Description of problem:

Unable to mount gfs2 file systems after upgrading to latest selinux-policy and SELinux=enforcing

The SELinux fcontext (selinux-policy-3.9.7-37.fc14.noarch) for the /dev nodes created by dlm/dlm_controld are set to device_t when they should be dlm_control_device_t for, minimally; 

/dev/dlm-control 
/dev/dlm-monitor
/dev/dlm_plock
/dev/dlm_rgmanager

Not sure if dlm_rgmanager needs to have the same fcontext. At present, it's also set to device_t.

Version-Release number of selected component (if applicable):

selinux-policy-3.9.7-37.fc14.noarch
cman-3.1.1-1.fc14.x86_64

How reproducible:

With selinux=enforcing, it's every time the system attempts to mount a gfs2 filesystem after restarting the cluster (/etc/init.d/cman restart).

Steps to Reproduce:

1. Upgrade to selinux-policy-3.9.7-37.fc14 & selinux=Enforcing
2. service cman start
3. service gfs2 start
  
Actual results:

gfs_controld fails to start (get error "dlm: no local IP address has been set", gfs2 file system doesn't mount and the following AVC's appear in /var/log/audit/audit.log:

type=AVC msg=audit(1301325627.439:67): avc:  denied  { getattr } for  pid=6086 comm="dlm_controld" path="/dev/dlm-control" dev=devtmpfs ino=26028 scontext=unconfined_u:system_
r:dlm_controld_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file
type=AVC msg=audit(1301325627.439:68): avc:  denied  { read } for  pid=6086 comm="dlm_controld" name="dlm-monitor" dev=devtmpfs ino=26030 scontext=unconfined_u:system_r:dlm_controld_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file
type=AVC msg=audit(1301325627.439:68): avc:  denied  { open } for  pid=6086 comm="dlm_controld" name="dlm-monitor" dev=devtmpfs ino=26030 scontext=unconfined_u:system_r:dlm_controld_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file
type=AVC msg=audit(1301325627.452:69): avc:  denied  { write } for  pid=6086 comm="dlm_controld" name="dlm_plock" dev=devtmpfs ino=26036 scontext=unconfined_u:system_r:dlm_controld_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=chr_file


Expected results:

Able to mount gfs2 file systems (and no AVCs for dlm_controld while with SELINUX=Enforcing


Additional info:

After updating the fcontexts for /dev/dlm* to dlm_control_device_t (from device_t) and updating load_kernel_modules() function in the cman init script:

fcontext updates:

semanage fcontext -a -t dlm_control_device_t -f -c /dev/dlm-control
semanage fcontext -a -t dlm_control_device_t -f -c /dev/dlm_plock
semanage fcontext -a -t dlm_control_device_t -f -c /dev/dlm-monitor
semanage fcontext -a -t dlm_control_device_t -f -c /dev/dlm_rgmanager

/etc/init.d/cman update:

load_kernel_modules()
{
        errmsg=$( modprobe configfs 2>&1 ) || return 1
        errmsg=$( modprobe dlm 2>&1 ) || return 1
        restorecon -F /dev/dlm* || return 1 # Added
}

Cluster now starts as expected, gfs2 file systems can be mounted, etc.

So I think the following things need to be addressed:

RHCS needs to ensure the DLM device nodes - /dev/dlm{-control, -monitor, _plock, _rgmanager} - get set to the correct fcontext (dlm_control_device_t) and not their present "device_t".

selinux-policy needs to add FC specs for all of the above DLM nodes.