Bug 697657 - kdump throws an error if policycoreutils is missing while propagating ssh keys
kdump throws an error if policycoreutils is missing while propagating ssh keys
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kexec-tools (Show other bugs)
6.0
All Linux
medium Severity medium
: rc
: ---
Assigned To: Dave Young
Cui Chun
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-04-18 16:53 EDT by Guil Barros
Modified: 2012-06-20 08:02 EDT (History)
6 users (show)

See Also:
Fixed In Version: kexec-tools-2.0.0-229.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-20 08:02:21 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch (729 bytes, patch)
2011-08-22 06:11 EDT, Cong Wang
no flags Details | Diff
do not depends on policycoreutils (996 bytes, patch)
2012-02-28 01:35 EST, Dave Young
no flags Details | Diff

  None (edit)
Description Guil Barros 2011-04-18 16:53:57 EDT
Description of problem:
kdump throws an error if policycoreutils is missing while propagating ssh keys

Version-Release number of selected component (if applicable):
kexec-tools-2.0.0-145.el6.i686

How reproducible:
every time

Steps to Reproduce:
1. do not install policycoreutils
2. configure kdump to use ssh
3. propagate ssh keys with 'service kdump propagate'
  
Actual results:
# service kdump propagate
/etc/init.d/kdump: line 281: /usr/sbin/sestatus: No such file or directory
Generating new ssh keys... done.
kdump@192.168.192.136's password: 
/root/.ssh/kdump_id_rsa.pub has been added to ~kdump/.ssh/authorized_keys on 192.168.192.136

Expected results:
# service kdump propagate
Generating new ssh keys... done.
kdump@192.168.192.136's password: 
/root/.ssh/kdump_id_rsa.pub has been added to ~kdump/.ssh/authorized_keys on 192.168.192.136
Comment 2 RHEL Product and Program Management 2011-04-19 02:00:59 EDT
Since RHEL 6.1 External Beta has begun, and this bug remains
unresolved, it has been rejected as it is not proposed as
exception or blocker.

Red Hat invites you to ask your support representative to
propose this request, if appropriate and relevant, in the
next release of Red Hat Enterprise Linux.
Comment 6 Cong Wang 2011-08-22 06:11:58 EDT
Created attachment 519258 [details]
Proposed patch

How about this patch? :)
Comment 7 Chao Ye 2011-08-23 02:57:40 EDT
(In reply to comment #6)
> Created attachment 519258 [details]
> Proposed patch
> 
> How about this patch? :)

With patch applied:
=========================================
[root@hp-xw9300-01 SOURCES]# service kdump propagate
No ssh config specified in /etc/kdump.conf.  Can't propagate
[root@hp-xw9300-01 SOURCES]# mv /etc/kdump.conf.rpmsave /etc/kdump.conf
mv:是否覆盖"/etc/kdump.conf"? y
[root@hp-xw9300-01 SOURCES]# service kdump propagate
Generating new ssh keys... open /root/.ssh/kdump_id_rsa failed: Permission denied.
done.
/root/.ssh/kdump_id_rsa.pub failed in transfer to 10.66.12.117
[root@hp-xw9300-01 SOURCES]# rpm -q policycoreutils
package policycoreutils is not installed
[root@hp-xw9300-01 SOURCES]# cat /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted
Comment 8 Cong Wang 2011-08-23 06:57:56 EDT
You need to pass selinux=0 to diable selinux totally.

With selinux=0, the patch works,

[root@dell-pe800-01 ~]# rpm -q policycoreutils
package policycoreutils is not installed
[root@dell-pe800-01 ~]# service kdump propagate
Generating new ssh keys... done.
root@10.3.230.99's password: 
/root/.ssh/kdump_id_rsa.pub has been added to ~root/.ssh/authorized_keys on 10.3.230.99
[root@dell-pe800-01 ~]# touch /etc/kdump.conf 
[root@dell-pe800-01 ~]# service kdump restart
Stopping kdump:[  OK  ]
Detected change(s) the following file(s):
  
  /etc/kdump.conf
Rebuilding /boot/initrd-2.6.32-191.el6.x86_64kdump.img

Starting kdump:[  OK  ]
Comment 9 Cong Wang 2011-08-23 07:00:39 EDT
The reason is that we will not support that you have selinux enabled but policycoreutils removed, this is a broken environment that you should fix, it is not kdump's fault to detect or fix this.

Also, I want to keep the patch as simple as possible.
Comment 10 Cong Wang 2011-08-23 07:03:17 EDT
With policycoreutils installed,

[root@dell-pe800-01 ~]# yum install -y policycoreutils
...
Installed:
  policycoreutils.x86_64 0:2.0.83-19.12.el6                                     

Complete!
[root@dell-pe800-01 ~]# service kdump propagate
Using existing keys...
/root/.ssh/kdump_id_rsa.pub has been added to ~root/.ssh/authorized_keys on 10.3.230.99
[root@dell-pe800-01 ~]# touch /etc/kdump.conf 
[root@dell-pe800-01 ~]# service kdump restart
Stopping kdump:[  OK  ]
Detected change(s) the following file(s):
  
  /etc/kdump.conf
Rebuilding /boot/initrd-2.6.32-191.el6.x86_64kdump.img
Starting kdump:[  OK  ]
Comment 15 Dave Young 2012-02-28 01:35:53 EST
Created attachment 566216 [details]
do not depends on policycoreutils
Comment 16 Dave Young 2012-02-28 01:41:09 EST
We did not found out why we need this setenforcing things, maybe some test without these code can help us find something.

For this bug, because we just need setenforce 0 or 1, so we can directly echo the value to selinuxfs. Please check if patch in comment #15 fix your problem.

I tested it for below case:
rpm -e policycoreutils
enforce set as 1:
 service kdump propagate
enforce set as 0:
 service kdump propagate
Comment 22 errata-xmlrpc 2012-06-20 08:02:21 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0758.html

Note You need to log in before you can comment on or make changes to this bug.