Hide Forgot
Created attachment 527355 [details] beaker job xml file for infiniband perftest Description of problem: Beaker complains AVC error in multi-hosts automatic test case for infiniband perftest since .ssh/authorized_keys labeling problem. Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. delete two lines '/sbin/restorecon -R -v /root' in the attachment perftest_multi_host_i386.xml 2. bkr job-submit perftest_multi_host_i386.xml 3. Actual results: Info: Searching AVC errors produced since 1318239982.02 (Mon Oct 10 05:46:22 2011) Searching logs... Running '/usr/bin/env LC_ALL=en_US.UTF-8 /sbin/ausearch -m AVC -m USER_AVC -m SELINUX_ERR -ts 10/10/2011 05:46:22 < /dev/null >/mnt/testarea/tmp.rhts-db-submit-result.LLmn7z 2>&1' ---- time->Mon Oct 10 05:57:39 2011 type=SYSCALL msg=audit(1318240659.495:192438): arch=40000003 syscall=5 success=no exit=-13 a0=2133e58 a1=8800 a2=0 a3=212ea20 items=0 ppid=7206 pid=13464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1318240659.495:192438): avc: denied { read } for pid=13464 comm="sshd" name="authorized_keys" dev=dm-0 ino=1962391 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=file Fail: AVC messages found. Checking for errors... Using stronger AVC checks. Define empty RHTS_OPTION_STRONGER_AVC parameter if this causes any problems. Running 'cat /mnt/testarea/tmp.rhts-db-submit-result.LLmn7z | /sbin/ausearch -m AVC -m SELINUX_ERR' Fail: AVC messages found. Running 'cat %s | /sbin/ausearch -m USER_AVC >/mnt/testarea/tmp.rhts-db-submit-result.4iFPnP 2>&1' Info: No AVC messages found. /bin/grep 'avc: ' /mnt/testarea/dmesg.log | /bin/grep --invert-match TESTOUT.log No AVC messages found in dmesg Running '/usr/sbin/sestatus' SELinux status: enabled SELinuxfs mount: /selinux Current mode: enforcing Mode from config file: enforcing Policy version: 24 Policy from config file: targeted Running 'rpm -q selinux-policy || true' selinux-policy-3.7.19-107.el6.noarch Expected results: Additional info: Failed : https://beaker.engineering.redhat.com/jobs/141273 Succeed ： https://beaker.engineering.redhat.com/jobs/141287
I don't see how /root/.ssh dir is created from the attached xml. If you create it by hand # mkdir /root/.ssh then you need to run restorecon.
Hi, Miroslav /root/.ssh was created by the kickstart script, not the attached xml. /sbin/restorecon -R -v /root fix the issue. However, even without run restorecon ,these is no avc error when I run the test manually.
Then this kickstart should contain [ -x /sbin/restorecon ] && /sbin/restorecon /root/.ssh in the %post. How do you run it manually? Which steps?
In fact, the error message arose when the test script setup passwordless ssh-connections with an auto-expect script. But there is no avc error when I executed 'ssh_copy_id_exp rdma1' manually. ###### script trigger avc error ######### function ssh_copy_id_exp { TARGET_HOST=$1 # $1=rdma1 /usr/bin/expect << EOF set force_conservative 0 ;# set to 1 to force conservative mode even if ;# script wasn't run conservatively originally if {\$force_conservative} { set send_slow {1 .1} proc send {ignore arg} { sleep .1 exp_send -s -- \$arg } } set timeout -1 spawn ssh-copy-id ${TARGET_HOST} match_max 100000 expect -exact "root@${TARGET_HOST}'s password: " send -- "xxxxxx\r" expect eof EOF } ssh_copy_id_exp rdma1
Sorry for the typo, I executed manually 'ssh_copy_id rdma1', not 'ssh_copy_id_exp rdma1'.
ssh-copy-id contains "restorecon" so this is reason why it works.
However, as comment #5 saying, the auto-expect script call ssh-copy-id too. As the avc error message can be eliminated with '/sbin/restorecon', it is ok to close the bug. I will run restorecon with the kickstart post script, when I run multi-hosts test which need ssh-connections.
Are we talking about the same host?
Yes, all of the automatic tests run on rdma1.rhts.eng.bos.redhat.com and rdma2.rhts.eng.bos.redhat.com.
Ok, I would say to leave restorecon in the %post. Could you send the kickstart?
the main kickstart file: http://download.lab.bos.redhat.com/qa/rhts/lookaside/rdma-testing/rdma-setup.sh And I attached a few kickstart statement in the beaker job xml file.