Re: [Users] SELinux denials on Sanlock
On Tue, Jun 19, 2012 at 12:48 PM, David Teigland wrote:
> On Tue, Jun 19, 2012 at 01:29:30PM -0400, Daniel J Walsh wrote:
>> -BEGIN PGP SIGNED MESSAGE-
>> Hash: SHA1
>>
>> On 06/19/2012 12:13 PM, David Teigland wrote:
>> > type=AVC msg=audit(1340053766.745:7): avc: denied { open } for
>> >>> pid=1908 comm="wdmd" name="wdmd.pid" dev=dm-0 ino=1574530
>> >>> scontext=system_u:system_r:wdmd_t:s0
>> >>> tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
>> >>>
>> >>> type=AVC msg=audit(1340053766.746:8): avc: denied { lock } for
>> >>> pid=1908 comm="wdmd" path="/var/run/wdmd/wdmd.pid" dev=dm-0 ino=1574530
>> >>> scontext=system_u:system_r:wdmd_t:s0
>> >>> tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
>> >>>
>> >>> type=SYSCALL msg=audit(1340053766.746:8): arch=x86_64 syscall=fcntl
>> >>> success=yes exit=0 a0=4 a1=6 a2=7fffae656290 a3=fff3 items=0 ppid=1
>> >>> pid=1908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>> >>> sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=wdmd exe=/usr/sbin/wdmd
>> >>> subj=system_u:system_r:wdmd_t:s0 key=(null)
>>
>> THis is caused by a bug in sanlock, the init script for wdmd was creating the
>> /var/run/wdmd file but not running restorecon on it.
>
> Thanks, that was fixed back in Feb, so some old/wrong packages must be in
> use.
Thanks for the info. I'll keep an eye on it but so far after manually
running restorecon it's a non-issue.
Not sure which version had the fix but this is latest in CentOS 6.2 install
sanlock.x86_64 1.8-2.el6 @base
Thanks
- Trey
>
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
Re: [Users] SELinux denials on Sanlock
On Tue, Jun 19, 2012 at 01:29:30PM -0400, Daniel J Walsh wrote:
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> On 06/19/2012 12:13 PM, David Teigland wrote:
> > type=AVC msg=audit(1340053766.745:7): avc: denied { open } for
> >>> pid=1908 comm="wdmd" name="wdmd.pid" dev=dm-0 ino=1574530
> >>> scontext=system_u:system_r:wdmd_t:s0
> >>> tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
> >>>
> >>> type=AVC msg=audit(1340053766.746:8): avc: denied { lock } for
> >>> pid=1908 comm="wdmd" path="/var/run/wdmd/wdmd.pid" dev=dm-0 ino=1574530
> >>> scontext=system_u:system_r:wdmd_t:s0
> >>> tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
> >>>
> >>> type=SYSCALL msg=audit(1340053766.746:8): arch=x86_64 syscall=fcntl
> >>> success=yes exit=0 a0=4 a1=6 a2=7fffae656290 a3=fff3 items=0 ppid=1
> >>> pid=1908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
> >>> sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=wdmd exe=/usr/sbin/wdmd
> >>> subj=system_u:system_r:wdmd_t:s0 key=(null)
>
> THis is caused by a bug in sanlock, the init script for wdmd was creating the
> /var/run/wdmd file but not running restorecon on it.
Thanks, that was fixed back in Feb, so some old/wrong packages must be in
use.
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
Re: [Users] SELinux denials on Sanlock
On Tue, Jun 19, 2012 at 06:56:56PM +0300, Itamar Heim wrote:
> On 06/19/2012 12:50 AM, Trey Dockendorf wrote:
> >I don't know if this is the wrong place to ask this question, but I
> >just started seeing SELinux denials after adding an iSCSI storage
> >domain in oVirt using my first node. The node is reporting that
> >selinux is preventing /usr/sbin/wdmd from accessing the pid file for
> >that service.
>
> david?
>
> >
> >Here are the denials
> >
> >type=AVC msg=audit(1340053766.745:7): avc: denied { open } for
> >pid=1908 comm="wdmd" name="wdmd.pid" dev=dm-0 ino=1574530
> >scontext=system_u:system_r:wdmd_t:s0
> >tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
> >
> >type=AVC msg=audit(1340053766.746:8): avc: denied { lock } for
> >pid=1908 comm="wdmd" path="/var/run/wdmd/wdmd.pid" dev=dm-0
> >ino=1574530 scontext=system_u:system_r:wdmd_t:s0
> >tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
> >
> >type=SYSCALL msg=audit(1340053766.746:8): arch=x86_64 syscall=fcntl
> >success=yes exit=0 a0=4 a1=6 a2=7fffae656290 a3=fff3 items=0
> >ppid=1 pid=1908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
> >egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=wdmd
> >exe=/usr/sbin/wdmd subj=system_u:system_r:wdmd_t:s0 key=(null)
Dan, any ideas? Looks similar to the other recent pile of selinux stuff
here https://bugzilla.redhat.com/show_bug.cgi?id=831908
> >I ran restorecon on /var/run/wdmd and it changed from var_run_t to
> >wdmd_var_run_t. I'm not sure how to make sanlock run again to see if
> >that solved the issue. Is there a way to determine it's resolved?
Restart the machine?
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
Re: [Users] SELinux denials on Sanlock
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 06/19/2012 12:13 PM, David Teigland wrote:
> type=AVC msg=audit(1340053766.745:7): avc: denied { open } for
>>> pid=1908 comm="wdmd" name="wdmd.pid" dev=dm-0 ino=1574530
>>> scontext=system_u:system_r:wdmd_t:s0
>>> tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
>>>
>>> type=AVC msg=audit(1340053766.746:8): avc: denied { lock } for
>>> pid=1908 comm="wdmd" path="/var/run/wdmd/wdmd.pid" dev=dm-0 ino=1574530
>>> scontext=system_u:system_r:wdmd_t:s0
>>> tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
>>>
>>> type=SYSCALL msg=audit(1340053766.746:8): arch=x86_64 syscall=fcntl
>>> success=yes exit=0 a0=4 a1=6 a2=7fffae656290 a3=fff3 items=0 ppid=1
>>> pid=1908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>>> sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=wdmd exe=/usr/sbin/wdmd
>>> subj=system_u:system_r:wdmd_t:s0 key=(null)
THis is caused by a bug in sanlock, the init script for wdmd was creating the
/var/run/wdmd file but not running restorecon on it.
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk/gtvoACgkQrlYvE4MpobMWRQCgyKpnY2mQeLvRdbOEK6JfKP2m
K9IAnjc8TDq1wYDenCtt7CDjQQrw+F8I
=mM24
-END PGP SIGNATURE-
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
Re: [Users] SELinux denials on Sanlock
On 06/19/2012 12:50 AM, Trey Dockendorf wrote:
I don't know if this is the wrong place to ask this question, but I
just started seeing SELinux denials after adding an iSCSI storage
domain in oVirt using my first node. The node is reporting that
selinux is preventing /usr/sbin/wdmd from accessing the pid file for
that service.
david?
Here are the denials
type=AVC msg=audit(1340053766.745:7): avc: denied { open } for
pid=1908 comm="wdmd" name="wdmd.pid" dev=dm-0 ino=1574530
scontext=system_u:system_r:wdmd_t:s0
tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=AVC msg=audit(1340053766.746:8): avc: denied { lock } for
pid=1908 comm="wdmd" path="/var/run/wdmd/wdmd.pid" dev=dm-0
ino=1574530 scontext=system_u:system_r:wdmd_t:s0
tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1340053766.746:8): arch=x86_64 syscall=fcntl
success=yes exit=0 a0=4 a1=6 a2=7fffae656290 a3=fff3 items=0
ppid=1 pid=1908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=wdmd
exe=/usr/sbin/wdmd subj=system_u:system_r:wdmd_t:s0 key=(null)
I ran restorecon on /var/run/wdmd and it changed from var_run_t to
wdmd_var_run_t. I'm not sure how to make sanlock run again to see if
that solved the issue. Is there a way to determine it's resolved?
Thanks
- Trey
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
