Re: [Users] SELinux denials on Sanlock

2012-06-19 Thread Itamar Heim

On 06/19/2012 12:50 AM, Trey Dockendorf wrote:

I don't know if this is the wrong place to ask this question, but I
just started seeing SELinux denials after adding an iSCSI storage
domain in oVirt using my first node.  The node is reporting that
selinux is preventing /usr/sbin/wdmd from accessing the pid file for
that service.


david?



Here are the denials

type=AVC msg=audit(1340053766.745:7): avc:  denied  { open } for
pid=1908 comm=wdmd name=wdmd.pid dev=dm-0 ino=1574530
scontext=system_u:system_r:wdmd_t:s0
tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file

type=AVC msg=audit(1340053766.746:8): avc:  denied  { lock } for
pid=1908 comm=wdmd path=/var/run/wdmd/wdmd.pid dev=dm-0
ino=1574530 scontext=system_u:system_r:wdmd_t:s0
tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file

type=SYSCALL msg=audit(1340053766.746:8): arch=x86_64 syscall=fcntl
success=yes exit=0 a0=4 a1=6 a2=7fffae656290 a3=fff3 items=0
ppid=1 pid=1908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=wdmd
exe=/usr/sbin/wdmd subj=system_u:system_r:wdmd_t:s0 key=(null)



I ran restorecon on /var/run/wdmd and it changed from var_run_t to
wdmd_var_run_t.  I'm not sure how to make sanlock run again to see if
that solved the issue.  Is there a way to determine it's resolved?


Thanks

- Trey
___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users


Re: [Users] SELinux denials on Sanlock

2012-06-19 Thread David Teigland
On Tue, Jun 19, 2012 at 01:29:30PM -0400, Daniel J Walsh wrote:
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1
 
 On 06/19/2012 12:13 PM, David Teigland wrote:
  type=AVC msg=audit(1340053766.745:7): avc:  denied  { open } for
  pid=1908 comm=wdmd name=wdmd.pid dev=dm-0 ino=1574530 
  scontext=system_u:system_r:wdmd_t:s0 
  tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
  
  type=AVC msg=audit(1340053766.746:8): avc:  denied  { lock } for 
  pid=1908 comm=wdmd path=/var/run/wdmd/wdmd.pid dev=dm-0 ino=1574530
  scontext=system_u:system_r:wdmd_t:s0 
  tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
  
  type=SYSCALL msg=audit(1340053766.746:8): arch=x86_64 syscall=fcntl 
  success=yes exit=0 a0=4 a1=6 a2=7fffae656290 a3=fff3 items=0 ppid=1
  pid=1908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
  sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=wdmd exe=/usr/sbin/wdmd
  subj=system_u:system_r:wdmd_t:s0 key=(null)
 
 THis is caused by a bug in sanlock, the init script for wdmd was creating the
 /var/run/wdmd file but not running restorecon on it.

Thanks, that was fixed back in Feb, so some old/wrong packages must be in
use.

___
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users