Ceph

http://qa-proxy.ceph.com/teuthology/bhubbard-2020-02-07_02:46:52-ceph-ansible-wip-badone-testing-distro-basic-smithi/4739367/teuthology.log

Note that the above run is not using ceph-deploy, but rather ceph-ansible.

SELinux is preventing /usr/bin/ceph-osd from using the setsched access on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that ceph-osd should be allowed setsched access on processes labeled ceph_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'fn_anonymous' --raw | audit2allow -M my-fnanonymous
# semodule -i my-fnanonymous.pp

Additional Information:
Source Context                system_u:system_r:ceph_t:s0
Target Context                system_u:system_r:ceph_t:s0
Target Objects                Unknown [ process ]
Source                        fn_anonymous
Source Path                   /usr/bin/ceph-osd
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           ceph-osd-14.2.7-437.geae77db.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-252.el7_7.6.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     smithi093
Platform                      Linux smithi093 3.10.0-1062.12.1.el7.x86_64 #1 SMP
                              Tue Feb 4 23:02:59 UTC 2020 x86_64 x86_64
Alert Count                   1
First Seen                    2020-02-10 03:16:46 UTC
Last Seen                     2020-02-10 03:16:46 UTC
Local ID                      0f02f878-2aac-4683-b803-67bc4deea7ad

Raw Audit Messages
type=AVC msg=audit(1581304606.562:6693): avc:  denied  { setsched } for  pid=14311 comm="fn_anonymous" scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:system_r:ceph_t:s0 tclass=process permissive=1

type=SYSCALL msg=audit(1581304606.562:6693): arch=x86_64 syscall=sched_setaffinity success=yes exit=0 a0=37e7 a1=8 a2=560699b8a7b0 a3=7f0ccd7740e0 items=0 ppid=1 pid=14311 auid=4294967295 uid=167 gid=167 euid=167 suid=167 fsuid=167 egid=167 sgid=167 fsgid=167 tty=(none) ses=4294967295 comm=fn_anonymous exe=/usr/bin/ceph-osd subj=system_u:system_r:ceph_t:s0 key=(null)

Hash: fn_anonymous,ceph_t,ceph_t,process,setsched

SELinux is preventing /usr/bin/ceph-mon from getattr access on the file /proc/kcore.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that ceph-mon should be allowed getattr access on the kcore file by default.                           
Then you should report this as a bug.
You can generate a local policy module to allow this access.                                                          
Do                                                                                                                    
allow this access for now by executing:    
# ausearch -c 'ms_dispatch' --raw | audit2allow -M my-msdispatch
# semodule -i my-msdispatch.pp                 

Additional Information:                                                                                               
Source Context                system_u:system_r:ceph_t:s0
Target Context                system_u:object_r:proc_kcore_t:s0       
Target Objects                /proc/kcore [ file ]                                                                    
Source                        ms_dispatch
Source Path                   /usr/bin/ceph-mon
Port                          <Unknown>                                                                                                                                                                                                      
Host                          <Unknown>                                                                               
Source RPM Packages           ceph-mon-14.2.7-437.geae77db.el7.x86_64  
Target RPM Packages                                                                                                                                                                                                                          Policy RPM                    selinux-policy-3.13.1-252.el7_7.6.noarch                                                                                                                                                                       
Selinux Enabled               True                   
Policy Type                   targeted                                                                                
Enforcing Mode                Permissive
Host Name                     smithi093
Platform                      Linux smithi093 3.10.0-1062.12.1.el7.x86_64 #1 SMP
                              Tue Feb 4 23:02:59 UTC 2020 x86_64 x86_64
Alert Count                   1
First Seen                    2020-02-10 03:14:06 UTC
Last Seen                     2020-02-10 03:14:06 UTC
Local ID                      0ba12610-4b86-4a69-82bc-292d8b04da10

Raw Audit Messages
type=AVC msg=audit(1581304446.209:5735): avc:  denied  { getattr } for  pid=8319 comm="ms_dispatch" path="/proc/kcore" dev="proc" ino=4026532039 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file 
permissive=1

type=SYSCALL msg=audit(1581304446.209:5735): arch=x86_64 syscall=newfstatat success=yes exit=0 a0=21 a1=55a4e81f40eb a2=7f7c050c3880 a3=0 items=0 ppid=1 pid=8319 auid=4294967295 uid=167 gid=167 euid=167 suid=167 fsuid=167 egid=167 sgid=1
67 fsgid=167 tty=(none) ses=4294967295 comm=ms_dispatch exe=/usr/bin/ceph-mon subj=system_u:system_r:ceph_t:s0 key=(null)

Hash: ms_dispatch,ceph_t,proc_kcore_t,file,getattr

Looks like the setsched issue might be new. Let me know if we need a new tracker for that one.

Seeing the 'setsched' fn_anonymous denial on master as well.

sectched denial being handled in https://tracker.ceph.com/issues/44196

Full description of the getattr on /proc/kcore denial at https://tracker.ceph.com/issues/43064#note-10

# ausearch -c 'ms_dispatch' --raw | audit2allow -M my-msdispatch
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i my-msdispatch.pp

# cat my-msdispatch.te 

module my-msdispatch 1.0;

require {
        type ceph_t;
        type proc_kcore_t;
        class file getattr;
}

#============= ceph_t ==============
allow ceph_t proc_kcore_t:file getattr;

https://github.com/ceph/ceph/pull/34870 merged