Project

General

Profile

Actions
Copy link

Bug #44196

closed

selinux setsched denials for 'fn_anonymous'

Added by Brad Hubbard about 4 years ago. Updated about 4 years ago.

Status:
Resolved
Priority:
High
Assignee:
-
Category:
common
Target version:
-
% Done:

0%

Source:
Development
Tags:
Backport:
nautilus
Regression:
No
Severity:
2 - major
Reviewed:
Affected Versions:
ceph-qa-suite:
Pull request ID:
33404
Crash signature (v1):
Crash signature (v2):

Description

type=AVC msg=audit(1582069840.087:6495): avc:  denied  { setsched } for  pid=27310 comm="fn_anonymous" scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:system_r:ceph_t:s0 tclass=process permissive=1

I can reproduce this with the code at https://bytefreaks.net/programming-2/c/cc-set-affinity-to-process-thread-example-code

# gcc -Wall /home/ubuntu/affinity.c -o /tmp/affinity
# chcon -t ceph_exec_t -u system_u /tmp/affinity
# runcon system_u:system_r:ceph_t:s0 /tmp/affinity
Successfully set thread 75076 to affinity to CPU 3
# grep -P "setsched" /var/log/audit/audit.log|tail -1
type=AVC msg=audit(1582081291.505:7290): avc:  denied  { setsched } for  pid=75076 comm="affinity" scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:system_r:ceph_t:s0 tclass=process permissive=1

This seems to be happening in the NUMA code according to timestamps from the logs so would almost certainly be this code.

$ ag sched_setaffinity src/common/numa.cc
158:  int r = sched_setaffinity(getpid(), cpu_set_size, cpu_set);
178:      r = sched_setaffinity(tid, cpu_set_size, cpu_set);

Related issues 2 (0 open — 2 closed)

Related to Ceph - Bug #40743: "SELinux denials found" in ceph-deploy/nautilusResolvedBrad Hubbard

Actions
Copied to Ceph - Backport #44260: nautilus: selinux setsched denials for 'fn_anonymous'ResolvedBrad HubbardActions
Actions
Copy link

Also available in: Atom PDF