Project

General

Profile

Bug #55443

"SELinux denials found.." in rados run

Added by Yuri Weinstein 8 months ago. Updated 4 months ago.

Status:
New
Priority:
Urgent
Assignee:
% Done:

0%

Source:
Tags:
Backport:
Regression:
No
Severity:
3 - minor
Reviewed:
Affected Versions:
ceph-qa-suite:
Crash signature (v1):
Crash signature (v2):

Description

Run: http://pulpito.front.sepia.ceph.com/yuriw-2022-04-23_16:12:08-rados-wip-55324-pacific-backport-distro-default-smithi/
Jobs: ['6803080', '6803087', '6803132', '6803104', '6803113', '6803128', '6803112', '6803134', '6803107', '6803103']
Logs: http://qa-proxy.ceph.com/teuthology/yuriw-2022-04-23_16:12:08-rados-wip-55324-pacific-backport-distro-default-smithi/6803080/teuthology.log

SELinux denials found on ubuntu@smithi120.front.sepia.ceph.com: ['type=AVC msg=audit(1650731309.430:200): avc: denied { node_bind } for pid=1997 comm="ping" saddr=172.21.15.120 scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:node_t:s0 tclass=icmp_socket permissive=1']

History

#1 Updated by Brad Hubbard 8 months ago

This looks like another systems issue, similar in nature to https://bugzilla.redhat.com/show_bug.cgi?id=1848929 so I think the only way we can get the tests passing until this is resolved in centos is to mask these selinux denials in the teuthology code so they are ignored.

Going to move this to infrastructure so David can give his input.

#2 Updated by Brad Hubbard 8 months ago

  • Project changed from Ceph to Infrastructure

#4 Updated by David Galloway 7 months ago

Yeah, I don't see anything indicating Ceph is doing the ping so it should be fine to whitelist.

#6 Updated by Yuri Weinstein 7 months ago

  • Priority changed from Normal to Urgent

#7 Updated by Laura Flores 7 months ago

Octopus too:

/a/yuriw-2022-04-26_20:58:55-rados-wip-yuri2-testing-2022-04-26-1132-octopus-distro-default-smithi/6807537

SELinux denials found on ubuntu@smithi186.front.sepia.ceph.com: ['type=AVC msg=audit(1651114126.589:7615): avc: denied { ioctl } for pid=42421 comm="iptables" path="/var/lib/containers/storage/overlay/45b930a7fa22d5f3f9b2b1b82e1fa0c602112ec6d6aa1e8625f5bc8c8f39a8e0/merged" dev="overlay" ino=3541410 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:container_file_t:s0:c1022,c1023 tclass=dir permissive=1', 'type=AVC msg=audit(1651114126.773:7617): avc: denied { ioctl } for pid=42454 comm="iptables" path="/var/lib/containers/storage/overlay/45b930a7fa22d5f3f9b2b1b82e1fa0c602112ec6d6aa1e8625f5bc8c8f39a8e0/merged" dev="overlay" ino=3541410 scontext=system_u:system_r:iptables_t:s0 tcontext=system_u:object_r:container_file_t:s0:c1022,c1023 tclass=dir permissive=1'] 

#8 Updated by Brad Hubbard 7 months ago

Laura Flores wrote:

Octopus too:

/a/yuriw-2022-04-26_20:58:55-rados-wip-yuri2-testing-2022-04-26-1132-octopus-distro-default-smithi/6807537
[...]

@Laura I think we are looking at that one in https://tracker.ceph.com/issues/55347 right?

#9 Updated by Laura Flores 7 months ago

Brad Hubbard wrote:

@Laura I think we are looking at that one in https://tracker.ceph.com/issues/55347 right?

Ah yes, thanks Brad.

#10 Updated by Sridhar Seshasayee 6 months ago

/a/yuriw-2022-06-15_18:29:33-rados-wip-yuri4-testing-2022-06-15-1000-pacific-distro-default-smithi/6881417

#11 Updated by Kamoltat (Junior) Sirivadhna 4 months ago

/a/yuriw-2022-08-04_11:58:29-rados-wip-yuri3-testing-2022-08-03-0828-pacific-distro-default-smithi/6958123

#12 Updated by Kamoltat (Junior) Sirivadhna 4 months ago

/a/yuriw-2022-08-04_11:58:29-rados-wip-yuri3-testing-2022-08-03-0828-pacific-distro-default-smithi/6958226

#13 Updated by Kamoltat (Junior) Sirivadhna 4 months ago

/a/yuriw-2022-08-04_11:58:29-rados-wip-yuri3-testing-2022-08-03-0828-pacific-distro-default-smithi/6958331

#14 Updated by Laura Flores 4 months ago

/a/yuriw-2022-08-11_16:46:00-rados-wip-yuri3-testing-2022-08-11-0809-pacific-distro-default-smithi/6968124

#15 Updated by Matan Breizman 4 months ago

/a/yuriw-2022-08-22_21:19:34-rados-wip-yuri4-testing-2022-08-18-1020-pacific-distro-default-smithi/6986470

/a/yuriw-2022-08-22_21:19:34-rados-wip-yuri4-testing-2022-08-18-1020-pacific-distro-default-smithi/6986482

/a/yuriw-2022-08-22_21:19:34-rados-wip-yuri4-testing-2022-08-18-1020-pacific-distro-default-smithi/6986492

Also available in: Atom PDF