From 52d653dcef43d4b823784a6dec3f0e88e5a0046f Mon Sep 17 00:00:00 2001 From: Mike Christie Date: Wed, 8 Jan 2020 18:03:40 -0600 Subject: [PATCH] selinux: Fix ceph-iscsi configfs access This fixes the the following selinux error when using ceph-iscsi's rbd-target-api daemon (rbd-target-gw has the same issue). They are a result of the a python library, rtslib, which the daemons use. Additional Information: Source Context system_u:system_r:ceph_t:s0 Target Context system_u:object_r:configfs_t:s0 Target Objects /sys/kernel/config/target/iscsi/iqn.2003-01.com.re dhat:ceph-iscsi/tpgt_1/attrib/authentication [ file ] Source rbd-target-api Source Path /usr/libexec/platform-python3.6 Port Host ans8 Source RPM Packages platform-python-3.6.8-15.1.el8.x86_64 Target RPM Packages Policy RPM selinux-policy-3.14.3-20.el8.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name ans8 Platform Linux ans8 4.18.0-147.el8.x86_64 #1 SMP Thu Sep 26 15:52:44 UTC 2019 x86_64 x86_64 Alert Count 1 First Seen 2020-01-08 18:39:47 EST Last Seen 2020-01-08 18:39:47 EST Local ID 6f8c3415-7a50-4dc8-b3d2-2621e1d00ca3 Raw Audit Messages type=AVC msg=audit(1578526787.577:68): avc: denied { ioctl } for pid=995 comm="rbd-target-api" path="/sys/kernel/config/target/iscsi/iqn.2003-01.com.redhat:ceph-iscsi/tpgt_1/attrib/authentication" dev="configfs" ino=25703 ioctlcmd=0x5401 scontext=system_u:system_r:ceph_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=file permissive=1 type=SYSCALL msg=audit(1578526787.577:68): arch=x86_64 syscall=ioctl success=no exit=ENOTTY a0=34 a1=5401 a2=7ffd4f8f1f60 a3=3052cd2d95839b96 items=0 ppid=1 pid=995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=rbd-target-api exe=/usr/libexec/platform-python3.6 subj=system_u:system_r:ceph_t:s0 key=(null) Hash: rbd-target-api,ceph_t,configfs_t,file,ioctl Signed-off-by: Mike Christie (cherry picked from commit 8187235c91e897cb8c167ee4cbb90d910103709b) --- selinux/ceph.te | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux/ceph.te b/selinux/ceph.te index 9a481b096e289..dc0a60cde4abb 100644 --- a/selinux/ceph.te +++ b/selinux/ceph.te @@ -21,7 +21,7 @@ require { class tcp_socket name_connect_t; class lnk_file { create getattr read unlink }; class dir { add_name create getattr open read remove_name rmdir search write }; - class file { create getattr open read rename unlink write }; + class file { create getattr open read rename unlink write ioctl }; class blk_file { getattr ioctl open read write }; class capability2 block_suspend; class process2 { nnp_transition nosuid_transition }; @@ -143,7 +143,7 @@ allow ceph_t sysfs_t:file { read getattr open }; allow ceph_t sysfs_t:lnk_file { read getattr }; allow ceph_t configfs_t:dir { add_name create getattr open read remove_name rmdir search write }; -allow ceph_t configfs_t:file { getattr open read write }; +allow ceph_t configfs_t:file { getattr open read write ioctl }; allow ceph_t configfs_t:lnk_file { create getattr read unlink };