[LU-6784] Defects in SELinux support

• Type: Bug
• Resolution: Fixed
• Priority: Blocker
• Affects Version/s: Lustre 2.8.0
• Severity: 3
• Assignee: WC Triage
• Reporter: Andrew Perepechko

Description

I was asked to file a ticket and summarize defects in the landed implementation of SELinux support which had been reported prior to landing:

1) [performance] create and setxattr are separate RPCs which makes things slow
2) [recovery] create and setxattr are separate RPCs, if the client crashes in between of create and setxattr, the file will not get a security label; client kernels will use default security labels in this case, but default label concept is not to work around file system bugs and no default label will be consistent with SELinux security model
3) [atomicity] create and setxattr are separate RPCs, if another client accesses the same file, it will see no security label, it will raise the same issues as in (2)
4) [consistent file system view from different clients] although initial versions of the landed patch made attempts to synchronize relabel operations among clients, the final patch does not implement any synchronization, so inodes in memory will keep old security labels in inode->i_security (this is documented in LU-5560)

Issue Links

• is blocking: LU-5560 SELinux support on the client side
• is related to: LU-9193 Multiple hangs observed with many open/getattr
• is related to: LU-13742 Provide an selinux_is_enabled for newer kernels
• is related to: LU-5074 Connection flag reservation for Secure Data Appliance
• is related to: LU-8955 Send SELinux policy info to server