https://jira.whamcloud.com This file is an XML representation of an issue en-us 9.4.14 940014 05-12-2023 https://jira.whamcloud.com/browse/LU-857 Lustre <p>This issue impacts Lustre 2.x releases on RHEL 6. This is possible that the same issues exists with Lustre 1.x.</p> <p>The problem is that you cannot use a Lustre filesystem with SELinux enforced, even if your Lustre policies only apply to all other filesystems, but not Lustre!</p> <p>If you do so, accesses to Lustre directories will be denied in some cases. However, file accesses in the same directory are granted. There is no SELinux policy involved here. This kind of configuration is used in production on our Lustre 1.6/RHEL 5 systems without any issues.</p> <p>Here is a 2-line patch to have a common behavior on RHEL5/RHEL6.<br/> Note: It does not add a real SELinux support for Lustre but ables to activate it for all other local filesystems, without Lustre misbehaving.</p> <p>Steps to reproduce the issue:</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java"># setenforce Enforcing # cd /mnt/lustre # mkdir foo # cd foo # ls: Permission denied </pre> </div></div> LU-857

Lustre client tolerates enforced SELinux.

Improvement Minor Resolved Fixed Niu Yawei Aurelien Degremont Wed, 16 Nov 2011 07:41:23 +0000 Tue, 23 Jul 2013 01:03:14 +0000 Wed, 23 Nov 2011 07:33:05 +0000 Lustre 2.0.0 Lustre 2.1.0 Lustre 2.2.0 Lustre 2.1.3 0 3 <p>Patch for review:<br/> <a href="http://review.whamcloud.com/#change,1703" class="external-link" target="_blank" rel="nofollow noopener">http://review.whamcloud.com/#change,1703</a></p> <p>Niu</p> <p>Could you please review the supplied patch?</p> <p>Thanks</p> <p>Peter</p> <p>Hi Aurelien</p> <p>I'm wondering how to test this patch. In my local environment, I can't even mount lustre on loop devices with selinux enabled (in permissive mode), could you show me how to mount lustre in permissive mode? Thank you.</p> <p>Hi</p> <p>To test it, I setup a simple test environment with 2 nodes. 1 for servers, 1 for client.<br/> With Lustre, SELinux is ok on Client, but absolutely not on Servers.</p> <p>Something like</p> <p><tt>NAME=ncli REFORMAT=: RCLIENTS="foo2" sh ./llmount.sh</tt></p> <p>Should do the trick</p> <p>Set SELinux in permissive mode on your RHEL6 client (/etc/sysconfig/selinux). You change to permissive/enforced using <tt>setenforce</tt><br/> Let SELinux disabled on your server node.</p> <p>Thank you, Aurelien. I've added reviewers in the gerrit.</p> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=x86_64,build_type=client,distro=el5,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » x86_64,client,el5,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=x86_64,build_type=server,distro=el5,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » x86_64,server,el5,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=i686,build_type=client,distro=el6,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » i686,client,el6,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=x86_64,build_type=client,distro=sles11,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » x86_64,client,sles11,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=x86_64,build_type=server,distro=el5,ib_stack=ofa/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » x86_64,server,el5,ofa #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=x86_64,build_type=client,distro=ubuntu1004,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » x86_64,client,ubuntu1004,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=x86_64,build_type=client,distro=el5,ib_stack=ofa/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » x86_64,client,el5,ofa #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=i686,build_type=server,distro=el6,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » i686,server,el6,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=x86_64,build_type=client,distro=el6,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » x86_64,client,el6,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=i686,build_type=server,distro=el5,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » i686,server,el5,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=i686,build_type=server,distro=el5,ib_stack=ofa/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » i686,server,el5,ofa #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=x86_64,build_type=server,distro=el6,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » x86_64,server,el6,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=i686,build_type=client,distro=el5,ib_stack=inkernel/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » i686,client,el5,inkernel #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>Integrated in <span class="image-wrap" style=""><img src="http://build.whamcloud.com/images/16x16/blue.png" style="border: 0px solid black" /></span> <a href="http://build.whamcloud.com/job/lustre-master/./arch=i686,build_type=client,distro=el5,ib_stack=ofa/360/" class="external-link" target="_blank" rel="nofollow noopener">lustre-master » i686,client,el5,ofa #360</a><br/> <a href="https://jira.whamcloud.com/browse/LU-857" title="Lustre client tolerates enforced SELinux." class="issue-link" data-issue-key="LU-857"><del>LU-857</del></a> security: Lustre client tolerates enforced SELinux. (Revision bf977ae5a02765f86b1920ae207cc1fe328011cb)</p> <p> Result = SUCCESS<br/> Oleg Drokin : <a href="http://git.whamcloud.com/gitweb?p=fs/lustre-release.git;a=shortlog;h=refs/heads/master&amp;a=commit&amp;h=bf977ae5a02765f86b1920ae207cc1fe328011cb" class="external-link" target="_blank" rel="nofollow noopener">bf977ae5a02765f86b1920ae207cc1fe328011cb</a><br/> Files : </p> <ul> <li>lustre/llite/namei.c</li> </ul> <p>patch landed for 2.2</p> <p>This patch adds a security_d_instantiate() call under dcache_lock, while Selinux implementation of the LSM hook can sleep (calls mutex_lock, kmalloc, getxattr).</p> <div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent"> <pre class="code-java">BUG: spinlock wrong CPU on CPU#0, diff/5435 (Tainted: G W ---------------- ) lock: ffffffff81a84780, .magic: dead4ead, .owner: diff/5435, .owner_cpu: 3 Pid: 5435, comm: diff Tainted: G W ---------------- 2.6.32-220.4.3.el6.x86_64 #10 Call Trace: [&lt;ffffffff8128a88a&gt;] ? spin_bug+0xaa/0x100 [&lt;ffffffff8128a956&gt;] ? _raw_spin_unlock+0x76/0xa0 [&lt;ffffffff8150739b&gt;] ? _spin_unlock+0x2b/0x40 [&lt;ffffffffa0eab1d5&gt;] ? ll_d_add+0x75/0x210 [lustre] [&lt;ffffffff8150739b&gt;] ? _spin_unlock+0x2b/0x40 [&lt;ffffffffa0eac602&gt;] ? ll_lookup_it_finish+0x8f2/0xa60 [lustre] [&lt;ffffffffa0eaa4ee&gt;] ? ll_i2gids+0x2e/0xe0 [lustre] [&lt;ffffffffa0eacb8e&gt;] ? ll_lookup_it+0x41e/0xc00 [lustre] [&lt;ffffffffa0eaa5a0&gt;] ? ll_md_blocking_ast+0x0/0x620 [lustre] [&lt;ffffffffa0ead5cf&gt;] ? ll_lookup_nd+0x25f/0x3e0 [lustre] [&lt;ffffffff8119993e&gt;] ? d_alloc+0x17e/0x1f0 [&lt;ffffffff8118edac&gt;] ? do_lookup+0x16c/0x1e0 [&lt;ffffffff8118f12d&gt;] ? __link_path_walk+0x20d/0x1080 [&lt;ffffffff8119023a&gt;] ? path_walk+0x6a/0xe0 [&lt;ffffffff8119040b&gt;] ? do_path_lookup+0x5b/0xa0 [&lt;ffffffff81191077&gt;] ? user_path_at+0x57/0xa0 [&lt;ffffffff811858c4&gt;] ? cp_new_stat+0xe4/0x100 [&lt;ffffffff81185af6&gt;] ? vfs_fstatat+0x46/0x80 [&lt;ffffffff81185c5b&gt;] ? vfs_stat+0x1b/0x20 [&lt;ffffffff81185c84&gt;] ? sys_newstat+0x24/0x50 [&lt;ffffffff810dcc22&gt;] ? audit_syscall_entry+0x272/0x2a0 </pre> </div></div> Development Rank 1|hzv82v: Rank (Obsolete) 4843