<!-- 
RSS generated by JIRA (9.4.14#940014-sha1:734e6822bbf0d45eff9af51f82432957f73aa32c) at Sat Feb 10 02:19:28 UTC 2024

It is possible to restrict the fields that are returned in this document by specifying the 'field' parameter in your request.
For example, to request only the issue key and summary append 'field=key&field=summary' to the URL of your request.
-->
<rss version="0.92" >
<channel>
    <title>Whamcloud Community JIRA</title>
    <link>https://jira.whamcloud.com</link>
    <description>This file is an XML representation of an issue</description>
    <language>en-us</language>    <build-info>
        <version>9.4.14</version>
        <build-number>940014</build-number>
        <build-date>05-12-2023</build-date>
    </build-info>


<item>
            <title>[LU-8659] sanity-selinux test_20a: test_20 passing even when localhost returning Permission Denied</title>
                <link>https://jira.whamcloud.com/browse/LU-8659</link>
                <project id="10000" key="LU">Lustre</project>
                    <description>&lt;p&gt;This issue was created by maloo for Saurabh Tandan &amp;lt;saurabh.tandan@intel.com&amp;gt;&lt;/p&gt;

&lt;p&gt;This issue relates to the following test suite run: &lt;a href=&quot;https://testing.hpdd.intel.com/test_sets/b0261008-85e9-11e6-a8b7-5254006e85c2&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://testing.hpdd.intel.com/test_sets/b0261008-85e9-11e6-a8b7-5254006e85c2&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;The sub-test test_20a failed with the following error:&lt;/p&gt;
&lt;div class=&quot;preformatted panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;preformattedContent panelContent&quot;&gt;
&lt;pre&gt;localhost: ssh exited with exit code 255
&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;
&lt;p&gt;Test_logs:&lt;/p&gt;
&lt;div class=&quot;preformatted panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;preformattedContent panelContent&quot;&gt;
&lt;pre&gt;== sanity-selinux test 20a: [atomicity] concurrent access from another client (file) ================= 02:04:40 (1475114680)
CMD: trevis-66vm1.trevis.hpdd.intel.com /usr/sbin/lctl set_param fail_val=20 fail_loc=0x1409
fail_val=20
fail_loc=0x1409
localhost: Warning: Permanently added &apos;localhost&apos; (ECDSA) to the list of known hosts.
localhost: Permission denied, please try again.
localhost: Received disconnect from UNKNOWN: 2: Too many authentication failures for sanityusr
pdsh@trevis-66vm1: localhost: ssh exited with exit code 255
ls: cannot access /mnt/lustre/df20a: No such file or directory
Resetting fail_loc on all nodes...CMD: trevis-66vm1.trevis.hpdd.intel.com,trevis-66vm2,trevis-66vm3,trevis-66vm7,trevis-66vm8 lctl set_param -n fail_loc=0 	    fail_val=0 2&amp;gt;/dev/null
done.
CMD: trevis-66vm1.trevis.hpdd.intel.com,trevis-66vm2,trevis-66vm3,trevis-66vm7,trevis-66vm8 rc=0;
val=\$(/usr/sbin/lctl get_param -n catastrophe 2&amp;gt;&amp;amp;1);
if [[ \$? -eq 0 &amp;amp;&amp;amp; \$val -ne 0 ]]; then
	echo \$(hostname -s): \$val;
	rc=\$val;
fi;
exit \$rc
CMD: trevis-66vm1.trevis.hpdd.intel.com,trevis-66vm2,trevis-66vm3,trevis-66vm7,trevis-66vm8 dmesg
&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;

&lt;p&gt;test_20 passing even when the localhost is returning Permission denied.&lt;/p&gt;</description>
                <environment>master</environment>
        <key id="40226">LU-8659</key>
            <summary>sanity-selinux test_20a: test_20 passing even when localhost returning Permission Denied</summary>
                <type id="1" iconUrl="https://jira.whamcloud.com/secure/viewavatar?size=xsmall&amp;avatarId=11303&amp;avatarType=issuetype">Bug</type>
                                            <priority id="3" iconUrl="https://jira.whamcloud.com/images/icons/priorities/major.svg">Major</priority>
                        <status id="5" iconUrl="https://jira.whamcloud.com/images/icons/statuses/resolved.png" description="A resolution has been taken, and it is awaiting verification by reporter. From here issues are either reopened, or are closed.">Resolved</status>
                    <statusCategory id="3" key="done" colorName="success"/>
                                    <resolution id="1">Fixed</resolution>
                                        <assignee username="sbuisson">Sebastien Buisson</assignee>
                                    <reporter username="maloo">Maloo</reporter>
                        <labels>
                    </labels>
                <created>Fri, 30 Sep 2016 21:31:40 +0000</created>
                <updated>Sat, 20 May 2017 19:25:47 +0000</updated>
                            <resolved>Sat, 20 May 2017 19:25:47 +0000</resolved>
                                    <version>Lustre 2.9.0</version>
                                    <fixVersion>Lustre 2.10.0</fixVersion>
                                        <due></due>
                            <votes>0</votes>
                                    <watches>7</watches>
                                                                            <comments>
                            <comment id="168058" author="jamesanunez" created="Mon, 3 Oct 2016 15:26:45 +0000"  >&lt;p&gt;Similar failures for tests 3 and 4 at &lt;a href=&quot;https://testing.hpdd.intel.com/test_sets/420ef8f0-897c-11e6-a9b0-5254006e85c2&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://testing.hpdd.intel.com/test_sets/420ef8f0-897c-11e6-a9b0-5254006e85c2&lt;/a&gt;&lt;/p&gt;

&lt;div class=&quot;preformatted panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;preformattedContent panelContent&quot;&gt;
&lt;pre&gt;== sanity-selinux test 3: access with unconfined user ================================================ 15:11:56 (1475507516)
sanityusr mapped as unconfined_u: touch /mnt/lustre/df3
localhost: Warning: Permanently added &apos;localhost&apos; (ECDSA) to the list of known hosts.
localhost: Permission denied, please try again.
localhost: Received disconnect from UNKNOWN: 2: Too many authentication failures for sanityusr
pdsh@trevis-66vm1: localhost: ssh exited with exit code 255
 sanity-selinux test_3: @@@@@@ FAIL: can&apos;t touch /mnt/lustre/df3 
&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;

&lt;div class=&quot;preformatted panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;preformattedContent panelContent&quot;&gt;
&lt;pre&gt;== sanity-selinux test 4: access with specific SELinux user ========================================== 15:12:08 (1475507528)
sanityusr mapped as guest_u: touch /mnt/lustre/df4
localhost: Permission denied, please try again.
localhost: Received disconnect from UNKNOWN: 2: Too many authentication failures for sanityusr
pdsh@trevis-66vm1: localhost: ssh exited with exit code 255
sanityusr mapped as user_u: touch /mnt/lustre/df4
localhost: Permission denied, please try again.
localhost: Received disconnect from UNKNOWN: 2: Too many authentication failures for sanityusr
pdsh@trevis-66vm1: localhost: ssh exited with exit code 255
 sanity-selinux test_4: @@@@@@ FAIL: can&apos;t touch /mnt/lustre/df4 
&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;</comment>
                            <comment id="168234" author="adilger" created="Tue, 4 Oct 2016 17:55:39 +0000"  >&lt;p&gt;Sebastien, I see that the failing test is using &lt;tt&gt;$PDSH ${uname}@localhost &quot;touch $filename&quot; &amp;amp;&lt;/tt&gt; to run the command on the local file.  Is $PDSH (ssh) used to initialize the security context for $uname, instead of just using $RUNAS directly?  Would &quot;su - $uname touch $filename&quot; or similar work without the need to allow passwordless ssh for $uname?&lt;/p&gt;


&lt;p&gt;On a related note, it would be useful to set &lt;tt&gt;$RUNAS_USER&lt;/tt&gt; in &lt;tt&gt;lustre/tests/cfg/local.sh&lt;/tt&gt; and as a fallback in &lt;tt&gt;test-framework.sh::init_test_env()&lt;/tt&gt; if it is not set, instead of fetching it repeatedly in the test:&lt;/p&gt;
&lt;div class=&quot;code panel&quot; style=&quot;border-width: 1px;&quot;&gt;&lt;div class=&quot;codeContent panelContent&quot;&gt;
&lt;pre class=&quot;code-java&quot;&gt;init_test_env() {
        RUNAS_USER=${RUNAS_USER:-$(getent passwd $RUNAS_ID | cut -d: -f1)}
}
&lt;/pre&gt;
&lt;/div&gt;&lt;/div&gt;</comment>
                            <comment id="168605" author="jhammond" created="Fri, 7 Oct 2016 02:47:34 +0000"  >&lt;p&gt;Using &lt;tt&gt;su - USER&lt;/tt&gt; keeps the original security context.&lt;/p&gt;</comment>
                            <comment id="168663" author="jhammond" created="Fri, 7 Oct 2016 13:55:40 +0000"  >&lt;p&gt;There are utilities &lt;tt&gt;runcon&lt;/tt&gt; and &lt;tt&gt;newrole&lt;/tt&gt; which we should try to use here (see &lt;a href=&quot;https://linux.die.net/man/1/newrole&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://linux.die.net/man/1/newrole&lt;/a&gt; and &lt;a href=&quot;https://linux.die.net/man/1/runcon&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://linux.die.net/man/1/runcon&lt;/a&gt;).&lt;/p&gt;</comment>
                            <comment id="175065" author="sbuisson" created="Fri, 25 Nov 2016 16:58:55 +0000"  >&lt;p&gt;Hi,&lt;/p&gt;

&lt;p&gt;I think I figured out how to replace &apos;ssh user@localhost&apos; with &apos;runas runcon&apos;.&lt;br/&gt;
The thing is it requires that the SELinux policy allows transitions from unconfined_t to user_t and guest_t:&lt;br/&gt;
#============= unconfined_r ==============&lt;br/&gt;
allow unconfined_r guest_r;&lt;br/&gt;
allow unconfined_r user_r;&lt;/p&gt;

&lt;p&gt;I will push a patch that modifies sanity-selinux.&lt;/p&gt;

&lt;p&gt;Thanks,&lt;br/&gt;
Sebastien.&lt;/p&gt;</comment>
                            <comment id="175066" author="gerrit" created="Fri, 25 Nov 2016 16:59:07 +0000"  >&lt;p&gt;Sebastien Buisson (sbuisson@ddn.com) uploaded a new patch: &lt;a href=&quot;http://review.whamcloud.com/23962&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;http://review.whamcloud.com/23962&lt;/a&gt;&lt;br/&gt;
Subject: &lt;a href=&quot;https://jira.whamcloud.com/browse/LU-8659&quot; title=&quot;sanity-selinux test_20a: test_20 passing even when localhost returning Permission Denied&quot; class=&quot;issue-link&quot; data-issue-key=&quot;LU-8659&quot;&gt;&lt;del&gt;LU-8659&lt;/del&gt;&lt;/a&gt; tests: use runcon in sanity-selinux&lt;br/&gt;
Project: fs/lustre-release&lt;br/&gt;
Branch: master&lt;br/&gt;
Current Patch Set: 1&lt;br/&gt;
Commit: 0cd696c19a837efe2a44a6530b01323960c839fc&lt;/p&gt;</comment>
                            <comment id="196548" author="gerrit" created="Sat, 20 May 2017 18:44:40 +0000"  >&lt;p&gt;Oleg Drokin (oleg.drokin@intel.com) merged in patch &lt;a href=&quot;https://review.whamcloud.com/23962/&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://review.whamcloud.com/23962/&lt;/a&gt;&lt;br/&gt;
Subject: &lt;a href=&quot;https://jira.whamcloud.com/browse/LU-8659&quot; title=&quot;sanity-selinux test_20a: test_20 passing even when localhost returning Permission Denied&quot; class=&quot;issue-link&quot; data-issue-key=&quot;LU-8659&quot;&gt;&lt;del&gt;LU-8659&lt;/del&gt;&lt;/a&gt; tests: use runcon in sanity-selinux&lt;br/&gt;
Project: fs/lustre-release&lt;br/&gt;
Branch: master&lt;br/&gt;
Current Patch Set: &lt;br/&gt;
Commit: 9d9a5ac444bcd796fe8757b092069570c24bc26a&lt;/p&gt;</comment>
                            <comment id="196558" author="pjones" created="Sat, 20 May 2017 19:25:47 +0000"  >&lt;p&gt;Landed for 2.10&lt;/p&gt;</comment>
                    </comments>
                    <attachments>
                    </attachments>
                <subtasks>
                    </subtasks>
                <customfields>
                                                                                                                                                                                            <customfield id="customfield_10890" key="com.atlassian.jira.plugins.jira-development-integration-plugin:devsummary">
                        <customfieldname>Development</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                        <customfield id="customfield_10390" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>1|hzyq5z:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10090" key="com.pyxis.greenhopper.jira:gh-global-rank">
                        <customfieldname>Rank (Obsolete)</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>9223372036854775807</customfieldvalue>
                        </customfieldvalues>
                    </customfield>
                                                                                            <customfield id="customfield_10060" key="com.atlassian.jira.plugin.system.customfieldtypes:select">
                        <customfieldname>Severity</customfieldname>
                        <customfieldvalues>
                                <customfieldvalue key="10022"><![CDATA[3]]></customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                        </customfields>
    </item>
</channel>
</rss>