Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-44733

systemd-coredump blocked by selinux in OCP 4.14.36+/4.15.29+/4.16

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • 4.14.z, 4.15.z, 4.16.z
    • RHCOS
    • None
    • Important
    • Yes
    • False
    • Hide

      None

      Show
      None

      Description of problem:

      Starting with OCP 4.14.36+/4.15.29+/4.16 selinux is blocking systemd-coredump from writing its coredump, see also https://issues.redhat.com/browse/RHEL-39937 and linked bugs

      Version-Release number of selected component (if applicable):

      OCP 4.14.36+/4.15.29+/4.16

      How reproducible:

      Install one of the above mentioned versions, kill a process with signal 11 and watch journal and audit logs
      
      journal:
      Oct 17 06:59:29 sno.sno-csa.coe.muc.redhat.com systemd-coredump[239192]: Failed to open our mntns: Permission denied
      
      audit log 
      type=SYSCALL msg=audit(1729148369.687:156898): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=7ffd15bf9c90 a2=80100 a3=0 items=0 ppid=2 pid=239183 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-coredum" exe="/usr/lib/systemd/systemd-coredump" subj=system_u:system_r:systemd_coredump_t:s0 key=(null)ARCH=x86_64 SYSCALL=openat AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"

      Steps to Reproduce:

      1. Install one of the affected versions, i.e. OCP 4.14.36+/4.15.29+/4.16       2. kill a process with signal 11
      3. watch journal/audit log for failed systemd-coredump     

      Actual results:

          coredump being blocked

      Expected results:

          coredump can be written

      Additional info:

       Also have a look at https://issues.redhat.com/browse/ACCELFIX-311 for more details

              Unassigned Unassigned
              rhn-support-dmoessner Daniel Moessner
              Michael Nguyen Michael Nguyen
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated: