Re: 2.6.24-rc2=another train wreck with amanda

[Stephen Smalley <sds@tycho.nsa.gov>]

On Wed, 2007-11-07 at 10:30 -0800, Andrew Morton wrote:
> > On Wed, 07 Nov 2007 06:49:01 -0500 Gene Heskett <gene.heskett@gmail.com> wrote:
> > Greetings;
> > 
> > I have this line in my /etc/modprobe.conf:
> > options dm-mod major=238
> > 
> > And I had a fsckup while building 2.6.24-rc2 cuz I thought it needed to be 
> > based on 2.6.23.1 that has made 2.6.24-rc2 the only kernel that will boot 
> > without a panic, killing init message.
> > 
> > I can survive that, but amanda (tar) went bonkers last night and tried to do a 
> > level 0 on everything, which is about 50GB, but its virtual tape size is only 
> > 11GB.
> > 
> > The last time this happened that line above fixed the device mapper to a 
> > stable address at a major of 238 which tar was happy with.
> > 
> > An ls -l of /dev/mapper:
> > [root@coyote /]# ls -l /dev/mapper
> > total 0
> > crw------- 1 root root  10, 62 Nov  6 23:40 control
> > brw-rw---- 1 root disk 238,  0 Nov  6 23:40 VolGroup00-LogVol00
> > brw-rw---- 1 root disk 238,  1 Nov  6 23:40 VolGroup00-LogVol01
> > 
> > So that hasn't changed, so what did?  Amanda itself hasn't been changed in 
> > several months, running the 20070727 snapshot of amanda-2.5.2p1 all this 
> > time.  Tar was updated by smart or yumex 2 or 3 days back, so it worked 
> > correctly after the update.  That leaves something in 2.6.24-rc2.  I didn't 
> > build rc1.
> > 
> > Other than that, rc2 seems stable.  But auditd failed to start in the bootup 
> > sequence. I think that's minor and may predate this particular kernel.  
> > However, selinux did a relabel before it booted, could that be the cause?
> > 
> 
> An selinux relabelling could well have caused a full backup by amanda.
> 
> There's a way of forcing a relabelling so that you can confirm this, but I
> forget what it is (cc's added, please).
> 
> But we don't know why the relabelling happened, do we?

Gene took his question to fedora-selinux-list, which is appropriate
since the autorelabel stuff is distro-specific.

In Fedora, rc.sysinit will perform a relabel if /.autorelabel exists or
autorelabel was passed on the kernel command line.  /.autorelabel can be
created by the user, by rc.sysinit itself (if you boot with SELinux
disabled, to force a relabel if you ever re-enable SELinux later), or by
utilities like system-config-{securitylevel,selinux} in response to
changing settings.  Merely installing and booting a new kernel shouldn't
trigger it.

Even when triggered, a relabel shouldn't call setxattr on the file
unless its existing on-disk label doesn't match the file contexts
specification in policy.  There is a force option that unconditionally
sets the label on all files, but I don't see that being used by the
autorelabel support.

-- 
Stephen Smalley
National Security Agency

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/