The nightly test test_integration/test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client is failing in selinux enforcing mode due to an AVC. See PR #2656 with the following logs and report:
test_integration/test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client
self = <ipatests.test_integration.test_smb.TestSMB object at 0x7f41a6f66610> def test_smb_access_for_ipa_user_at_ipa_client(self): samba_share = { 'name': 'homes', 'server_path': '/home/{}'.format(self.ipa_user1), 'unc': '//{}/homes'.format(self.smbserver.hostname) } > self.check_smb_access_at_ipa_client( self.ipa_user1, self.ipa_user1_password, samba_share) test_integration/test_smb.py:318: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ test_integration/test_smb.py:303: in check_smb_access_at_ipa_client self.mount_smb_share(user, password, samba_share, mount_point) test_integration/test_smb.py:116: in mount_smb_share self.smbclient.run_command([ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = <ipatests.pytest_ipa.integration.host.Host client0.ipa.test (client)> argv = ['mount', '-t', 'cifs', '//client1.ipa.test/homes', '/mnt/smb', '-o', ...] set_env = True, stdin_text = None, log_stdout = True, raiseonerr = True cwd = None, bg = False, encoding = 'utf-8', ok_returncode = 0 def run_command(self, argv, set_env=True, stdin_text=None, log_stdout=True, raiseonerr=True, cwd=None, bg=False, encoding='utf-8', ok_returncode=0): """Wrapper around run_command to log stderr on raiseonerr=True :param ok_returncode: return code considered to be correct, you can pass an integer or sequence of integers """ result = super().run_command( argv, set_env=set_env, stdin_text=stdin_text, log_stdout=log_stdout, raiseonerr=False, cwd=cwd, bg=bg, encoding=encoding ) # in FIPS mode SSH may print noise to stderr, remove the string # "FIPS mode initialized" + optional newline. result.stderr_bytes = FIPS_NOISE_RE.sub(b'', result.stderr_bytes) try: result_ok = result.returncode in ok_returncode except TypeError: result_ok = result.returncode == ok_returncode if not result_ok and raiseonerr: result.log.error('stderr: %s', result.stderr_text) > raise subprocess.CalledProcessError( result.returncode, argv, result.stdout_text, result.stderr_text ) E subprocess.CalledProcessError: Command '['mount', '-t', 'cifs', '//client1.ipa.test/homes', '/mnt/smb', '-o', 'sec=krb5i,multiuser']' returned non-zero exit status 32. pytest_ipa/integration/host.py:202: CalledProcessError ------------------------------Captured stderr call------------------------------ ipa: ERROR: stderr: mount error(126): Required key not available Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)
The journal on the client shows the following AVC:
May 12 08:32:36 client0.ipa.test kernel: CIFS: Attempting to mount \\client1.ipa.test\homes May 12 08:32:36 client0.ipa.test audit[14696]: AVC avc: denied { execute } for pid=14696 comm="request-key" name="cifs.upcall" dev="vda5" ino=139589 scontext=system_u:system_r:keyutils_request_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0 May 12 08:32:36 client0.ipa.test request-key[14696]: :42: Failed to execute '/usr/sbin/cifs.upcall': Permission denied May 12 08:32:36 client0.ipa.test kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed May 12 08:32:36 client0.ipa.test kernel: CIFS: VFS: \\client1.ipa.test Send error in SessSetup = -126 May 12 08:32:36 client0.ipa.test kernel: CIFS: VFS: cifs_mount failed w/return code = -126
This error has already been reported against selinux-policy as Bug 2182643 against Fedora 38 - CIFS mounts fail due to SELinux denies on request-key.
Marking as a tracker only.
The Fedora BZ https://bugzilla.redhat.com/show_bug.cgi?id=2182643 has been closed as fixed but the test is still failing. Opening https://bugzilla.redhat.com/show_bug.cgi?id=2220943 to track the problem.
The nightly test is now successful: PR #2970 with the following report, using selinux-policy-38.27-1.fc38.noarch as can be seen in pkg list
Metadata Update from @frenaud: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)