#9380 [Tracker] Nightly test failure f38+ in test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client (selinux)
Closed: fixed by frenaud. Opened by frenaud.

Issue

The nightly test test_integration/test_smb.py::TestSMB::test_smb_access_for_ipa_user_at_ipa_client is failing in selinux enforcing mode due to an AVC.
See PR #2656 with the following logs and report:

self = <ipatests.test_integration.test_smb.TestSMB object at 0x7f41a6f66610>
    def test_smb_access_for_ipa_user_at_ipa_client(self):
        samba_share = {
            'name': 'homes',
            'server_path': '/home/{}'.format(self.ipa_user1),
            'unc': '//{}/homes'.format(self.smbserver.hostname)
        }
>       self.check_smb_access_at_ipa_client(
            self.ipa_user1, self.ipa_user1_password, samba_share)
test_integration/test_smb.py:318: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test_integration/test_smb.py:303: in check_smb_access_at_ipa_client
    self.mount_smb_share(user, password, samba_share, mount_point)
test_integration/test_smb.py:116: in mount_smb_share
    self.smbclient.run_command([
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <ipatests.pytest_ipa.integration.host.Host client0.ipa.test (client)>
argv = ['mount', '-t', 'cifs', '//client1.ipa.test/homes', '/mnt/smb', '-o', ...]
set_env = True, stdin_text = None, log_stdout = True, raiseonerr = True
cwd = None, bg = False, encoding = 'utf-8', ok_returncode = 0
    def run_command(self, argv, set_env=True, stdin_text=None,
                    log_stdout=True, raiseonerr=True,
                    cwd=None, bg=False, encoding='utf-8', ok_returncode=0):
        """Wrapper around run_command to log stderr on raiseonerr=True
        :param ok_returncode: return code considered to be correct,
                              you can pass an integer or sequence of integers
        """
        result = super().run_command(
            argv, set_env=set_env, stdin_text=stdin_text,
            log_stdout=log_stdout, raiseonerr=False, cwd=cwd, bg=bg,
            encoding=encoding
        )
        # in FIPS mode SSH may print noise to stderr, remove the string
        # "FIPS mode initialized" + optional newline.
        result.stderr_bytes = FIPS_NOISE_RE.sub(b'', result.stderr_bytes)
        try:
            result_ok = result.returncode in ok_returncode
        except TypeError:
            result_ok = result.returncode == ok_returncode
        if not result_ok and raiseonerr:
            result.log.error('stderr: %s', result.stderr_text)
>           raise subprocess.CalledProcessError(
                result.returncode, argv,
                result.stdout_text, result.stderr_text
            )
E           subprocess.CalledProcessError: Command '['mount', '-t', 'cifs', '//client1.ipa.test/homes', '/mnt/smb', '-o', 'sec=krb5i,multiuser']' returned non-zero exit status 32.
pytest_ipa/integration/host.py:202: CalledProcessError
 ------------------------------Captured stderr call------------------------------ 
ipa: ERROR: stderr: mount error(126): Required key not available
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)

The journal on the client shows the following AVC:

May 12 08:32:36 client0.ipa.test kernel: CIFS: Attempting to mount \\client1.ipa.test\homes
May 12 08:32:36 client0.ipa.test audit[14696]: AVC avc:  denied  { execute } for  pid=14696 comm="request-key" name="cifs.upcall" dev="vda5" ino=139589 scontext=system_u:system_r:keyutils_request_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0
May 12 08:32:36 client0.ipa.test request-key[14696]: :42: Failed to execute '/usr/sbin/cifs.upcall': Permission denied
May 12 08:32:36 client0.ipa.test kernel: CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed
May 12 08:32:36 client0.ipa.test kernel: CIFS: VFS: \\client1.ipa.test Send error in SessSetup = -126
May 12 08:32:36 client0.ipa.test kernel: CIFS: VFS: cifs_mount failed w/return code = -126

This error has already been reported against selinux-policy as Bug 2182643 against Fedora 38 - CIFS mounts fail due to SELinux denies on request-key.

Marking as a tracker only.


The Fedora BZ https://bugzilla.redhat.com/show_bug.cgi?id=2182643 has been closed as fixed but the test is still failing. Opening https://bugzilla.redhat.com/show_bug.cgi?id=2220943 to track the problem.

The nightly test is now successful: PR #2970 with the following report,
using selinux-policy-38.27-1.fc38.noarch as can be seen in pkg list

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata