Bug 7506

Summary: udev-cache possibly incompatible with meta-selinux
Product: [Runtime] System Startup Reporter: Richard Tollerton <rich.tollerton>
Component: system-startupAssignee: Joe MacDonald <joe>
Status: RESOLVED FIXED QA Contact:
Severity: minor    
Priority: Low CC: alejandro.hernandez, ben.shelton, benjamin.esquivel, kevin.tian, leonardo.sandoval.gonzalez, mark.hatle, rich.tollerton, richard.purdie, sgw
Version: unspecified   
Target Milestone: 2.4 M2   
Hardware: All   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: New (Never tested)
Verified: Documentation change: Don't know

Description Richard Tollerton 2015-03-23 17:54:59 UTC 
I'm filing this as a tracking bug. We haven't done a whole lot of testing on this configuration but we wanted to provide a workaround and provide a link to this from our documentation.

There is some evidence to suggest that the udev-cache facility (cf openembedded-core/meta/recipes-core/udev/udev/udev-cache) is not generally compatible with SELinux. This may cause at best slower boot times and at worst, additional warnings/errors at boot time and/or failures in enforcing mode (?).

This may cause the udev-cache facility to fail to identify a cachable device configuration, slowing down the boot. 

1) While porting udev-cache changes to meta-selinux, I came across commit c7fc09794c20db9e3b32d326abb627985d2b5b65 [1]: "If, on the other hand, we at least create the cache with selinux and xattrs preserved and restored, we get significantly fewer errors and warnings on boot and we can successfully restore the context further down in init anyway. It still leaves some devices mislabeled, though, and still produces warnings on boot. Previous versions of the initscript removed all use of the dev-cache, if need be, we fall back to that. It is possible to get the middle-ground behaviour by defining use_udev_cache at the top of the udev initscript." This seems to imply that udev-cache has yet to work 100.0% under SELinux.

2) The existing udev-cache selinux implementation included an explicit jump to enforcing mode -- in other words, it's not possible to run udev-cache under permissive mode. It's not clear why this is necessary. I've removed this in our branches.


The workaround is to disable the udev-cache facility entirely by commenting out the DEVCACHE setting in /etc/default/udev-cache.


[1] http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/commit/?id=c7fc09794c20db9e3b32d326abb627985d2b5b65
Comment 1 Leonardo Sandoval Gonzalez 2015-09-21 16:17:09 UTC 
Moving it to 2.1 due to time restrictions right now.
Comment 2 Leonardo Sandoval Gonzalez 2016-11-07 19:29:20 UTC 
Validate if this bug is oe-core related.
Comment 3 Stephen K Jolley 2016-11-21 19:09:40 UTC 
Leo,

Who are you asking to do the validate this issue?

Stephen
Comment 4 Leonardo Sandoval Gonzalez 2016-11-22 17:59:56 UTC 
(In reply to comment #3)
> Leo,
> 
> Who are you asking to do the validate this issue?
> 
> Stephen

For this bug, we need to understand if this is a valid bug and I plan to work on it. Due to the importance and current load, moving it M3 and setting the correct estimate time.
Comment 5 Leonardo Sandoval Gonzalez 2017-06-12 17:40:24 UTC 
Joe, is this something you can review and work?
Comment 6 Richard Purdie 2017-08-17 15:07:16 UTC 
We deleted udev-cache in http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=44f550f392e231b7fbd1e29da3f59d6c9dd7f472 so this issue is no longer present.