IBM / core-dump-handler

Save core dumps from a Kubernetes Service or RedHat OpenShift to an S3 protocol compatible object store
https://ibm.github.io/core-dump-handler/
MIT License
131 stars 40 forks source link

SELinux blocks cdc from running #141

Open gugu opened 1 year ago

gugu commented 1 year ago

I'm trying to setup core-dump-handler, but get this error in journalctl:

Mar 22 17:22:44 ip-172-30-18-62.ec2.internal kernel: audit: type=1400 audit(1679505764.849:16): avc:  denied  { execute } for  pid=636018 comm="kworker/u4:2" name="cdc" dev="nvme1n1p1" ino=576664 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:local_t:s0 tclass=file permissive=0
Mar 22 17:22:44 ip-172-30-18-62.ec2.internal kernel: Core dump to |/var/mnt/core-dump-handler/cdc pipe failed

OS: Bottlerocket OS 1.12.0 (aws-k8s-1.24)

Replacing |/var/mnt/core-dump-handler/cdc -c=%c -e=%e -p=%p -s=%s -t=%t -d=/var/mnt/core-dump-handler/cores -h=%h -E=%E with |/bin/tee /var/mnt/core-dump-handler/cores/%p, so looks like the problem is external mount