sit.cephfs: Add proxy enbaled shares with vfs_ceph_new(non-mgr)

[anoopcs9]

With ceph/ceph#58376 merged we have the libcephfs proxy library and its dependencies available with upstream. Therefore we try to create an additional share with proxy enabled.

Please note that even though we have the required Recommends: for dependent packages defined in the rpm spec file(and visible with built rpms) there is an extra mile that DNF takes as part of libsolv library which prevents it from being presented as installable weak dependencies as one would expect as per the docs.

depends on ceph/ceph#61537

[dpulls]

⚠️ Dpulls not installed on repository ceph/ceph. Checkout our quickstart for how to install.

[anoopcs9]

We'll have to probably wait for the packages to be built with ceph/ceph#61537

and

There's still a TODO for resolving the following SELinux AVC denials:

type=AVC msg=audit(1738236295.070:1470): avc: denied { write } for pid=41822 comm="smbd[192.168.12" name="libcephfsd.sock" dev="tmpfs" ino=1908 scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file permissive=1

type=AVC msg=audit(1738236295.070:1470): avc: denied { connectto } for pid=41822 comm="smbd[192.168.12" path="/run/libcephfsd.sock" scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1

[anoopcs9]

We'll have to probably wait for the packages to be built with ceph/ceph#61537

Done.

and

There's still a TODO for resolving the following SELinux AVC denials:

type=AVC msg=audit(1738236295.070:1470): avc: denied { write } for pid=41822 comm="smbd[192.168.12" name="libcephfsd.sock" dev="tmpfs" ino=1908 scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file permissive=1

Temporarily did a hack to create socket under /run/samba where all required permissions(basically rw) are already granted for smbd.

type=AVC msg=audit(1738236295.070:1470): avc: denied { connectto } for pid=41822 comm="smbd[192.168.12" path="/run/libcephfsd.sock" scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1

For this we may have to create a custom policy until upstream agrees to come up with a boolean(probably samba_load_cephfs_proxy) to contain allow rules for above mentioned AVC denials.

[anoopcs9]

Confirmation on the final pending SELinux AVC denial from failed test run logs:

$ grep type=AVC sit_statedump/storage2/log/audit/audit.log | grep smbd
type=AVC msg=audit(1738328323.323:3830): avc:  denied  { connectto } for  pid=57963 comm="smbd[192.168.12" path="/run/samba/libcephfsd.sock" scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0

[anoopcs9]

There's still a TODO for resolving the following SELinux AVC denials:

type=AVC msg=audit(1738236295.070:1470): avc: denied { write } for pid=41822 comm="smbd[192.168.12" name="libcephfsd.sock" dev="tmpfs" ino=1908 scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=sock_file permissive=1
type=AVC msg=audit(1738236295.070:1470): avc: denied { connectto } for pid=41822 comm="smbd[192.168.12" path="/run/libcephfsd.sock" scontext=system_u:system_r:smbd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=1

fedora-selinux/selinux-policy#2555 created upstream to address the above SELinux issues.

[anoopcs9]

Proxy enabled share configuration from test statedump:

[share-cephfs-default-vfs-new-proxy]
comment = Volume 'share' from cephfs(default vfs-new-proxy)
vfs objects = acl_xattr ceph_snapshots ceph_new
ceph_new:config_file = /etc/ceph/sit.ceph.conf
ceph_new:user_id = sit
ceph_new:proxy = yes
path = /volumes/_nogroup/share/9efd7a3c-72ff-4eb3-8abc-909703ca9da1
browseable = yes
read only = no
acl_xattr:security_acl_name = user.NTACL

and the sanity runs passed on the additional share.

==================================== PASSES ====================================
=========================== short test summary info ============================
PASSED testcases/consistency/test_consistency.py::test_consistency[192.168.123.10-share-cephfs-default-vfs-new]
PASSED testcases/consistency/test_consistency.py::test_consistency[192.168.123.10-share-cephfs-default-vfs-new-proxy]
PASSED testcases/consistency/test_consistency.py::test_consistency[192.168.123.10-share-cephfs-default-kclient]
PASSED testcases/consistency/test_consistency.py::test_consistency[192.168.123.10-share-cephfs-default-vfs]
============================== 4 passed in 0.94s ===============================