nfs mount takes long time on x86 rhel4 u4 with selinux enabled

nfs mount takes long time on x86 rhel4 u4 with selinux enabled

[abcde efghi]

hi

nfs mount takes long time on x86 rhel4 u4 with selinux enabled.
This happens only with selinux enabled. Without selinx it takes few
milli-seconds.
When I installed machine with selinux enabled and selinux enabled
during run,mount works properly.

why is it so?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: nfs mount takes long time on x86 rhel4 u4 with selinux enabled

[Russell Coker]

On Tuesday 10 October 2006 22:00, "abcde efghi" <svmdcv@gmail.com> wrote:
> nfs mount takes long time on x86 rhel4 u4 with selinux enabled.
> This happens only with selinux enabled. Without selinx it takes few
> milli-seconds.
> When I installed machine with selinux enabled and selinux enabled
> during run,mount works properly.

The most common cause of delays in NFS mounts is the portmap daemon not 
running on the local machine.

I'm not sure what you mean by "selinux enabled during run".  Did you test by 
booting with SE Linux in enforcing mode, running "time mount ..." 
then "umount ... ; setenforce 0 ; time mount ..."?  (where ... means the 
necessary parameters).

Did you check the audit log?  If you installed U4 then I think auditd will be 
on by default so you have to check /var/log/audit/audit.log otherwise 
run "dmesg" and look for "avc" messages.  If SE Linux is misconfigured then 
you should see some AVC messages.

Last time I was using RHEL4U4 I had no problems with NFS mounting.

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: nfs mount takes long time on x86 rhel4 u4 with selinux enabled

[abcde efghi]

hi

during installation time it was disabled
and during boottime i enabled it
(.i.e by setting selinux=enforcing in /etc/selinux/config and reboot)
that time it is taking some time to mount
what could be the pbm? is it really bcoz of portmap daemon?
how does portmap daemon cause this pbm? any pointers?

note the time and call trace details:

time mount <server:/disk/disk1/data1/ /mnt --type nfs
-orw,bg,nointr,hard,timeo=600,wsize=32768,rsize=32768,nfsvers=3,tcp,actimeo=0,
addr=10.0.0.60

 real    1m45.006s
 user    0m0.000s
 sys     0m0.017s

 .
 mount         D F8CCB803  2036  4202   4169                     (NOTLB)
 f5c26d04 00000082 00000246 f8ccb803 00000000 f6f2b080 0648da88 f8cccac2
        f8ccb803 00000000 00000000 06051de0 00000000 00000000 a2fd0280
 000f456a
        0231aa80 f744ceb0 f744d01c f6f2b100 02120414 f6f2b080 f6f2b100
 f5c26d30
 Call Trace:
  [<f8ccb803>] xprt_timer+0x0/0x79 [sunrpc]
  [<f8cccac2>] rpc_sleep_on+0x24/0x33 [sunrpc]
  [<f8ccb803>] xprt_timer+0x0/0x79 [sunrpc]
  [<02120414>] prepare_to_wait+0x12/0x4c
  [<f8cccfed>] __rpc_execute+0x1a0/0x326 [sunrpc]
  [<021204e9>] autoremove_wake_function+0x0/0x2d
  [<021204e9>] autoremove_wake_function+0x0/0x2d
  [<021204e9>] autoremove_wake_function+0x0/0x2d
  [<f8cc95de>] rpc_call_sync+0x68/0x8c [sunrpc]
  [<f8cd2b0e>] rpc_register+0xde/0x11b [sunrpc]
  [<022b647f>] inet_addr_type+0x20/0xa6
  [<f8ccf178>] svc_register+0x80/0xd9 [sunrpc]
  [<f8cd1223>] svc_setup_socket+0x88/0x1af [sunrpc]
  [<f8cd143f>] svc_create_socket+0xf5/0x12c [sunrpc]
  [<f8cd1579>] svc_makesock+0x4c/0x53 [sunrpc]
  [<f8a2e002>] lockd_up+0x95/0x13c [lockd]
  [<f8d71868>] nfs_fill_super+0x186/0x2ca [nfs]
  [<022c9864>] __down_failed+0x8/0xc
  [<f8d735d6>] nfs_get_sb+0x1d0/0x203 [nfs]
  [<021601ca>] do_kern_mount+0x8a/0x147
  [<02172eab>] do_new_mount+0x61/0x90
  [<0217352c>] do_mount+0x178/0x190
  [<021557c7>] get_user_size+0x30/0x57
  [<021732d0>] exact_copy_from_user+0x31/0x66
  [<02173883>] sys_mount+0x91/0x108


thanks


 .
On 10/10/06, abcde efghi <svmdcv@gmail.com> wrote:
> hi
>
> nfs mount takes long time on x86 rhel4 u4 with selinux enabled.
> This happens only with selinux enabled. Without selinx it takes few
> milli-seconds.
> When I installed machine with selinux enabled and selinux enabled
> during run,mount works properly.
>
> why is it so?
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: nfs mount takes long time on x86 rhel4 u4 with selinux enabled

[Russell Coker]

On Wednesday 11 October 2006 00:35, "abcde efghi" <svmdcv@gmail.com> wrote:
> during installation time it was disabled
> and during boottime i enabled it
> (.i.e by setting selinux=enforcing in /etc/selinux/config and reboot)

Before that reboot did you touch /.autorelabel?

> that time it is taking some time to mount
> what could be the pbm? is it really bcoz of portmap daemon?
> how does portmap daemon cause this pbm? any pointers?

If it's portmap then it's not an SE Linux issue and is best discussed on 
another list.

> note the time and call trace details:
>
> time mount <server:/disk/disk1/data1/ /mnt --type nfs
> -orw,bg,nointr,hard,timeo=600,wsize=32768,rsize=32768,nfsvers=3,tcp,actimeo
>=0, addr=10.0.0.60

You did not provide any information on AVC messages or the time taken for the 
mount command when SE Linux is in permissive mode (after running
"setenforce 0").  Without such information we can't help you.  You need to 
answer every question in my messages if you want useful answers from us.

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: nfs mount takes long time on x86 rhel4 u4 with selinux enabled

[abcde efghi]

hi

at present i dont have those logs
one last question.

is it compulsory to do touch /.autorelabel when we are doing reboot?
and it should be done before or after reboot?(bit confused. i thought
after reboot)
note:i am moving from disabled to enforcing selinux

thanks


On 10/10/06, Russell Coker <russell@coker.com.au> wrote:
> On Wednesday 11 October 2006 00:35, "abcde efghi" <svmdcv@gmail.com> wrote:
> > during installation time it was disabled
> > and during boottime i enabled it
> > (.i.e by setting selinux=enforcing in /etc/selinux/config and reboot)
>
> Before that reboot did you touch /.autorelabel?
>
> > that time it is taking some time to mount
> > what could be the pbm? is it really bcoz of portmap daemon?
> > how does portmap daemon cause this pbm? any pointers?
>
> If it's portmap then it's not an SE Linux issue and is best discussed on
> another list.
>
> > note the time and call trace details:
> >
> > time mount <server:/disk/disk1/data1/ /mnt --type nfs
> > -orw,bg,nointr,hard,timeo=600,wsize=32768,rsize=32768,nfsvers=3,tcp,actimeo
> >=0, addr=10.0.0.60
>
> You did not provide any information on AVC messages or the time taken for the
> mount command when SE Linux is in permissive mode (after running
> "setenforce 0").  Without such information we can't help you.  You need to
> answer every question in my messages if you want useful answers from us.
>
> --
> russell@coker.com.au
> http://etbe.blogspot.com/          My Blog
>
> http://www.coker.com.au/sponsorship.html Sponsoring Free Software development
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: nfs mount takes long time on x86 rhel4 u4 with selinux enabled

[Daniel J Walsh]

abcde efghi wrote:
> hi
>
> at present i dont have those logs
> one last question.
>
> is it compulsory to do touch /.autorelabel when we are doing reboot?
> and it should be done before or after reboot?(bit confused. i thought
> after reboot)
> note:i am moving from disabled to enforcing selinux
>
> thanks
>
>
> On 10/10/06, Russell Coker <russell@coker.com.au> wrote:
>> On Wednesday 11 October 2006 00:35, "abcde efghi" <svmdcv@gmail.com> 
>> wrote:
>> > during installation time it was disabled
>> > and during boottime i enabled it
>> > (.i.e by setting selinux=enforcing in /etc/selinux/config and reboot)
>>
>> Before that reboot did you touch /.autorelabel?
>>
>> > that time it is taking some time to mount
>> > what could be the pbm? is it really bcoz of portmap daemon?
>> > how does portmap daemon cause this pbm? any pointers?
>>
>> If it's portmap then it's not an SE Linux issue and is best discussed on
>> another list.
>>
>> > note the time and call trace details:
>> >
>> > time mount <server:/disk/disk1/data1/ /mnt --type nfs
>> > 
>> -orw,bg,nointr,hard,timeo=600,wsize=32768,rsize=32768,nfsvers=3,tcp,actimeo 
>>
>> >=0, addr=10.0.0.60
>>
>> You did not provide any information on AVC messages or the time taken 
>> for the
>> mount command when SE Linux is in permissive mode (after running
>> "setenforce 0").  Without such information we can't help you.  You 
>> need to
>> answer every question in my messages if you want useful answers from us.
>>
When you turn on SELinux you need to relabel the entire file system.  
touch /.autorelabel, will cause the init scripts to do this before any 
processes are running.   This is the best way to turn on SELinux.  After 
you are running SELinux you should not need to relabel again.
>> -- 
>> russell@coker.com.au
>> http://etbe.blogspot.com/          My Blog
>>
>> http://www.coker.com.au/sponsorship.html Sponsoring Free Software 
>> development
>>
>
> -- 
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to 
> majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.