IBM Support

Getting CS Linux to work with SELinux (Security Enhanced Linux) on RHEL

Troubleshooting


Problem

Red Hat Enterprise Linux (RHEL) comes with a feature called Security Enhanced Linux (SELinux). Using the default RHEL installation choices and the default SELinux configuration, CS Linux will not start properly.

Symptom

When SELinux is enforcing, you may see entries similar to the following in /var/log/messages:
    :
    snastart: FATAL: Error inserting streams
    (/lib/modules/2.6.9-22.EL/misc/streams.ko): Permission denied
    snastart: Error: Could not load streams driver
    snastart: Refer to the readme file for further information
    snastart: CS Linux cannot start because drivers failed to load
    snastart: Refer to the readme file for further information
    SELinux: initialized (dev LiS, type LiS), not configured for labeling
    Linux Streams Subsystem failed to register its file system (-13).
    :
If you later logon as root and attempt to initiate the /etc/init.d/snastart manually, you will may a kernel oops similar to the following:

        :
    Linux STREAMS Subsystem loading...
    kmem_cache_create: duplicate cache LiS-Atomic-200
    kernel BUG at mm/slab.c:1453!
    EIP is at kmem_cache_create+0x417/0x48a
    Process modprobe (pid: 2561, threadinfo=c4ef6000 task=c4212c70)
    vprintk+0x22d/0x29d
    lis_mem_init+0x3d/0x58 [streams]
    lis_init_module+0x27/0x16c [streams]
    sys_init_module+0x1f1/0x2d9
    syscall_call+0x7/0xb
        :

Another symptom seen from when SELinux is set for 'enforcing' could be a failure to start Enterprise Extender (HPR/IP) links. The sna.err log may record:

        :
    2021-06-08 19:30:14 EDT 4099-15(0-1) E (snalab.ibm.com) PID 3990 (snadaemon)
    Failed to open device /dev/sna_HPRIP.
    Errno = 6
    2021-06-08 19:30:14 EDT 4099-22(0-1) P (snalab.ibm.com) PID 3990 (snadaemon)
    Failed to open Streams for DLC IP0, failure code 2
        :

[{"Line of Business":{"code":"LOB70","label":"Z TPS"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSKK8Z","label":"Communications Server for Data Center Deployment"},"ARM Category":[{"code":"a8m0z0000001jSmAAI","label":"Comm Server DSD Linux V7"},{"code":"a8m0z0000001jSiAAI","label":"Comm Server Linux Sys Z V6"},{"code":"a8m0z0000001jSrAAI","label":"Comm Server Linx86"},{"code":"a8m0z0000001jSjAAI","label":"Comm Server Linxppc V6"}],"Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.0.0;and future releases","Type":"MASTER"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
10 June 2021

UID

swg21229399