ilorest doesn't start on CIS hardened system
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
hw-health-charm |
Fix Released
|
High
|
John Lettman |
Bug Description
Hi,
We're deploying hw-health charm to Bionic hardened with recent Ubuntu Bionic CIS benchmark 18.04.17 (based on CIS 2.0.1). ilorest tool that charm uses for hardware monitoring fails to start:
$ ilorest
ilorest: error while loading shared libraries: libz.so.1: failed to map segment from shared object
As strace ilorest shows (the loader attempts to load a number of .so files with randomized names from /tmp, see below comments for why), the root cause is this CIS remediation:
# 1.1.5 Ensure noexec option set on /tmp partition (Automated)
rule-1.1.5()
{
ensure_
}
Which breaks pyinstaller as documented in https:/
The workaround is to remount /tmp as described below:
$ sudo mount /tmp -o remount,exec
ubuntu@
iLOrest : RESTful Interface Tool version 3.1.1
....
Related branches
- Martin Kalcok (community): Approve
- 🤖 prod-jenkaas-bootstack (community): Approve (continuous-integration)
- Erhan Sunar (community): Approve
- Eric Chen: Approve
- Robert Gildein: Approve
-
Diff: 246 lines (+68/-39)3 files modifiedsrc/files/ilorest/cron_ilorest.py (+26/-8)
src/tests/unit/test_cron_ilorest.py (+39/-29)
src/tox.ini (+3/-2)
- 🤖 prod-jenkaas-bootstack (community): Approve (continuous-integration)
- BootStack Reviewers: Pending requested
- BootStack Reviewers: Pending requested
-
Diff: 30 lines (+7/-1)2 files modifiedsrc/files/ilorest/cron_ilorest.py (+3/-1)
src/reactive/hw_health.py (+4/-0)
description: | updated |
description: | updated |
Changed in charm-hw-health: | |
assignee: | nobody → John Lettman (jplettman) |
Changed in charm-hw-health: | |
status: | Confirmed → In Progress |
Changed in charm-hw-health: | |
status: | In Progress → Fix Committed |
Changed in charm-hw-health: | |
milestone: | none → 22.04 |
tags: | added: bseng-60 |
Changed in charm-hw-health: | |
status: | Fix Committed → Fix Released |
Another option would be to use a specific directory for the charm without the `noexec` restriction. It can be specified using the TMP environment variable. This allows the tool to run without remounting /tmp with `exec` (which is being specifically checked by CIS), for example:
# original issue
root@myhost:~# /usr/sbin/ilorest list -j --selector=Chassis
/usr/sbin/ilorest: error while loading shared libraries: libz.so.1: failed to map segment from shared object
# workaround via TMP ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ---- context" : "/redfish/ v1/$metadata# Chassis. Chassis" , v1/Chassis/ 1/", v1_10_2. Chassis" ,
root@myhost:~# mkdir /var/lib/hw-health
root@myhost:~# export TMP=/var/lib/health
root@myhost:~# /usr/sbin/ilorest list -j --selector=Chassis
iLOrest : RESTful Interface Tool version 3.2.2
Copyright (c) 2014-2021 Hewlett Packard Enterprise Development LP
-------
[
{
"@odata.
"@odata.etag": "<redacted>",
"@odata.id": "/redfish/
"@odata.type": "#Chassis.
"AssetTag": " ",
(...)