I'm exploring new territory: the first time I've ever tried to mount a
loop device (a ro file) at boot using fstab.
My fstab entry works fine from the command line, but it fails at boot
time due to a selinux avc error, I dont understand why but I suspect
it is because the file context is unsuitable.
The file and context are:
[david@kablamm ~]$ ls -lZ
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso
-r--r----- root share unconfined_u:object_r:default_t:s0
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso
The fstab line is:
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso /mnt/Fedora-09-i386-DVD iso9660 loop,ro,gid=share
0 0
The command line that works is:
# mount /mnt/Fedora-09-i386-DVD
The boot-time error messages are:
Mounting local filesystems:
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso: Permission
denied [FAILED]
Mounting other filesystems:
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso: Permission
denied [FAILED]
and from dmesg:
type=1400 audit(1241411595.523:4): avc: denied { read } for
pid=1335 comm="mount" name="Fedora-09-i386-DVD.iso" dev=sdb2 ino=1922
scontext=system_u:system_r:mount_t:s0
tcontext=unconfined_u:object_r:default_t:s0 tclass=file
and my selinux status is:
[root@kablamm ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 22
Policy from config file: targeted
QUESTIONS:
I'm guessing that the problem is the file's tcontext .. what should it
be? Is it just a matter of changing it to mount_t, the same as the
error message scontext?
The command
# sesearch --allow -s mount_t -c file -p read
gives 1292 results. How could I decide which one of these to use?
And if anyone can say why it does not matter after boot time, I'd
appreciate understanding that. Possibly something to do with context
transitions?
I've not attempted any trial and error solution, prefer to comprehend
security tools if possible.
Thanks.
--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
