On Thu, Jan 13, 2011 at 12:47 PM, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
On Thu, 2011-01-13 at 09:12 -0500, Stephen Smalley wrote:Oh, and under what OS were those files created? RHEL-5 or F-14?
> On Thu, 2011-01-13 at 11:51 -0200, Paulo Cavalcanti wrote:
>
> > Here it goes:
>
> > ----
> > type=SYSCALL msg=audit(01/13/2011 07:31:09.287:39) : arch=x86_64
> > syscall=lstat success=no exit=-13(Permission denied) a0=7ff594509d50
> > a1=7ffff3924c40 a2=7ffff3924c40 a3=2f534d50522f6c6d items=0 ppid=2230
> > pid=2270 auid=unset uid=apache gid=apache euid=apache suid=apache
> > fsuid=apache egid=apache sgid=apache fsgid=apache tty=(none) ses=unset
> > comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0
> > key=(null)
> > type=AVC msg=audit(01/13/2011 07:31:09.287:39) : avc: denied
> > { getattr } for pid=2270 comm=httpd
> > path=/home/packages/rpms/myrpms-el5-x86_64/repodata dev=sda4
> > ino=31331129 scontext=system_u:system_r:httpd_t:s0
> > tcontext=system_u:object_r:file_t:s0 tclass=dir
>
> Was this while running RHEL-5 or F-14? Is /home mounted with a context=
> mount option? What does 'mount' show for /home and/or /home/packages
> (if a separate mount)?
The files were created in rhel5 and /home there was mounted using the
context I posted before:
LABEL=/home /home ext4 defaults,context=user_u:
object_r:user_home_t:s0 1 2
The avc denial was produced when reading the created files on F14.
Basically, what I did was:
1) I booted on rhel5, and updated my rhel5 RPM repo (createrepo+repoview).
2) I booted on F14 again and tried to use mock to create some rhel5 rpms
accessing the local repo updated on step 1.
3) I reset the context on F14, and mock could access the files normally.
I have two different users, with the same ID (500), in fedora 14 and rhel5,
and basically these users share some directories in /home used for keeping rpms,
and a few directories accessed by httpd, and kept in the home of the fedora user.
The avc denial was produced when reading the created files on F14.
Basically, what I did was:
1) I booted on rhel5, and updated my rhel5 RPM repo (createrepo+repoview).
2) I booted on F14 again and tried to use mock to create some rhel5 rpms
accessing the local repo updated on step 1.
3) I reset the context on F14, and mock could access the files normally.
I have two different users, with the same ID (500), in fedora 14 and rhel5,
and basically these users share some directories in /home used for keeping rpms,
and a few directories accessed by httpd, and kept in the home of the fedora user.
--
Paulo Roma Cavalcanti
LCG - UFRJ
-- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel
