On Thu, 2011-01-13 at 18:21 -0200, Paulo Cavalcanti wrote:
>
>
> On Thu, Jan 13, 2011 at 12:47 PM, Stephen Smalley <sds@xxxxxxxxxxxxx>
> wrote:
> On Thu, 2011-01-13 at 09:12 -0500, Stephen Smalley wrote:
> > On Thu, 2011-01-13 at 11:51 -0200, Paulo Cavalcanti wrote:
> >
> > > Here it goes:
> >
> > > ----
> > > type=SYSCALL msg=audit(01/13/2011 07:31:09.287:39) :
> arch=x86_64
> > > syscall=lstat success=no exit=-13(Permission denied)
> a0=7ff594509d50
> > > a1=7ffff3924c40 a2=7ffff3924c40 a3=2f534d50522f6c6d
> items=0 ppid=2230
> > > pid=2270 auid=unset uid=apache gid=apache euid=apache
> suid=apache
> > > fsuid=apache egid=apache sgid=apache fsgid=apache
> tty=(none) ses=unset
> > > comm=httpd exe=/usr/sbin/httpd
> subj=system_u:system_r:httpd_t:s0
> > > key=(null)
> > > type=AVC msg=audit(01/13/2011 07:31:09.287:39) : avc:
> denied
> > > { getattr } for pid=2270 comm=httpd
> > > path=/home/packages/rpms/myrpms-el5-x86_64/repodata
> dev=sda4
> > > ino=31331129 scontext=system_u:system_r:httpd_t:s0
> > > tcontext=system_u:object_r:file_t:s0 tclass=dir
> >
> > Was this while running RHEL-5 or F-14? Is /home mounted
> with a context=
> > mount option? What does 'mount' show for /home
> and/or /home/packages
> > (if a separate mount)?
>
>
> Oh, and under what OS were those files created? RHEL-5 or
> F-14?
>
>
>
>
> The files were created in rhel5 and /home there was mounted using the
> context I posted before:
>
> LABEL=/home /home ext4
> defaults,context=user_u:
> object_r:user_home_t:s0 1 2
>
> The avc denial was produced when reading the created files on F14.
>
> Basically, what I did was:
>
> 1) I booted on rhel5, and updated my rhel5 RPM repo (createrepo
> +repoview).
>
> 2) I booted on F14 again and tried to use mock to create some rhel5
> rpms
> accessing the local repo updated on step 1.
>
> 3) I reset the context on F14, and mock could access the files
> normally.
>
> I have two different users, with the same ID (500), in fedora 14 and
> rhel5,
> and basically these users share some directories in /home used for
> keeping rpms,
> and a few directories accessed by httpd, and kept in the home of the
> fedora user.
Ok, your options are:
1) Use a context= mount on both RHEL-5 and F-14. Then it won't use
on-disk contexts at all under either OS for those files.
-or-
2) Use the context= mount only under RHEL-5, but run restorecon on /home
(or at least on any locations where files might have been created when
running RHEL-5) under F-14 before you try accessing the files there.
--
Stephen Smalley
National Security Agency
--
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/devel
