Paul Howarth wrote:
On Sat, 2006-09-30 at 01:16 +0200, Davide Bolcioni wrote:
Greetings,
while attempting to set up leafnode <http://leafnode.sourceforge.net> I
had a problem with mounting its spool, /var/spool/news:
Sep 14 00:36:11 camelot kernel: audit(1158186712.955:375): avc: denied
{ mounton } for pid=1353 comm="mount" name="news" dev=dm-3 ino=65600
scontext=system_u:system_r:mount_t:s0
tcontext=system_u:object_r:news_spool_t:s0 tclass=dir
Using audit2why and then audit2allow I was able to come up with the
following .te policy:
module news 1.0;
require {
class dir mounton;
type mount_t;
type news_spool_t;
role system_r;
};
allow mount_t news_spool_t:dir mounton;
which to my untrained eye looked good. Researching the archives before
writing this, however, I came upon the answer for a similar problem:
https://www.redhat.com/archives/fedora-selinux-list/2006-August/msg00096.html
and found out that it would probably have been enough to label the
mount point mnt_t (haven't tried it yet). Assuming it works, how should
I have found out about it ? I tried rpm -qd and found out about the
selinux-policy documentation, but nothing showed up for the targeted
policy. In this context, isn't audit2allow somewhat ... dangerous ?
Or was it just a shortcoming in the leafnode RPM, so I should be looking
at what INN is doing instead ?
This sort of problem only usually crops up when you add a mountpoint
post-installation. It's not really something that can be anticipated by
packagers of general applications like leafnode (in fact it's a problem
for mount rather than a problem for leafnode). It might be useful for
SELinux diagnostic tools to note that "mounton" problems are usually the
result of a labelling problem rather than a policy problem though.
There already is one.
Labelling the mountpoint as mnt_t should indeed fix this problem.
Paul.
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
#
# Authors: Karl MacMillan <kmacmillan@xxxxxxxxxxxxxxxxx>
#
# Copyright (C) 2006 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
#
from setroubleshoot.util import *
from setroubleshoot.Plugin import Plugin
from rhpl.translate import _
class plugin(Plugin):
summary = _('''
SELinux prevented $SOURCE_PATH from mounting on the file or directory
"$TARGET_PATH" (type "$TARGET_TYPE").
''')
problem_description = _('''
SELinux prevented $SOURCE_PATH from mounting a filesystem on the file
or directory "$TARGET_PATH" of type "$TARGET_TYPE". By default
SELinux limits the mounting of filesystems to only some files or
directories (those with types that have the mountpoint attribute). The
type "$TARGET_TYPE" does not have this attribute. You can change the
label of the file or directory.
''')
fix_description = _('''
Changing the file_context to mnt_t will allow mount to mount the file system:
"chcon -t mnt_t $TARGET_PATH."
''')
fix_cmd = 'chcon -t mnt_t $TARGET_PATH'
def __init__(self):
Plugin.__init__(self, __name__)
def analyze(self):
if self.avc.sourceTypeMatch("mount_t") and "mounton" in self.avc.access:
return True
else:
return False
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
