|
Great - thank you. We had set fcontext equivalence: [root@host-name ~]# semanage fcontext -C -l SELinux Local fcontext Equivalence /var/adm/ras = /var/log /gpfs-fs/homes/a = /home /gpfs-fs/homes/b = /home /gpfs-fs/homes/c = /home /gpfs-fs/homes/d = /home /gpfs-fs/homes/e = /home /gpfs-fs/homes/f = /home /gpfs-fs/homes/g = /home /gpfs-fs/homes/h = /home /gpfs-fs/homes/i = /home /gpfs-fs/homes/j = /home /gpfs-fs/homes/k = /home /gpfs-fs/homes/l = /home /gpfs-fs/homes/m = /home /gpfs-fs/homes/n = /home /gpfs-fs/homes/o = /home /gpfs-fs/homes/p = /home /gpfs-fs/homes/q = /home /gpfs-fs/homes/r = /home /gpfs-fs/homes/s = /home /gpfs-fs/homes/t = /home /gpfs-fs/homes/u = /home /gpfs-fs/homes/v = /home /gpfs-fs/homes/w = /home /gpfs-fs/homes/x = /home /gpfs-fs/homes/y = /home /gpfs-fs/homes/z = /home [root@host-name ~]# And run restorecon on one of the home directories itself, but not on the paths above it. Doing this seems to have fixed the problem
without the need for an additional module. In fact it appears to have been the mount point of the file system that was the problem, so restorecon needs running on every machine. Great. But I’m a still bit confused about the need to add
home_root_t to the new home dir roots and to have the equivalency rule – don’t
they achieve the same thing? Many thanks, Luke --
Luke Sudbery Architecture, Infrastructure and Systems Advanced Research Computing, IT Services Room 132, Computer Centre G5, Elms Road Please note I don’t work on Monday. From: d.sastre.medina@xxxxxxxxx <d.sastre.medina@xxxxxxxxx>
Hello Luke, If you are relocating home directories somewhere else (not /home), you need to make sure those new home directories are properly labeled. As you can see in the AVC denials, those directories/files are unlabeled_t. The semanage-fcontext(8) manual page contains an example: # semanage fcontext -a -t home_root_t "/disk6" Obviously, you need to replace the paths in the example with the ones on your use case. Hope that helps. On Thu, May 27, 2021 at 1:16 PM Luke Sudbery <L.R.Sudbery@xxxxxxxxxx> wrote:
|
_______________________________________________ selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
