Attachment 160755 Details for Bug 251023 – selinux alert when attempting to automount a dir

selinux alert when attempting to automount a dir

selinux_alert.txt (text/plain), 2.08 KB, created by simon on 2007-08-06 15:46:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: simon

Created: 2007-08-06 15:46:28 UTC

Size: 2.08 KB

patch

obsolete

>Summary
>    SELinux prevented /sbin/mount.nfs from mounting on the file or directory
>    "bash" (type "shell_exec_t").
>
>Detailed Description
>    SELinux prevented /sbin/mount.nfs from mounting a filesystem on the file or
>    directory "bash" of type "shell_exec_t". By default SELinux limits the
>    mounting of filesystems to only some files or directories (those with types
>    that have the mountpoint attribute). The type "shell_exec_t" does not have
>    this attribute. You can either relabel the file or directory or set the
>    boolean "allow_mount_anyfile" to true to allow mounting on any file or
>    directory.
>
>Allowing Access
>    Changing the "allow_mount_anyfile" boolean to true will allow this access:
>    "setsebool -P allow_mount_anyfile=1."
>
>    The following command will allow this access:
>    setsebool -P allow_mount_anyfile=1
>
>Additional Information        
>
>Source Context                user_u:system_r:mount_t
>Target Context                system_u:object_r:shell_exec_t
>Target Objects                bash [ file ]
>Affected RPM Packages         nfs-utils-1.0.12-4.fc7 [application]
>Policy RPM                    selinux-policy-2.6.4-30.fc7
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   plugins.allow_mount_anyfile
>Host Name                     echo
>Platform                      Linux echo 2.6.22.1-41.fc7 #1 SMP Fri Jul 27
>                              18:10:34 EDT 2007 i686 i686
>Alert Count                   35
>First Seen                    Mon 06 Aug 2007 16:35:13 BST
>Last Seen                     Mon 06 Aug 2007 16:37:33 BST
>Local ID                      fda8059b-5b24-4953-b06d-6ac4c5208b45
>Line Numbers                  
>
>Raw Audit Messages            
>
>avc: denied { execute } for comm="mount.nfs" dev=sda2 egid=0 euid=0
>exe="/sbin/mount.nfs" exit=-13 fsgid=0 fsuid=0 gid=0 items=0 name="bash"
>pid=27448 scontext=user_u:system_r:mount_t:s0 sgid=0
>subj=user_u:system_r:mount_t:s0 suid=0 tclass=file
>tcontext=system_u:object_r:shell_exec_t:s0 tty=(none) uid=0
>

Actions: View

Attachments on bug 251023: 160755