Bug 118975

Summary:	staff_t can loopback mount but sysadm_t can't
Product:	[Fedora] Fedora	Reporter:	Tim Waugh <twaugh>
Component:	policy	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED NEXTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	barryn, gczarcinski, mikem, pgraner, wtogami
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-04-19 17:57:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	114961

Description Tim Waugh 2004-03-23 15:15:18 UTC

Description of problem:
Trying this sort of thing:

mount -oloop,ro boot.iso /mnt/cdrom

works as staff_t but not as sysadm_t.  Is that intentional?

Version-Release number of selected component (if applicable):
1.9-11

Comment 1 Daniel Walsh 2004-03-24 21:42:10 UTC

The problem is the staff is not transitioning and sysadm, is.  So in
the case of sysadm you are running under mount_t context (Which is
correct?)  In the case of staff you are running under staff_t context.
 In this version of selinux staff_t is all powerfull, in the future it
will not be.  So this is a bug in that mount is not able to read the
file it is trying to mount.

Problem is with mount -o bind and mount -oloop almost any
file/directory can be a source or destination of mounting.

Comment 2 Mike McLean 2004-03-25 23:22:55 UTC

So what is the correct way to perform a loopback mount with selinux?

Comment 3 Colin Walters 2004-04-19 17:57:16 UTC

staff_t transitions now into a mount domain too, so this bug is fixed
as far as I can see.

Mike:  I just added a new type, sysadm_mount_source_t that you can use
for loopback devices.  So the correct way is now:

chcon -t sysadm_mount_source_t foo.iso
mount -o loop foo.iso /mnt/cdrom

This will be in the next policy upload.

Comment 4 Mike McLean 2004-04-19 18:30:27 UTC

What about loopback mounting an iso that is on an RO-mounted NFS
filesystem?