Bug 120595
| Summary: | LVM policy needs work | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Noa Resare <noa> |
| Component: | policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED RAWHIDE | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | rawhide | CC: | de_lupus, gczarcinski, leonard-rh-bugzilla, pgraner, tvismor |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | triage|leonardjo|closed|rawhide | ||
| Fixed In Version: | 1.11.2-18 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2004-05-10 18:03:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Noa Resare
2004-04-11 19:11:31 UTC
'/sbin/lvm vgscan --mknodes' also fails when executed as root with enforcing enabled: [root@marit noa]# /sbin/lvm vgscan --mknodes Reading all physical volumes. This may take a while... /sys/block: opendir failed: Permission denied Found volume group "vg0" using metadata type lvm2 /dev/mapper/control: open failed: Permission denied Is device-mapper driver missing from kernel? [root@marit noa]# setenforce 0 [root@marit noa]# /sbin/lvm vgscan --mknodes Reading all physical volumes. This may take a while... Found volume group "vg0" using metadata type lvm2 Please attach avc messages from /var/log/messages doing the following:
# setenforce 0
# mv /etc/lvm /etc/lvm.bak
# /sbin/lvm lvscan
results in the following syslog message:
Apr 12 14:52:08 marit kernel: audit(1081774328.383:0): avc: denied {
create } for pid=6419 exe=/sbin/lvm name=lvm
scontext=root:system_r:lvm_t tcontext=root:object_r:etc_t tclass=dir
(i have updated to policy-1.10.2-5 since the original report)
Try adding file_type_auto_trans(lvm_t, etc_t, lvm_etc_t, dir) to /etc/security/selinux/src/policy/domains/program/lvm.te then type make -c /etc/security/selinux/src/policy/ load Does that help? I have added those lines to the latest policy with policy-1.11.2-6 the test command above ('/sbin/lvm vgscan'
without /etc/lvm) doesn't fail directly. However, the syslog gets the
following:
audit(1082483473.373:0): avc: denied { read } for pid=4063
exe=/sbin/lvm.static dev= ino=1 scontext=root:system_r:lvm_t
tcontext=system_u:object_r:devpts_t tclass=dir
audit(1082483474.146:0): avc: denied { getattr } for pid=4063
exe=/sbin/lvm.static path=/dev/shm dev= ino=2359
scontext=root:system_r:lvm_t tcontext=system_u:object_r:tmpfs_t tclass=dir
audit(1082483474.316:0): avc: denied { read } for pid=4063
exe=/sbin/lvm.static name=block dev= ino=243
scontext=root:system_r:lvm_t tcontext=system_u:object_r:sysfs_t tclass=dir
*** Bug 121323 has been marked as a duplicate of this bug. *** *** Bug 121259 has been marked as a duplicate of this bug. *** *** Bug 120962 has been marked as a duplicate of this bug. *** *** Bug 121323 has been marked as a duplicate of this bug. *** Fixed in policy-1.11.2-18 |