Bug 186915

Summary: mount does not translate SELIinux context options though libselinux
Product: [Fedora] Fedora Reporter: Paul Howarth <paul>
Component: util-linuxAssignee: Karel Zak <kzak>
Status: CLOSED ERRATA QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: medium    
Version: 5CC: igeorgex, mlh
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-03-30 20:04:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Paul Howarth 2006-03-27 14:05:08 UTC 
Description of problem:
The "context" and "fscontext" mount options no longer *seem* to be
supported by mount in FC5:

# mount -r -o
loop,fscontext=system_u:object_r:public_content_t
/srv/softlib/fedora/bordeaux/FC-5-i386-DVD.iso /srv/softlib/fedora/bordeaux/dvd
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

The same command fails in the same way with "fscontext" changed to
"context", but works if neither of those options is present. This leaves
me with the mounted DVD image having a context of iso9660_t, which is
reasonable but not what I want for serving out a local yum repository. 

Version-Release number of selected component (if applicable):
util-linux-2.13-0.20

Additional info:
After bringing this up on fedora-selinux-list,
(http://www.redhat.com/archives/fedora-selinux-list/2006-March/msg00110.html),
the problem was explained by Stephen Smalley:

  Error message that I get in /var/log/messages is
  SELinux: security_context_to_sid(system_u:object_r:public_content_t) failed
... errno=-22 (EINVAL).

  But if I add a ':s0' suffix to the context, it works.  So IIUC the
  problem here is that mount is directly passing the user-supplied context
  to the kernel without interacting with libselinux to translate it (via
  selinux_trans_to_raw_context).  Needs to be patched accordingly, and
  updated in FC5 as well as rawhide.

The workaround above is solving my problem, but as Stephen says, it needs fixing
 for FC5 and rawhide.

It doesn't help that the "context" and "fscontext" mount options aren't
documented in the mount manpage, but that's another ticket.
Comment 1 Karel Zak 2006-03-27 14:35:46 UTC 
*** Bug 179437 has been marked as a duplicate of this bug. ***