Bug 2196911
| Summary: | selinux prevents nfs id mapping | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Marek Greško <marek.gresko> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 38 | CC: | dwalsh, lvrabec, mmalik, nknazeko, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-11 06:52:54 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 2180611 *** |
When you list files in the nfs directory on the nfs client, you see all the files owned by nobody. NFS ID mapping is not working. System is nearly unusable when home directories on nfs without switching to permissive mode. You can see these logs: AVC avc: denied { search } for pid=... comm="nfsidmap" name="sss" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir permissive=1 AVC avc: denied { read } for pid=... comm="nfsidmap" name="passwd" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1 AVC avc: denied { open } for pid=... comm="nfsidmap" path="/var/lib/sss/mc/passwd" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1 AVC avc: denied { getattr } for pid=... comm="nfsidmap" path="/var/lib/sss/mc/passwd" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1 AVC avc: denied { map } for pid=... comm="nfsidmap" path="/var/lib/sss/mc/passwd" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_public_t:s0 tclass=file permissive=1 AVC avc: denied { write } for pid=... comm="nfsidmap" name="nss" dev="dm-1" ino=... scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=sock_file permissive=1 AVC avc: denied { connectto } for pid=... comm="nfsidmap" path="/var/lib/sss/pipes/nss" scontext=system_u:system_r:nfsidmap_t:s0 tcontext=system_u:system_r:sssd_t:s0 tclass=unix_stream_socket permissive=1 Reproducible: Always Steps to Reproduce: 1. Configure nfs client. 2. List directories on nfs share. 3. Files are displayed as owned by nobody. Actual Results: Files are displayed as owned by nobody. Expected Results: Correct file ownership displayed.