Bug 409631

Summary: Constant selinux alerts from encfs
Product: [Fedora] Fedora Reporter: Brian G. Anderson <bikehead>
Component: selinux-policyAssignee: Daniel Walsh <dwalsh>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: 8CC: jkubin, lemenkov
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Current Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-07-14 12:03:31 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Brian G. Anderson 2007-12-03 23:43:16 UTC
Description of problem:
I get a regular stream of selinux warnings from my mounted encfs system.  See below.

Summary
    SELinux is preventing encfs (xdm_t) "getattr" to /boot (boot_t).

Detailed Description
    SELinux denied access requested by encfs. It is not expected that this
    access is required by encfs and this access may signal an intrusion attempt.
    It is also possible that the specific version or configuration of the
    application is causing it to require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for /boot, restorecon -v /boot If
    this does not work, there is currently no automatic way to allow this
    access. Instead,  you can generate a local policy module to allow this
    access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
    can disable SELinux protection altogether. Disabling SELinux protection is
    not recommended. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Additional Information        

Source Context                system_u:system_r:xdm_t:SystemLow-SystemHigh
Target Context                system_u:object_r:boot_t
Target Objects                /boot [ dir ]
Affected RPM Packages         filesystem-2.4.11-1.fc8 [target]
Policy RPM                    selinux-policy-3.0.8-62.fc8
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   plugins.catchall_file
Host Name                     kelly
Platform                      Linux kelly 2.6.23.8-63.fc8 #1 SMP Wed Nov 21
                              18:51:08 EST 2007 i686 i686
Alert Count                   12
First Seen                    Mon 03 Dec 2007 06:36:06 AM PST
Last Seen                     Mon 03 Dec 2007 03:38:15 PM PST
Local ID                      6d414b14-91b6-43c2-ae9a-f6d8f27069aa
Line Numbers                  

Raw Audit Messages            

avc: denied { getattr } for comm=encfs dev=sda1 path=/boot pid=3215
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dir
tcontext=system_u:object_r:boot_t:s0



Version-Release number of selected component (if applicable):
fuse-encfs-1.3.2-1.fc7
selinux-policy-targeted-3.0.8-62.fc8
selinux-policy-3.0.8-62.fc8

How reproducible:
always

Steps to Reproduce:
1. Create a encfs filesystem and mount it in home directory.
2.
3.
  
Actual results:
constant selinux warnings

Expected results:
no warnings

Additional info:

Comment 1 Peter Lemenkov 2008-01-23 09:41:29 UTC
Looks like this bug doesn't concerned with encfs but rather with selinux policies.

You should adjust your selinux policies. Take a look at the following articles
(just for starting point):

http://docs.fedoraproject.org/selinux-apache-fc3/sn-debugging-and-customizing.html
http://www.linuxdevcenter.com/pub/a/linux/excerpt/selnx_1/index.html


Comment 2 Peter Lemenkov 2008-07-12 07:27:01 UTC
Reassigning to selinux-team

Comment 3 Daniel Walsh 2008-07-14 12:03:31 UTC
Please update to the latest selinux-policy.