Bug 435793
| Summary: | AVC denial on mount of read-only NFS | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Warren Togami <wtogami> | ||||
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> | ||||
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 8 | CC: | jkubin | ||||
| Target Milestone: | --- | Keywords: | Reopened | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2008-03-19 18:33:38 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 188611 | ||||||
| Attachments: |
|
||||||
Created attachment 296685 [details]
selinux_alert.txt
Fixed in selinux-policy-3.3.1-10.fc9 What exactly did you do? Could you do the same thing for F-8 selinux-policy too? I allowed rpc.mountd to write to the lvm_control chr_file. Fixed in selinux-policy-3.0.8-91.fc8 |
selinux-policy-3.0.8-87.fc8 /etc/exports: /opt/ltsp *(ro,async) mkdir /mnt/temp mount -t nfs -o ro 127.0.0.1:/opt/ltsp/i386 /mnt/temp host=newcaprica.boston.redhat.com type=AVC msg=audit(1204530354.521:30): avc: denied { write } for pid=2457 comm="rpc.mountd" name="control" dev=tmpfs ino=259 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file Mount succeeds and works fine for read-only access. Full alert text attached below.