Bug 444518

Summary: SELinux is preventing rpc.mountd (nfsd_t) "getattr" to /dev/oprofile (oprofilefs_t).
Product: [Fedora] Fedora Reporter: Dave Jones <davej>
Component: nfs-utilsAssignee: Steve Dickson <steved>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: dwalsh, pfrields
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-05-07 10:33:37 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Dave Jones 2008-04-28 16:08:02 EDT
I keep getting the following selinux alerts..

host=gelk type=AVC msg=audit(1209370387.669:1944098): avc: denied { getattr }
for pid=5549 comm="rpc.mountd" path="/dev/oprofile" dev=oprofilefs ino=25090
scontext=unconfined_u:system_r:nfsd_t:s0
tcontext=system_u:object_r:oprofilefs_t:s0 tclass=dir host=gelk type=SYSCALL
msg=audit(1209370387.669:1944098): arch=c000003e syscall=4 success=no exit=-13
a0=7fff4549dbc0 a1=7fff4549db30 a2=7fff4549db30 a3=0 items=0 ppid=1 pid=5549
auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=197568 comm="rpc.mountd" exe="/usr/sbin/rpc.mountd"
subj=unconfined_u:system_r:nfsd_t:s0 key=(null) 

I have no idea what's causing them.  They seem to happen at various times of the
day, sometimes even whilst I'm asleep.

Why nfsd is touching /dev/oprofile at all I've no idea.
This reminds me of a similar bug I had a while back that 'went away' where the
same thing was happening but that was /dev/admmidi instead.
Comment 1 Steve Dickson 2008-05-07 10:00:46 EDT
This probably has to do with the fact thatrpc.mountd is 
searching for the uuid of some export. It used the routines
in libblkid. 

The reason the other bug 'went away' is I removed a blkid
call (blkid_probe_all_new()) that *always* touch every 
/dev entry, which was obviously not needed... 

So I wonder if something in the liblkid lib has changed...

Dan, is there some policy that problems using this interface should be 
using or set? 
Comment 2 Daniel Walsh 2008-05-07 10:33:37 EDT
Well this is fixed  in selinux-policy-3.3.1-45.fc9.noarch