Bug 560152

Summary:

SELinux is preventing mv from creating a file with a context of unlabeled_t on a
filesystem.

Detailed Description:

SELinux is preventing mv from creating a file with a context of unlabeled_t on a
filesystem. Usually this happens when you ask the cp command to maintain the
context of a file when copying between file systems, "cp -a" for example. Not
all file contexts should be maintained between the file systems. For example, a
read-only file type like iso9660_t should not be placed on a r/w system. "cp -P"
might be a better solution, as this will adopt the default file context for the
destination.

Allowing Access:

Use a command like "cp -P" to preserve all permissions except SELinux context.

Additional Information:

Source Context                system_u:object_r:unlabeled_t:s0
Target Context                system_u:object_r:fusefs_t:s0
Target Objects                .gnome2 [ filesystem ]
Source                        mv
Source Path                   /bin/mv
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           coreutils-6.12-20.fc10
Target RPM Packages           
Policy RPM                    selinux-policy-3.5.13-74.fc10
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   filesystem_associate
Host Name                     (removed)
Platform                      Linux (removed)
                              2.6.27.41-170.2.117.fc10.i686 #1 SMP Thu Dec 10
                              11:00:29 EST 2009 i686 i686
Alert Count                   1
First Seen                    Mon 01 Jan 2001 06:50:24 AM LKT
Last Seen                     Mon 01 Jan 2001 06:50:24 AM LKT
Local ID                      05708be3-a072-4642-a2cb-e1be8c8eefbe
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(978310224.393:30): avc:  denied  { associate } for  pid=2535 comm="mv" name=".gnome2" scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fusefs_t:s0 tclass=filesystem

node=(removed) type=SYSCALL msg=audit(978310224.393:30): arch=40000003 syscall=39 success=no exit=-13 a0=82802b0 a1=1c0 a2=805f34c a3=82802b0 items=0 ppid=2516 pid=2535 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="mv" exe="/bin/mv" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)



Hash String generated from  selinux-policy-3.5.13-74.fc10,filesystem_associate,mv,unlabeled_t,fusefs_t,filesystem,associate
audit2allow suggests:

#============= unlabeled_t ==============
allow unlabeled_t fusefs_t:filesystem associate;