Bug 582921
Summary: | SELinux is preventing /sbin/mount.cifs "getcap" access . | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Michal Hlavinka <mhlavink> |
Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | 13 | CC: | dwalsh, mgrepl |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | x86_64 | ||
OS: | Linux | ||
Whiteboard: | setroubleshoot_trace_hash:2e24793e922a4be40a6280e52e258a1bb49734632f4f9f6976371bc34913b7a2 | ||
Fixed In Version: | selinux-policy-3.7.19-2.fc13 | Doc Type: | Bug Fix |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2010-04-21 22:00:58 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Michal Hlavinka
2010-04-16 07:37:35 UTC
also setcap denial poped up: Summary: SELinux is preventing /sbin/mount.cifs "setcap" access . Detailed Description: [mount.cifs has a permissive type (mount_t). This access was not denied.] SELinux denied access requested by mount.cifs. It is not expected that this access is required by mount.cifs and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:mount_t:s0 Target Context system_u:system_r:mount_t:s0 Target Objects None [ process ] Source mount.cifs Source Path /sbin/mount.cifs Port <Unknown> Host nbone.mihlnet Source RPM Packages cifs-utils-4.3-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.15-4.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name nbone.mihlnet Platform Linux nbone.mihlnet 2.6.33.2-47.fc13.x86_64 #1 SMP Wed Apr 14 21:34:20 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Fri 16 Apr 2010 09:32:34 AM CEST Last Seen Fri 16 Apr 2010 09:32:34 AM CEST Local ID d26919f2-a9c9-44d2-8c1b-cf7f83938d3a Line Numbers Raw Audit Messages node=nbone.mihlnet type=AVC msg=audit(1271403154.374:20085): avc: denied { setcap } for pid=3195 comm="mount.cifs" scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:mount_t:s0 tclass=process node=nbone.mihlnet type=SYSCALL msg=audit(1271403154.374:20085): arch=c000003e syscall=126 success=yes exit=128 a0=7f7a0cd7f6f4 a1=7f7a0cd7f6fc a2=1 a3=30 items=0 ppid=3194 pid=3195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount.cifs" exe="/sbin/mount.cifs" subj=system_u:system_r:mount_t:s0 key=(null) Fixed in selinux-policy-3.7.19-2.fc13.noarch Miroslav add this one to F12. and still one missing. Above reports were from only unsuccessful mounting (autofs was not set correctly). During/after successful mounting I got also: Summary: SELinux is preventing /sbin/mount.cifs "setpcap" access . Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by mount.cifs. It is not expected that this access is required by mount.cifs and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:mount_t:s0 Target Context unconfined_u:system_r:mount_t:s0 Target Objects None [ capability ] Source mount.cifs Source Path /sbin/mount.cifs Port <Unknown> Host nbone.mihlnet Source RPM Packages cifs-utils-4.3-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.15-4.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name catchall Host Name nbone.mihlnet Platform Linux nbone.mihlnet 2.6.33.2-47.fc13.x86_64 #1 SMP Wed Apr 14 21:34:20 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Fri 16 Apr 2010 06:26:06 PM CEST Last Seen Fri 16 Apr 2010 06:26:06 PM CEST Local ID c99a3ff6-a969-49c5-bfff-78540b45d076 Line Numbers Raw Audit Messages node=nbone.mihlnet type=AVC msg=audit(1271435166.740:20160): avc: denied { setpcap } for pid=15673 comm="mount.cifs" capability=8 scontext=unconfined_u:system_r:mount_t:s0 tcontext=unconfined_u:system_r:mount_t:s0 tclass=capability node=nbone.mihlnet type=SYSCALL msg=audit(1271435166.740:20160): arch=c000003e syscall=157 success=yes exit=0 a0=18 a1=0 a2=0 a3=0 items=0 ppid=15672 pid=15673 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="mount.cifs" exe="/sbin/mount.cifs" subj=unconfined_u:system_r:mount_t:s0 key=(null) Fixed in selinux-policy-3.7.19-3.fc13.noarch selinux-policy-3.7.19-2.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-2.fc13 selinux-policy-3.7.19-2.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-2.fc13 selinux-policy-3.7.19-2.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. |