Bug 589755

Summary: selinux policy prevents mrepo mounting isos
Product: [Fedora] Fedora Reporter: Need Real Name <lsof>
Component: mrepoAssignee: Susi Lehtola <susi.lehtola>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 12CC: dwalsh, lsof, mgrepl, sandro, susi.lehtola
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: mrepo-0.8.6-6.el5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-05-31 18:16:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Attachments:
Description Flags
patch to fix selinux code in mrepo none

Description Need Real Name 2010-05-06 20:03:24 UTC
This is probably the worst bug you will get today because it contains almost no useful information.

Despite un-hiding dontaudit messages, I have no avcs to show you.

mrepo --remount fails when selinux is running in enforcing mode and works when in permissive mode.

This is because mrepo is labelled as a type for apache and apache isn't allowed to do touch loop devices or mount things.

The audit log and message log have no entries at all. This is worrying :)

dmesg shows
 security_context_to_sid(system_u:object_r:httpd_sys_content_t) failed for (dev loop0, type iso9660) errno=-22

Any chance of a boolean for this or a new type?

Comment 1 Daniel Walsh 2010-05-06 20:36:47 UTC
This looks wrong

system_u:object_r:httpd_sys_content_t

Should be

system_u:object_r:httpd_sys_content_t:s0

Comment 2 Need Real Name 2010-05-06 21:37:49 UTC
# getenforce 
Enforcing
# dmesg -c
# mrepo --remount
/usr/bin/mrepo:18: DeprecationWarning: The popen2 module is deprecated.  Use the subprocess module.
  import os, sys, glob, re, shutil, getopt, popen2
/usr/bin/mrepo:19: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
  import ConfigParser, urlparse, sha, types, traceback
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
# dmesg -c
ISO 9660 Extensions: Microsoft Joliet Level 3
ISO 9660 Extensions: RRIP_1991A
SELinux: security_context_to_sid(system_u:object_r:httpd_sys_content_t) failed for (dev loop0, type iso9660) errno=-22
# mount|grep loop

# setenforce 0
# mrepo --remount
/usr/bin/mrepo:18: DeprecationWarning: The popen2 module is deprecated.  Use the subprocess module.
  import os, sys, glob, re, shutil, getopt, popen2
/usr/bin/mrepo:19: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
  import ConfigParser, urlparse, sha, types, traceback
# dmesg -c
ISO 9660 Extensions: Microsoft Joliet Level 3
ISO 9660 Extensions: RRIP_1991A
SELinux: initialized (dev loop0, type iso9660), uses genfs_contexts
# mount|grep loop
/dev/loop0 on /var/www/mrepo/RHEL5.4-i386/disc1 type iso9660 (ro)

Comment 3 Need Real Name 2010-05-06 21:39:08 UTC
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/bin/mrepo

Comment 4 Daniel Walsh 2010-05-07 20:46:18 UTC
Created attachment 412439 [details]
patch to fix selinux code in mrepo

You need to specify a :s0 on the end of the mount command.  We have selinux python bindings also.

Comment 5 Daniel Walsh 2010-05-07 20:46:52 UTC
Need Real Name

Can you try this patch to see if it fixes your problem.

Comment 6 Need Real Name 2010-05-08 08:55:40 UTC
Works perfectly - thanks.

There is another avc bug, but in the init script. I will file a separate bug.

Comment 7 Fedora Update System 2010-05-11 06:07:46 UTC
mrepo-0.8.6-6.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.el5

Comment 8 Fedora Update System 2010-05-11 06:07:51 UTC
mrepo-0.8.6-6.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc13

Comment 9 Fedora Update System 2010-05-11 06:07:55 UTC
mrepo-0.8.6-6.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc12

Comment 10 Susi Lehtola 2010-05-11 06:11:25 UTC
Thanks for the patch.

Comment 11 Fedora Update System 2010-05-11 19:44:35 UTC
mrepo-0.8.6-6.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mrepo'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc12

Comment 12 Fedora Update System 2010-05-12 01:52:49 UTC
mrepo-0.8.6-6.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mrepo'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.el5

Comment 13 Fedora Update System 2010-05-12 12:18:26 UTC
mrepo-0.8.6-6.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mrepo'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc13

Comment 14 Fedora Update System 2010-05-31 18:16:50 UTC
mrepo-0.8.6-6.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2010-05-31 18:20:40 UTC
mrepo-0.8.6-6.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2010-06-03 15:01:29 UTC
mrepo-0.8.6-6.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.