Bug 589755
| Summary: | selinux policy prevents mrepo mounting isos | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Need Real Name <lsof> | ||||
| Component: | mrepo | Assignee: | Susi Lehtola <susi.lehtola> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | low | ||||||
| Version: | 12 | CC: | dwalsh, lsof, mgrepl, sandro, susi.lehtola | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | mrepo-0.8.6-6.el5 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2010-05-31 18:16:56 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Need Real Name
2010-05-06 20:03:24 UTC
This looks wrong system_u:object_r:httpd_sys_content_t Should be system_u:object_r:httpd_sys_content_t:s0 # getenforce
Enforcing
# dmesg -c
# mrepo --remount
/usr/bin/mrepo:18: DeprecationWarning: The popen2 module is deprecated. Use the subprocess module.
import os, sys, glob, re, shutil, getopt, popen2
/usr/bin/mrepo:19: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
import ConfigParser, urlparse, sha, types, traceback
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
# dmesg -c
ISO 9660 Extensions: Microsoft Joliet Level 3
ISO 9660 Extensions: RRIP_1991A
SELinux: security_context_to_sid(system_u:object_r:httpd_sys_content_t) failed for (dev loop0, type iso9660) errno=-22
# mount|grep loop
# setenforce 0
# mrepo --remount
/usr/bin/mrepo:18: DeprecationWarning: The popen2 module is deprecated. Use the subprocess module.
import os, sys, glob, re, shutil, getopt, popen2
/usr/bin/mrepo:19: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
import ConfigParser, urlparse, sha, types, traceback
# dmesg -c
ISO 9660 Extensions: Microsoft Joliet Level 3
ISO 9660 Extensions: RRIP_1991A
SELinux: initialized (dev loop0, type iso9660), uses genfs_contexts
# mount|grep loop
/dev/loop0 on /var/www/mrepo/RHEL5.4-i386/disc1 type iso9660 (ro)
-rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/bin/mrepo Created attachment 412439 [details]
patch to fix selinux code in mrepo
You need to specify a :s0 on the end of the mount command. We have selinux python bindings also.
Need Real Name Can you try this patch to see if it fixes your problem. Works perfectly - thanks. There is another avc bug, but in the init script. I will file a separate bug. mrepo-0.8.6-6.el5 has been submitted as an update for Fedora EPEL 5. http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.el5 mrepo-0.8.6-6.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc13 mrepo-0.8.6-6.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc12 Thanks for the patch. mrepo-0.8.6-6.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update mrepo'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc12 mrepo-0.8.6-6.el5 has been pushed to the Fedora EPEL 5 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update mrepo'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.el5 mrepo-0.8.6-6.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update mrepo'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc13 mrepo-0.8.6-6.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report. mrepo-0.8.6-6.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. mrepo-0.8.6-6.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report. |