Bug 800929
| Summary: | nfs-server restart causes avc denial, avc: denied { execute } for pid=14480 comm="sh" name="mount" | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Petr Sklenar <psklenar> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.0 | CC: | mmalik |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-06-13 13:12:35 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
If you run in permissive mode, do you see any other AVC's? Yes, following AVCs appear in permissive mode:
----
time->Tue Apr 10 11:12:19 2012
type=SYSCALL msg=audit(1334049139.673:71): arch=c000003e syscall=59 success=yes exit=0 a0=177c2b0 a1=177c3d0 a2=177af60 a3=7fff88b1cfa0 items=0 ppid=1319 pid=1320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(1334049139.673:71): avc: denied { execute_no_trans } for pid=1320 comm="sh" path="/bin/mount" dev=sda4 ino=2883655 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file
type=AVC msg=audit(1334049139.673:71): avc: denied { execute } for pid=1320 comm="sh" name="mount" dev=sda4 ino=2883655 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file
----
time->Tue Apr 10 11:12:19 2012
type=SYSCALL msg=audit(1334049139.677:72): arch=c000003e syscall=2 success=yes exit=3 a0=7fb3682c14f0 a1=42 a2=1a4 a3=7fffbc3a5dc0 items=0 ppid=1319 pid=1320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(1334049139.677:72): avc: denied { write } for pid=1320 comm="mount" name="utab" dev=tmpfs ino=1970 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_var_run_t:s0 tclass=file
----
time->Tue Apr 10 11:12:19 2012
type=SYSCALL msg=audit(1334049139.678:73): arch=c000003e syscall=165 success=yes exit=0 a0=7fb3693dd1d0 a1=7fb3693dd1f0 a2=7fb3693dd210 a3=ffffffffc0ed0000 items=0 ppid=1319 pid=1320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(1334049139.678:73): avc: denied { module_request } for pid=1320 comm="mount" kmod="nfsd" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
type=AVC msg=audit(1334049139.678:73): avc: denied { mounton } for pid=1320 comm="mount" path="/proc/fs/nfsd" dev=proc ino=4026531845 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=dir
----
time->Tue Apr 10 11:12:19 2012
type=SYSCALL msg=audit(1334049139.803:74): arch=c000003e syscall=21 success=yes exit=0 a0=7fb3693dd1f0 a1=2 a2=0 a3=7fffbc3a5f80 items=0 ppid=1319 pid=1320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:nfsd_t:s0 key=(null)
type=AVC msg=audit(1334049139.803:74): avc: denied { write } for pid=1320 comm="mount" name="/" dev=nfsd ino=1 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=dir
----
Fixed in selinux-policy-3.10.0-114.fc17 This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request. |
Description of problem: service nfs-server restart causes avc denial and its not started Version-Release number of selected component (if applicable): nfs-utils-1.2.5-3.el7.x86_64 selinux-policy-3.10.0-56.el7.noarch How reproducible: deterministic Steps to Reproduce: 1. service nfs-server restart Actual results: # restorecon /bin/mount # getenforce Enforcing # ls -laZ /bin/mount -rwsr-xr-x. root root system_u:object_r:mount_exec_t:s0 /bin/mount # service nfs-server restart Redirecting to /bin/systemctl restart nfs-server.service type=AVC msg=audit(1331129342.367:1159): avc: denied { execute } for pid=14480 comm="sh" name="mount" dev=dm-1 ino=397106 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file type=AVC msg=audit(1331129342.368:1160): avc: denied { execute } for pid=14480 comm="sh" name="mount" dev=dm-1 ino=397106 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file Job failed. See system logs and 'systemctl status' for details. # find / -inum 397106 /bin/mount Expected results: no denial nfs-server can start Additional info: