Bug 842905
| Summary: | user_u crontab_t autofs .viminfo | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Sol Jerome <sol.jerome> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Michal Trunecka <mtruneck> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.5 | CC: | dwalsh, ebenes, mmalik, mtruneck |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.7.19-160.el6 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-02-21 08:26:03 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Do you have NFS Home dirs? (In reply to comment #2) > Do you have NFS Home dirs? Yes. They are mounted via autofs. This is currently allowed in F18. Will backport it. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0314.html |
Description of problem: A user_u selinux user is unable to write to .viminfo via crontab. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-155.el6_3.noarch How reproducible: always Steps to Reproduce: 1. automount user's home directory 2. setsebool -P use_nfs_home_dirs=1 3. try to edit crontab with EDITOR=vim Actual results: Crontab is edited successfully, with the following AVC: type=AVC msg=audit(1343164641.420:12541): avc: denied { search } for pid=4752 comm="vim" name="/" dev=autofs ino=10361 scontext=user_u:user_r:crontab_t:s0 tcontext=system_u:object_r:autofs_t:s0 tclass=dir Expected results: User should be able to write to ~/.viminfo. Additional info: # echo "avc: denied { search } for pid=4752 comm="vim" name="/" dev=autofs ino=10361 scontext=user_u:user_r:crontab_t:s0 tcontext=system_u:object_r:autofs_t:s0 tclass=dir" | audit2why avc: denied { search } for pid=4752 comm=vim name=/ dev=autofs ino=10361 scontext=user_u:user_r:crontab_t:s0 tcontext=system_u:object_r:autofs_t:s0 tclass=dir Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.