Bug 856565

Summary:	Selinux prevents automount from writing its pid file if it already exists
Product:	Red Hat Enterprise Linux 5	Reporter:	Ian Kent <ikent>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED NOTABUG	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.8	CC:	dwalsh, mmalik, yanwang
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-09-26 09:01:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	845503

Description Ian Kent 2012-09-12 10:38:30 UTC

Description of problem:
If the file /var/run/autofs.pid exists when autofs is started
Selinux will prevent automount from opening (and truncating)
the pid file to write the pid to it.


Version-Release number of selected component (if applicable):
selinux-policy-2.4.6-331.el5

How reproducible:
Always.

Steps to Reproduce:
1. touch /var/run/autofs.pid
2. service autofs start
  
Actual results:
ls -l /var/run/autofs.pid shows a zero length file and a
automount logs a permission denied message.

Expected results:
The pid file is truncated and the pid of the daemon is
written to the pid file.

Comment 1 RHEL Program Management 2012-09-12 10:58:40 UTC

This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux release.  Product Management has
requested further review of this request by Red Hat Engineering, for
potential inclusion in a Red Hat Enterprise Linux release for currently
deployed products.  This request is not yet committed for inclusion in
a release.

Comment 2 Miroslav Grepl 2012-09-12 11:42:18 UTC

Could you attach AVC msgs?

Comment 3 Milos Malik 2012-09-12 11:55:26 UTC

The problem is that /var/run/autofs.pid is mislabelled when you "touch" it.

# service autofs status
automount is stopped
# touch /var/run/autofs.pid
# ls -Z /var/run/autofs.pid
-rw-r--r--  root root root:object_r:var_run_t          /var/run/autofs.pid
# restorecon -v /var/run/autofs.pid
restorecon reset /var/run/autofs.pid context root:object_r:var_run_t:s0->system_u:object_r:automount_var_run_t:s0
# ls -Z /var/run/autofs.pid
-rw-r--r--  root root system_u:object_r:automount_var_run_t /var/run/autofs.pid
# service autofs start
Starting automount:                                        [  OK  ]
# service autofs status
automount (pid  27733) is running...
#

Comment 4 Milos Malik 2012-09-26 06:21:06 UTC

Seen in /var/log/messages:
----
Sep 26 08:13:01 rhel59 automount[3027]: become_daemon:1099: failed to write pid file /var/run/autofs.pid: Permission denied
Sep 26 08:13:02 rhel59 setroubleshoot: SELinux is preventing automount (automount_t) "write" to ./autofs.pid (var_run_t). For complete SELinux messages. run sealert -l 80dde560-7fb3-4c9b-b373-9231263b78c5
----

Here is the AVC:
----
type=PATH msg=audit(09/26/2012 08:13:01.833:42) : item=0 name=/var/run/autofs.pid inode=65946 dev=03:03 mode=file,644 ouid=root ogid=root rdev=00:00 obj=root:object_r:var_run_t:s0 
type=CWD msg=audit(09/26/2012 08:13:01.833:42) :  cwd=/ 
type=SYSCALL msg=audit(09/26/2012 08:13:01.833:42) : arch=i386 syscall=open success=no exit=-13(Permission denied) a0=bfa32f71 a1=8241 a2=1b6 a3=8cd01f0 items=1 ppid=3026 pid=3027 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=5 comm=automount exe=/usr/sbin/automount subj=root:system_r:automount_t:s0 key=(null) 
type=AVC msg=audit(09/26/2012 08:13:01.833:42) : avc:  denied  { write } for  pid=3027 comm=automount name=autofs.pid dev=hda3 ino=65946 scontext=root:system_r:automount_t:s0 tcontext=root:object_r:var_run_t:s0 tclass=file 
----

Very similar AVC can be seen on RHEL-6.4, but I still blame the mislabelled file. When you call "restorecon -Rv /var/run" the problem disappears.

Comment 5 Miroslav Grepl 2012-09-26 09:01:41 UTC

Yes, the pid file will be mislabeled if you just touch it or if you start a service by hand.