Bug 980509

Summary:	some *_use_nfs booleans don't contain rules for autofs_t access
Product:	Red Hat Enterprise Linux 6	Reporter:	Michal Trunecka <mtruneck>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Michal Trunecka <mtruneck>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.5	CC:	dwalsh, ebenes, mgrepl
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.7.19-212.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-11-21 10:32:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Michal Trunecka 2013-07-02 14:42:22 UTC

Description of problem:
Some booleans which allow access to nfs don't contain rules to allow access to autofs as well.

Following booleans allow autofs_t access in RHEL7, but not in RHEL6:

allow_ftpd_anon_write
allow_ftpd_use_nfs
cobbler_use_nfs
git_system_enable_homedirs
git_system_use_nfs
openvpn_enable_homedirs
qemu_use_nfs
samba_share_nfs
sanlock_use_nfs
ssh_chroot_rw_homedirs
virt_use_nfs
virt_use_samba
xen_use_nfs

Following booleans allow access to nfs_t, but not autofs_t on both RHEL6 and 7 (is this correct or is it a bug in RHEL7 as well?):

allow_guest_exec_content
allow_staff_exec_content
allow_sysadm_exec_content
allow_user_exec_content
allow_xguest_exec_content
httpd_enable_cgi


Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-205.el6.noarch

Comment 2 Michal Trunecka 2013-08-15 12:27:48 UTC

These three booleans are still missing the autofs_t rules:

git_system_enable_homedirs
git_system_use_nfs
openvpn_enable_homedirs

selinux-policy-3.7.19-211.el6.noarch

Comment 3 Michal Trunecka 2013-08-15 12:30:01 UTC

And regarding this list:

allow_guest_exec_content
allow_staff_exec_content
allow_sysadm_exec_content
allow_user_exec_content
allow_xguest_exec_content
httpd_enable_cgi

is it ok not to have rules for autofs_t while having rules for nfs_t in these?

Comment 4 Miroslav Grepl 2013-08-23 07:42:04 UTC

(In reply to Michal Trunecka from comment #2)
> These three booleans are still missing the autofs_t rules:
> 
> git_system_enable_homedirs
> git_system_use_nfs
> openvpn_enable_homedirs
> 
> selinux-policy-3.7.19-211.el6.noarch

Fixing these booleans.

Comment 7 errata-xmlrpc 2013-11-21 10:32:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1598.html