Bug 998129
| Summary: | AVC denials upon login/logon when pam_mount is used | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jan Pazdziora (Red Hat) <jpazdziora> |
| Component: | selinux-policy-targeted | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED DUPLICATE | QA Contact: | Ben Levenson <benl> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | dwalsh, jpazdziora |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-01-06 13:07:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Probably we could start to think about different labeling for mount.crypt. Yes I think that would be a good idea. I just hit the issue again, on Fedora 20: pam_mount-2.14-1.fc20.x86_64 selinux-policy-targeted-3.12.1-183.fc20.noarch *** This bug has been marked as a duplicate of bug 1086822 *** |
Description of problem: I use pam_mount to mount user's encrypted home. When the user logs in and logs out using ssh, AVC denials are logged. Version-Release number of selected component (if applicable): pam_mount-2.13-4.20130707git966c6bea.fc19.i686 selinux-policy-targeted-3.12.1-69.fc19.noarch How reproducible: Deterministic. Steps to Reproduce: 1. Have pam_mount configured in /etc/pam.d/system-auth-ac and /etc/pam.d/password-auth-ac and in /etc/security/pam_mount.conf.xml with <volume user="user" fstype="crypt" path="/dev/vg_host/home-user-enc" mountpoint="/home/user" options="fstype=ext4"/> 2. Login in to the machine with ssh, then type exit. Actual results: AVC denials upon log on: type=AVC msg=audit(1376748630.921:506): avc: denied { getattr } for pid=1341 comm="sshd" path="/run/mount/utab" dev="tmpfs" ino=9458 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_var_run_t:s0 tclass=file type=AVC msg=audit(1376748630.921:507): avc: denied { read write } for pid=1341 comm="sshd" name="utab" dev="tmpfs" ino=9458 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_var_run_t:s0 tclass=file type=AVC msg=audit(1376748630.921:507): avc: denied { open } for pid=1341 comm="sshd" path="/run/mount/utab" dev="tmpfs" ino=9458 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_var_run_t:s0 tclass=file AVC denitals upon log out: type=AVC msg=audit(1376748638.756:518): avc: denied { execute } for pid=1433 comm="sshd" name="mount.crypt" dev="dm-1" ino=267237 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file type=AVC msg=audit(1376748638.756:518): avc: denied { read open } for pid=1433 comm="sshd" path="/usr/sbin/mount.crypt" dev="dm-1" ino=267237 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file type=AVC msg=audit(1376748638.756:518): avc: denied { execute_no_trans } for pid=1433 comm="sshd" path="/usr/sbin/mount.crypt" dev="dm-1" ino=267237 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_exec_t:s0 tclass=file type=AVC msg=audit(1376748638.765:519): avc: denied { read } for pid=1433 comm="umount.crypt" name="cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file type=AVC msg=audit(1376748638.765:519): avc: denied { open } for pid=1433 comm="umount.crypt" path="/run/cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file type=AVC msg=audit(1376748638.765:520): avc: denied { lock } for pid=1433 comm="umount.crypt" path="/run/cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file type=AVC msg=audit(1376748638.765:521): avc: denied { getattr } for pid=1433 comm="umount.crypt" path="/run/cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file type=AVC msg=audit(1376748638.767:522): avc: denied { write } for pid=1433 comm="umount.crypt" name="cmtab" dev="tmpfs" ino=31004 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file type=AVC msg=audit(1376748639.303:523): avc: denied { read } for pid=1433 comm="umount.crypt" name="dm-6" dev="devtmpfs" ino=25416 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file type=AVC msg=audit(1376748639.303:523): avc: denied { open } for pid=1433 comm="umount.crypt" path="/dev/dm-6" dev="devtmpfs" ino=25416 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file type=AVC msg=audit(1376748639.304:524): avc: denied { getattr } for pid=1433 comm="umount.crypt" path="/dev/mapper/control" dev="devtmpfs" ino=8163 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file type=AVC msg=audit(1376748639.304:525): avc: denied { read write } for pid=1433 comm="umount.crypt" name="control" dev="devtmpfs" ino=8163 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file type=AVC msg=audit(1376748639.304:525): avc: denied { open } for pid=1433 comm="umount.crypt" path="/dev/mapper/control" dev="devtmpfs" ino=8163 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file type=AVC msg=audit(1376748639.306:526): avc: denied { ioctl } for pid=1433 comm="umount.crypt" path="/dev/mapper/control" dev="devtmpfs" ino=8163 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lvm_control_t:s0 tclass=chr_file type=AVC msg=audit(1376748639.306:527): avc: denied { ipc_info } for pid=1433 comm="umount.crypt" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:kernel_t:s0 tclass=system type=AVC msg=audit(1376748639.308:528): avc: denied { read } for pid=1433 comm="umount.crypt" name="queue.bin" dev="tmpfs" ino=25438 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file type=AVC msg=audit(1376748639.308:528): avc: denied { open } for pid=1433 comm="umount.crypt" path="/run/udev/queue.bin" dev="tmpfs" ino=25438 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file type=AVC msg=audit(1376748639.309:529): avc: denied { getattr } for pid=1433 comm="umount.crypt" path="/run/udev/queue.bin" dev="tmpfs" ino=25438 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file This is under permissive. Expected results: No AVC denials. Additional info: