Bug 1000642 - staff_t can't access mock build outputs
staff_t can't access mock build outputs
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2013-08-23 19:31 EDT by Garrett Holmstrom
Modified: 2013-09-22 20:44 EDT (History)
4 users (show)

See Also:
Fixed In Version: selinux-policy-3.11.1-103.fc18
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-09-22 20:44:34 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Garrett Holmstrom 2013-08-23 19:31:25 EDT
Description of problem:
I usually run as staff_t, which doesn't seem to have access to /var/lib/mock/results or anything else that happens to be labelled mock_var_lib_t.  This prevents me from grabbing packages after mock finishes building them.  Should it?

type=SYSCALL msg=audit(1377300241.231:11272): arch=c000003e syscall=4 success=no exit=-13 a0=7ffffbe7b36a a1=7ffffbe796c0 a2=7ffffbe796c0 a3=2 items=0 ppid=2067 pid=11853 auid=1000 uid=1000 gid=100 euid=1000 suid=1000 fsuid=1000 egid=100 sgid=100 fsgid=100 ses=1 tty=pts4 comm="cp" exe="/usr/bin/cp" subj=staff_u:staff_r:staff_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1377300241.231:11272): avc:  denied  { search } for  pid=11853 comm="cp" name="mock" dev="dm-1" ino=15460 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mock_var_lib_t:s0 tclass=dir

Version-Release number of selected component (if applicable):
Comment 1 Miroslav Grepl 2013-08-27 05:00:58 EDT
commit 0e437ade6d7eccfd73d03db415915dfe79878440
Author: Miroslav Grepl <mgrepl@redhat.com>
Date:   Tue Aug 27 11:00:37 2013 +0200

    Allow roles which can run mock to read mock lib files to view results
Comment 2 Fedora Update System 2013-09-02 11:28:39 EDT
selinux-policy-3.11.1-101.fc18 has been submitted as an update for Fedora 18.
Comment 3 Fedora Update System 2013-09-02 19:27:22 EDT
Package selinux-policy-3.11.1-101.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-101.fc18'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
Comment 4 Fedora Update System 2013-09-10 07:17:34 EDT
selinux-policy-3.11.1-103.fc18 has been submitted as an update for Fedora 18.
Comment 5 Fedora Update System 2013-09-22 20:44:34 EDT
selinux-policy-3.11.1-103.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.