Bug 1121283 - SELinux prevents Nautilus from running cryptsetup to mount encrypted volume
Summary: SELinux prevents Nautilus from running cryptsetup to mount encrypted volume
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 21
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2014-07-18 21:10 UTC by Andrew Gunnerson
Modified: 2014-09-01 09:48 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-09-01 09:48:49 UTC

Attachments (Terms of Use)

Description Andrew Gunnerson 2014-07-18 21:10:30 UTC
Description of problem:

(I apologize if this doesn't belong under the selinux-policy component)

For some reason, SELinux is preventing Nautilus from executing cryptsetup to unlock an external encrypted volume. When I plug in my (encrypted) external drive and try to mount it, I get the following error:

(Screenshot) https://dl.dropboxusercontent.com/u/486665/Luks/Screenshot%20from%202014-07-18%2016%3A44%3A34.png

(Error Text)
Error unlocking /dev/sdc1: Command-line `cryptsetup luksOpen "/dev/sdc1" "luks-7cb3d180-ca8e-439a-8d11-ed536576a13c"' exited with non-zero exit status 1:

This is immediately followed by the following SELinux denial:

(Screenshot) https://dl.dropboxusercontent.com/u/486665/Luks/Screenshot%20from%202014-07-18%2016%3A45%3A10.png

(Full denial text) https://dl.dropboxusercontent.com/u/486665/Luks/selinux.txt

If I manually run the cryptsetup command that Nautilus shows, it succeeds without error. After I do that, Nautilus is even able to unmount the volume (I'm assuming it runs "cryptsetup luksClose ...").

(Screenshot) https://dl.dropboxusercontent.com/u/486665/Luks/Screenshot%20from%202014-07-18%2016%3A48%3A18.png

I'm not quite sure why "cryptsetup luksOpen..." fails only when it's run by Nautilus.

Version-Release number of selected component (if applicable):


Additional info:

Looking at the SELinux error, I'm seeing "system_u:system_r:lvm_t:s0", but my drive does not use LVM, just a single luks-encrypted ext4 partition.

Comment 1 Miroslav Grepl 2014-07-21 09:58:51 UTC
Could you attach raw AVC msgs?

Comment 2 Andrew Gunnerson 2014-07-21 22:45:44 UTC
Miroslav: Thanks for the reply! Are looking for the /var/log/audit/audit.log file?

I'll attach that to this bug report. From a quick grep, the first cryptsetup denial starts at line 25549.

type=AVC msg=audit(1405716212.399:2264): avc:  denied  { write } for  pid=23091 comm="cryptsetup" scontext=system_u:system_r:lvm_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=socket permissive=0
type=SYSCALL msg=audit(1405716212.399:2264): arch=c000003e syscall=46 success=no exit=-13 a0=9 a1=7fffe7273be0 a2=0 a3=5db items=0 ppid=1508 pid=23091 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cryptsetup" exe="/usr/sbin/cryptsetup" subj=system_u:system_r:lvm_t:s0 key=(null)

Comment 3 Andrew Gunnerson 2014-07-21 22:52:04 UTC
Sorry, Bugzilla doesn't seem to let me attach the log. Here's a link to it: https://dl.dropboxusercontent.com/u/486665/RHBZ1121283/audit.log

Comment 4 Miroslav Grepl 2014-09-01 09:48:49 UTC
Is this still an issue? I believe it has been fixed in the kernel.

Note You need to log in before you can comment on or make changes to this bug.