Bug 1156177 - SELinux error when unplugging USB drive with RAID
Summary: SELinux error when unplugging USB drive with RAID
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 20
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-10-23 18:06 UTC by Ken Dreyer
Modified: 2015-03-10 00:55 UTC (History)
5 users (show)

Fixed In Version: selinux-policy-3.12.1-197.fc20
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-03-10 00:55:48 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Ken Dreyer 2014-10-23 18:06:05 UTC
Background: I unplugged a USB SATA hard drive from my computer, and this triggered the SELinux denial. This hard drive was previously part of a software RAID1 from another computer.



SELinux is preventing /usr/sbin/mdadm from 'create' accesses on the blk_file .

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that mdadm should be allowed create access on the  blk_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep mdadm /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:mdadm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:tmp_t:s0
Target Objects                 [ blk_file ]
Source                        mdadm
Source Path                   /usr/sbin/mdadm
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           mdadm-3.3-7.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-189.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.16.6-200.fc20.x86_64 #1 SMP Wed
                              Oct 15 13:06:51 UTC 2014 x86_64 x86_64
Alert Count                   4
First Seen                    2014-10-23 11:39:49 MDT
Last Seen                     2014-10-23 11:50:25 MDT
Local ID                      0a742a2b-0bbd-406c-b3a8-9d0271a7524f

Raw Audit Messages
type=AVC msg=audit(1414086625.486:399): avc:  denied  { create } for  pid=2235 comm="mdadm" name=".tmp.md.2235:8:18" scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=blk_file permissive=0


type=SYSCALL msg=audit(1414086625.486:399): arch=x86_64 syscall=mknod success=no exit=EACCES a0=7fff894e8970 a1=6180 a2=812 a3=0 items=0 ppid=2234 pid=2235 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=mdadm exe=/usr/sbin/mdadm subj=system_u:system_r:mdadm_t:s0-s0:c0.c1023 key=(null)

Hash: mdadm,mdadm_t,tmp_t,blk_file,create

Comment 1 Daniel Walsh 2015-01-03 13:23:32 UTC
26479b18b02297efde6c76d1ba7c6475970c696f and
eb2b9ea632ede55bf233254bbe57f689f6080f4e fix this in git.

Comment 2 Fedora Update System 2015-01-27 16:56:39 UTC
selinux-policy-3.12.1-197.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-197.fc20

Comment 3 Fedora Update System 2015-01-30 04:41:35 UTC
Package selinux-policy-3.12.1-197.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-197.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-1398/selinux-policy-3.12.1-197.fc20
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2015-03-10 00:55:48 UTC
selinux-policy-3.12.1-197.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.