Description of problem: Trying this sort of thing: mount -oloop,ro boot.iso /mnt/cdrom works as staff_t but not as sysadm_t. Is that intentional? Version-Release number of selected component (if applicable): 1.9-11
The problem is the staff is not transitioning and sysadm, is. So in the case of sysadm you are running under mount_t context (Which is correct?) In the case of staff you are running under staff_t context. In this version of selinux staff_t is all powerfull, in the future it will not be. So this is a bug in that mount is not able to read the file it is trying to mount. Problem is with mount -o bind and mount -oloop almost any file/directory can be a source or destination of mounting.
So what is the correct way to perform a loopback mount with selinux?
staff_t transitions now into a mount domain too, so this bug is fixed as far as I can see. Mike: I just added a new type, sysadm_mount_source_t that you can use for loopback devices. So the correct way is now: chcon -t sysadm_mount_source_t foo.iso mount -o loop foo.iso /mnt/cdrom This will be in the next policy upload.
What about loopback mounting an iso that is on an RO-mounted NFS filesystem?