Red Hat Bugzilla – Bug 118975
staff_t can loopback mount but sysadm_t can't
Last modified: 2007-11-30 17:10:38 EST
Description of problem:
Trying this sort of thing:
mount -oloop,ro boot.iso /mnt/cdrom
works as staff_t but not as sysadm_t. Is that intentional?
Version-Release number of selected component (if applicable):
The problem is the staff is not transitioning and sysadm, is. So in
the case of sysadm you are running under mount_t context (Which is
correct?) In the case of staff you are running under staff_t context.
In this version of selinux staff_t is all powerfull, in the future it
will not be. So this is a bug in that mount is not able to read the
file it is trying to mount.
Problem is with mount -o bind and mount -oloop almost any
file/directory can be a source or destination of mounting.
So what is the correct way to perform a loopback mount with selinux?
staff_t transitions now into a mount domain too, so this bug is fixed
as far as I can see.
Mike: I just added a new type, sysadm_mount_source_t that you can use
for loopback devices. So the correct way is now:
chcon -t sysadm_mount_source_t foo.iso
mount -o loop foo.iso /mnt/cdrom
This will be in the next policy upload.
What about loopback mounting an iso that is on an RO-mounted NFS