Bug 1372106 - SELinux is preventing nfs-server-gene from read access on the file export_features
Summary: SELinux is preventing nfs-server-gene from read access on the file export_fea...
Keywords:
Status: CLOSED WORKSFORME
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 25
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-31 23:45 UTC by Anthony Messina
Modified: 2017-01-14 18:05 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-01-14 18:05:07 UTC
Type: Bug

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Anthony Messina 2016-08-31 23:45:38 UTC 
While the alert says "nfs-server-gene," I believe this is really related to the nfs-utils changes for /usr/lib/systemd/system-generators/nfs-server-generator

~]# rpm -q selinux-policy-targeted nfs-utils
selinux-policy-targeted-3.13.1-191.13.fc24.noarch
nfs-utils-1.3.4-1.rc2.fc24.x86_64

~]# ls -lZ /usr/lib/systemd/system-generators/nfs-server-generator
-rwxr-xr-x. 1 root root system_u:object_r:init_exec_t:s0 45864 Aug 25 07:12 /usr/lib/systemd/system-generators/nfs-server-generator


~]# ls -lZ /proc/fs/nfsd/export_features 
-r--r--r--. 1 root root system_u:object_r:nfsd_fs_t:s0 0 Aug 29 18:33 /proc/fs/nfsd/export_features

type=AVC msg=audit(1472677507.798:556): avc:  denied  { read } for  pid=9027 comm="nfs-server-gene" name="export_features" dev="nfsd" ino=3 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=file permissive=0
Comment 1 Anthony Messina 2017-01-14 18:05:07 UTC 
This seems to have been fixed with one of the SELinux F25 updates as I don't see this error any longer.
Note You need to log in before you can comment on or make changes to this bug.