Bug 147659 - smbd_t getattr denials through caused by df
smbd_t getattr denials through caused by df
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy-strict (Show other bugs)
rawhide
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-02-09 22:25 EST by Ivan Gyurdiev
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version: 1.25.4-10.1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-09-15 11:56:48 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ivan Gyurdiev 2005-02-09 22:25:40 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041228 Firefox/1.0 Fedora/1.0-8

Description of problem:
The following denials occur when doing df with a presently
mounted smbfs filesystem. Why is it that such strange things are happening?
- smbd looking at other mounted filesystems when queried through df
- mplayer looking at mozilla specific files when launched from mozilla.. etc

audit(1108005672.356:0): avc:  denied  { getattr } for  pid=6037 exe=/usr/sbin/smbd path=/boot dev=hda1 ino=2 scontext=system_u:system_r:smbd_t tcontext=system_u:object_r:boot_t tclass=dir

audit(1108005672.356:0): avc:  denied  { getattr } for  pid=6037 exe=/usr/sbin/smbd path=/dev/pts dev=devpts ino=1 scontext=system_u:system_r:smbd_t tcontext=system_u:object_r:devpts_t tclass=dir

audit(1108005672.357:0): avc:  denied  { getattr } for  pid=6037 exe=/usr/sbin/smbd path=/dev/shm dev=tmpfs ino=4595 scontext=system_u:system_r:smbd_t tcontext=system_u:object_r:tmpfs_t tclass=dir

Version-Release number of selected component (if applicable):
selinux-policy-strict-1.21.11-2

How reproducible:
Always

Steps to Reproduce:
1. See summary

Additional info:
Comment 1 Daniel Walsh 2005-02-21 19:02:12 EST
I have no idea.
Added some dontaudit rules to sambe.te.
1.21.14-3

Dan
Comment 2 Ivan Gyurdiev 2005-04-23 09:39:19 EDT
I would like to reconfirm on:
selinux-policy-strict-1.23.12-1

However, it's in permissive mode...

Maybe we should investigate why this is happening as opposed to adding
dontaudit rules. 

Comment 3 Ivan Gyurdiev 2005-05-27 22:35:22 EDT
There's possibility to use the mount_point rule to fix this properly.
That's one of the reasons I added it in the first place.

However, I'm still not sure why it does this - it would be better to
find the exact place in code where it needs it - it's probably the 
function that computes free space or something in the smbd.


Note You need to log in before you can comment on or make changes to this bug.