Bug 147659 - smbd_t getattr denials through caused by df
Summary: smbd_t getattr denials through caused by df
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-strict   
(Show other bugs)
Version: rawhide
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact:
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-02-10 03:25 UTC by Ivan Gyurdiev
Modified: 2007-11-30 22:11 UTC (History)
0 users

Fixed In Version: 1.25.4-10.1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-09-15 15:56:48 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Ivan Gyurdiev 2005-02-10 03:25:40 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041228 Firefox/1.0 Fedora/1.0-8

Description of problem:
The following denials occur when doing df with a presently
mounted smbfs filesystem. Why is it that such strange things are happening?
- smbd looking at other mounted filesystems when queried through df
- mplayer looking at mozilla specific files when launched from mozilla.. etc

audit(1108005672.356:0): avc:  denied  { getattr } for  pid=6037 exe=/usr/sbin/smbd path=/boot dev=hda1 ino=2 scontext=system_u:system_r:smbd_t tcontext=system_u:object_r:boot_t tclass=dir

audit(1108005672.356:0): avc:  denied  { getattr } for  pid=6037 exe=/usr/sbin/smbd path=/dev/pts dev=devpts ino=1 scontext=system_u:system_r:smbd_t tcontext=system_u:object_r:devpts_t tclass=dir

audit(1108005672.357:0): avc:  denied  { getattr } for  pid=6037 exe=/usr/sbin/smbd path=/dev/shm dev=tmpfs ino=4595 scontext=system_u:system_r:smbd_t tcontext=system_u:object_r:tmpfs_t tclass=dir

Version-Release number of selected component (if applicable):
selinux-policy-strict-1.21.11-2

How reproducible:
Always

Steps to Reproduce:
1. See summary

Additional info:

Comment 1 Daniel Walsh 2005-02-22 00:02:12 UTC
I have no idea.
Added some dontaudit rules to sambe.te.
1.21.14-3

Dan

Comment 2 Ivan Gyurdiev 2005-04-23 13:39:19 UTC
I would like to reconfirm on:
selinux-policy-strict-1.23.12-1

However, it's in permissive mode...

Maybe we should investigate why this is happening as opposed to adding
dontaudit rules. 



Comment 3 Ivan Gyurdiev 2005-05-28 02:35:22 UTC
There's possibility to use the mount_point rule to fix this properly.
That's one of the reasons I added it in the first place.

However, I'm still not sure why it does this - it would be better to
find the exact place in code where it needs it - it's probably the 
function that computes free space or something in the smbd.




Note You need to log in before you can comment on or make changes to this bug.