Bug 186915 - mount does not translate SELIinux context options though libselinux
mount does not translate SELIinux context options though libselinux
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: util-linux (Show other bugs)
5
All Linux
medium Severity medium
: ---
: ---
Assigned To: Karel Zak
Ben Levenson
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-03-27 09:05 EST by Paul Howarth
Modified: 2007-11-30 17:11 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-03-30 15:04:29 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Paul Howarth 2006-03-27 09:05:08 EST
Description of problem:
The "context" and "fscontext" mount options no longer *seem* to be
supported by mount in FC5:

# mount -r -o
loop,fscontext=system_u:object_r:public_content_t
/srv/softlib/fedora/bordeaux/FC-5-i386-DVD.iso /srv/softlib/fedora/bordeaux/dvd
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

The same command fails in the same way with "fscontext" changed to
"context", but works if neither of those options is present. This leaves
me with the mounted DVD image having a context of iso9660_t, which is
reasonable but not what I want for serving out a local yum repository. 

Version-Release number of selected component (if applicable):
util-linux-2.13-0.20

Additional info:
After bringing this up on fedora-selinux-list,
(http://www.redhat.com/archives/fedora-selinux-list/2006-March/msg00110.html),
the problem was explained by Stephen Smalley:

  Error message that I get in /var/log/messages is
  SELinux: security_context_to_sid(system_u:object_r:public_content_t) failed
... errno=-22 (EINVAL).

  But if I add a ':s0' suffix to the context, it works.  So IIUC the
  problem here is that mount is directly passing the user-supplied context
  to the kernel without interacting with libselinux to translate it (via
  selinux_trans_to_raw_context).  Needs to be patched accordingly, and
  updated in FC5 as well as rawhide.

The workaround above is solving my problem, but as Stephen says, it needs fixing
 for FC5 and rawhide.

It doesn't help that the "context" and "fscontext" mount options aren't
documented in the mount manpage, but that's another ticket.
Comment 1 Karel Zak 2006-03-27 09:35:46 EST
*** Bug 179437 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.