Bug 186915 - mount does not translate SELIinux context options though libselinux
Summary: mount does not translate SELIinux context options though libselinux
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: util-linux
Version: 5
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Karel Zak
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2006-03-27 14:05 UTC by Paul Howarth
Modified: 2007-11-30 22:11 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2006-03-30 20:04:29 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Paul Howarth 2006-03-27 14:05:08 UTC
Description of problem:
The "context" and "fscontext" mount options no longer *seem* to be
supported by mount in FC5:

# mount -r -o
loop,fscontext=system_u:object_r:public_content_t
/srv/softlib/fedora/bordeaux/FC-5-i386-DVD.iso /srv/softlib/fedora/bordeaux/dvd
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

The same command fails in the same way with "fscontext" changed to
"context", but works if neither of those options is present. This leaves
me with the mounted DVD image having a context of iso9660_t, which is
reasonable but not what I want for serving out a local yum repository. 

Version-Release number of selected component (if applicable):
util-linux-2.13-0.20

Additional info:
After bringing this up on fedora-selinux-list,
(http://www.redhat.com/archives/fedora-selinux-list/2006-March/msg00110.html),
the problem was explained by Stephen Smalley:

  Error message that I get in /var/log/messages is
  SELinux: security_context_to_sid(system_u:object_r:public_content_t) failed
... errno=-22 (EINVAL).

  But if I add a ':s0' suffix to the context, it works.  So IIUC the
  problem here is that mount is directly passing the user-supplied context
  to the kernel without interacting with libselinux to translate it (via
  selinux_trans_to_raw_context).  Needs to be patched accordingly, and
  updated in FC5 as well as rawhide.

The workaround above is solving my problem, but as Stephen says, it needs fixing
 for FC5 and rawhide.

It doesn't help that the "context" and "fscontext" mount options aren't
documented in the mount manpage, but that's another ticket.

Comment 1 Karel Zak 2006-03-27 14:35:46 UTC
*** Bug 179437 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.