Red Hat Bugzilla – Bug 186915
mount does not translate SELIinux context options though libselinux
Last modified: 2007-11-30 17:11:28 EST
Description of problem:
The "context" and "fscontext" mount options no longer *seem* to be
supported by mount in FC5:
# mount -r -o
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
missing codepage or other error
In some cases useful info is found in syslog - try
dmesg | tail or so
The same command fails in the same way with "fscontext" changed to
"context", but works if neither of those options is present. This leaves
me with the mounted DVD image having a context of iso9660_t, which is
reasonable but not what I want for serving out a local yum repository.
Version-Release number of selected component (if applicable):
After bringing this up on fedora-selinux-list,
the problem was explained by Stephen Smalley:
Error message that I get in /var/log/messages is
SELinux: security_context_to_sid(system_u:object_r:public_content_t) failed
... errno=-22 (EINVAL).
But if I add a ':s0' suffix to the context, it works. So IIUC the
problem here is that mount is directly passing the user-supplied context
to the kernel without interacting with libselinux to translate it (via
selinux_trans_to_raw_context). Needs to be patched accordingly, and
updated in FC5 as well as rawhide.
The workaround above is solving my problem, but as Stephen says, it needs fixing
for FC5 and rawhide.
It doesn't help that the "context" and "fscontext" mount options aren't
documented in the mount manpage, but that's another ticket.
*** Bug 179437 has been marked as a duplicate of this bug. ***