Bug 409631 - Constant selinux alerts from encfs
Constant selinux alerts from encfs
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
8
i386 Linux
low Severity low
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-12-03 18:43 EST by Brian G. Anderson
Modified: 2008-07-14 08:03 EDT (History)
2 users (show)

See Also:
Fixed In Version: Current
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-07-14 08:03:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Brian G. Anderson 2007-12-03 18:43:16 EST
Description of problem:
I get a regular stream of selinux warnings from my mounted encfs system.  See below.

Summary
    SELinux is preventing encfs (xdm_t) "getattr" to /boot (boot_t).

Detailed Description
    SELinux denied access requested by encfs. It is not expected that this
    access is required by encfs and this access may signal an intrusion attempt.
    It is also possible that the specific version or configuration of the
    application is causing it to require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for /boot, restorecon -v /boot If
    this does not work, there is currently no automatic way to allow this
    access. Instead,  you can generate a local policy module to allow this
    access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
    can disable SELinux protection altogether. Disabling SELinux protection is
    not recommended. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Additional Information        

Source Context                system_u:system_r:xdm_t:SystemLow-SystemHigh
Target Context                system_u:object_r:boot_t
Target Objects                /boot [ dir ]
Affected RPM Packages         filesystem-2.4.11-1.fc8 [target]
Policy RPM                    selinux-policy-3.0.8-62.fc8
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   plugins.catchall_file
Host Name                     kelly
Platform                      Linux kelly 2.6.23.8-63.fc8 #1 SMP Wed Nov 21
                              18:51:08 EST 2007 i686 i686
Alert Count                   12
First Seen                    Mon 03 Dec 2007 06:36:06 AM PST
Last Seen                     Mon 03 Dec 2007 03:38:15 PM PST
Local ID                      6d414b14-91b6-43c2-ae9a-f6d8f27069aa
Line Numbers                  

Raw Audit Messages            

avc: denied { getattr } for comm=encfs dev=sda1 path=/boot pid=3215
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dir
tcontext=system_u:object_r:boot_t:s0



Version-Release number of selected component (if applicable):
fuse-encfs-1.3.2-1.fc7
selinux-policy-targeted-3.0.8-62.fc8
selinux-policy-3.0.8-62.fc8

How reproducible:
always

Steps to Reproduce:
1. Create a encfs filesystem and mount it in home directory.
2.
3.
  
Actual results:
constant selinux warnings

Expected results:
no warnings

Additional info:
Comment 1 Peter Lemenkov 2008-01-23 04:41:29 EST
Looks like this bug doesn't concerned with encfs but rather with selinux policies.

You should adjust your selinux policies. Take a look at the following articles
(just for starting point):

http://docs.fedoraproject.org/selinux-apache-fc3/sn-debugging-and-customizing.html
http://www.linuxdevcenter.com/pub/a/linux/excerpt/selnx_1/index.html
Comment 2 Peter Lemenkov 2008-07-12 03:27:01 EDT
Reassigning to selinux-team
Comment 3 Daniel Walsh 2008-07-14 08:03:31 EDT
Please update to the latest selinux-policy.

Note You need to log in before you can comment on or make changes to this bug.