Bug 409631 - Constant selinux alerts from encfs
Summary: Constant selinux alerts from encfs
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 8
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2007-12-03 23:43 UTC by Brian G. Anderson
Modified: 2008-07-14 12:03 UTC (History)
2 users (show)

Clone Of:
Last Closed: 2008-07-14 12:03:31 UTC

Attachments (Terms of Use)

Description Brian G. Anderson 2007-12-03 23:43:16 UTC
Description of problem:
I get a regular stream of selinux warnings from my mounted encfs system.  See below.

    SELinux is preventing encfs (xdm_t) "getattr" to /boot (boot_t).

Detailed Description
    SELinux denied access requested by encfs. It is not expected that this
    access is required by encfs and this access may signal an intrusion attempt.
    It is also possible that the specific version or configuration of the
    application is causing it to require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for /boot, restorecon -v /boot If
    this does not work, there is currently no automatic way to allow this
    access. Instead,  you can generate a local policy module to allow this
    access - see http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you
    can disable SELinux protection altogether. Disabling SELinux protection is
    not recommended. Please file a
    http://bugzilla.redhat.com/bugzilla/enter_bug.cgi against this package.

Additional Information        

Source Context                system_u:system_r:xdm_t:SystemLow-SystemHigh
Target Context                system_u:object_r:boot_t
Target Objects                /boot [ dir ]
Affected RPM Packages         filesystem-2.4.11-1.fc8 [target]
Policy RPM                    selinux-policy-3.0.8-62.fc8
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   plugins.catchall_file
Host Name                     kelly
Platform                      Linux kelly #1 SMP Wed Nov 21
                              18:51:08 EST 2007 i686 i686
Alert Count                   12
First Seen                    Mon 03 Dec 2007 06:36:06 AM PST
Last Seen                     Mon 03 Dec 2007 03:38:15 PM PST
Local ID                      6d414b14-91b6-43c2-ae9a-f6d8f27069aa
Line Numbers                  

Raw Audit Messages            

avc: denied { getattr } for comm=encfs dev=sda1 path=/boot pid=3215
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=dir

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Create a encfs filesystem and mount it in home directory.
Actual results:
constant selinux warnings

Expected results:
no warnings

Additional info:

Comment 1 Peter Lemenkov 2008-01-23 09:41:29 UTC
Looks like this bug doesn't concerned with encfs but rather with selinux policies.

You should adjust your selinux policies. Take a look at the following articles
(just for starting point):


Comment 2 Peter Lemenkov 2008-07-12 07:27:01 UTC
Reassigning to selinux-team

Comment 3 Daniel Walsh 2008-07-14 12:03:31 UTC
Please update to the latest selinux-policy.

Note You need to log in before you can comment on or make changes to this bug.