Bug 444518 - SELinux is preventing rpc.mountd (nfsd_t) "getattr" to /dev/oprofile (oprofilefs_t).
SELinux is preventing rpc.mountd (nfsd_t) "getattr" to /dev/oprofile (oprofil...
Product: Fedora
Classification: Fedora
Component: nfs-utils (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Steve Dickson
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2008-04-28 16:08 EDT by Dave Jones
Modified: 2015-01-04 17:30 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-05-07 10:33:37 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Dave Jones 2008-04-28 16:08:02 EDT
I keep getting the following selinux alerts..

host=gelk type=AVC msg=audit(1209370387.669:1944098): avc: denied { getattr }
for pid=5549 comm="rpc.mountd" path="/dev/oprofile" dev=oprofilefs ino=25090
tcontext=system_u:object_r:oprofilefs_t:s0 tclass=dir host=gelk type=SYSCALL
msg=audit(1209370387.669:1944098): arch=c000003e syscall=4 success=no exit=-13
a0=7fff4549dbc0 a1=7fff4549db30 a2=7fff4549db30 a3=0 items=0 ppid=1 pid=5549
auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=197568 comm="rpc.mountd" exe="/usr/sbin/rpc.mountd"
subj=unconfined_u:system_r:nfsd_t:s0 key=(null) 

I have no idea what's causing them.  They seem to happen at various times of the
day, sometimes even whilst I'm asleep.

Why nfsd is touching /dev/oprofile at all I've no idea.
This reminds me of a similar bug I had a while back that 'went away' where the
same thing was happening but that was /dev/admmidi instead.
Comment 1 Steve Dickson 2008-05-07 10:00:46 EDT
This probably has to do with the fact thatrpc.mountd is 
searching for the uuid of some export. It used the routines
in libblkid. 

The reason the other bug 'went away' is I removed a blkid
call (blkid_probe_all_new()) that *always* touch every 
/dev entry, which was obviously not needed... 

So I wonder if something in the liblkid lib has changed...

Dan, is there some policy that problems using this interface should be 
using or set? 
Comment 2 Daniel Walsh 2008-05-07 10:33:37 EDT
Well this is fixed  in selinux-policy-3.3.1-45.fc9.noarch

Note You need to log in before you can comment on or make changes to this bug.