Bug 467138 - SELinux prevented mount from mounting on the file or directory type fusefs_t
SELinux prevented mount from mounting on the file or directory type fusefs_t
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
x86_64 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2008-10-15 18:18 EDT by Philip Ashmore
Modified: 2009-06-10 07:11 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-06-10 07:11:11 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Philip Ashmore 2008-10-15 18:18:13 EDT
Description of problem:
I've got the Fedora 9 x86_64 DVD iso on an ntfs partition I mount with ntfs-3g in /etc/rc.local as follows

    touch /var/lock/subsys/local
    ntfs-3g /dev/sda1 /mnt/vista/

I've omitted the full path in the iso location for clarity, replacing it with "..."

I tried adding 
    mount -o,ro,loop -t iso9660 /mnt/vista/.../Fedora-9-x86_64-DVD.iso /mnt/f9

on the next line but that didn't work.

So instead I added
    /mnt/vista/.../Fedora-9-x86_64-DVD.iso /mnt/f9 iso9660 ro,loop 0 0

to /etc/fstab

I can run
    # mount /mnt/f9
    # unmount /mnt/f9

and they both work.

When I resume from hibernate, I get a setroubleshoot 2.0.8 pop-up and when I look in the log I see

    SELinux prevented mount from mounting on the file or directory "./Fedora 9-x86_64-DVD.iso" (type "fusefs_t")

Version-Release number of selected component (if applicable):

How reproducible:
Every time I resume from hibernate

Steps to Reproduce:
1. Install Fedora on an x86_64 machine with an ntfs partition.
2. Store the Fedora 9 x86_64 iso on the partition.
3. As root "mkdir /mnt/f9" (edit as appropriate).
3. As root "mkdir /mnt/vista" (edit as appropriate).
4. As root in /etc/rc.local add "ntfs-3g /dev/sda1 /mnt/vista/" (edit as appropriate).
5. As root in /etc/fstab add "/mnt/vista/.../Fedora-9-x86_64-DVD.iso /mnt/f9 iso9660 ro,loop 0 0" (edit as appropriate).
6. Check that you can mount and unmount the iso.
7. Hibernate

Actual results:
    SELinux prevented mount from mounting on the file or directory "./Fedora 9-x86_64-DVD.iso" (type "fusefs_t")

Expected results:
No errors.

Additional info:
Comment 1 Daniel Walsh 2008-10-17 15:37:33 EDT
Please attach the entire troubleshoot message or at least the avc message.
Comment 2 Philip Ashmore 2008-10-17 19:18:50 EDT
>>> setroubleshoot message begin <<<

SELinux prevented mount from mounting on the file or directory
"./Fedora-9-x86_64-DVD.iso" (type "fusefs_t").

Detailed Description:

SELinux prevented mount from mounting a filesystem on the file or directory
"./Fedora-9-x86_64-DVD.iso" of type "fusefs_t". By default SELinux limits the
mounting of filesystems to only some files or directories (those with types that
have the mountpoint attribute). The type "fusefs_t" does not have this
attribute. You can either relabel the file or directory or set the boolean
"allow_mount_anyfile" to true to allow mounting on any file or directory.

Allowing Access:

Changing the "allow_mount_anyfile" boolean to true will allow this access:
"setsebool -P allow_mount_anyfile=1."

Fix Command:

setsebool -P allow_mount_anyfile=1

Additional Information:

Source Context                system_u:system_r:mount_t:s0-s0:c0.c1023
Target Context                system_u:object_r:fusefs_t:s0
Target Objects                ./Fedora-9-x86_64-DVD.iso [ file ]
Source                        mount
Source Path                   /bin/mount
Port                          <Unknown>
Host                          mypc
Source RPM Packages           util-linux-ng-2.13.1-8.3.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-99.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   allow_mount_anyfile
Host Name                     mypc
Platform                      Linux mypc #1 SMP Sat Sep
                              20 03:23:12 EDT 2008 x86_64 x86_64
Alert Count                   1
First Seen                    Sat 18 Oct 2008 12:10:11 AM IST
Last Seen                     Sat 18 Oct 2008 12:10:11 AM IST
Local ID                      f30d5302-9782-4643-8fab-bc4e8f312d26
Line Numbers                  

Raw Audit Messages            

host=mypc type=AVC msg=audit(1224285011.690:96): avc:  denied  { read } for  pid=19564 comm="mount" name="Fedora-9-x86_64-DVD.iso" dev=sda1 ino=125613 scontext=system_u:system_r:mount_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fusefs_t:s0 tclass=file

host=mypc type=SYSCALL msg=audit(1224285011.690:96): arch=c000003e syscall=2 success=no exit=-13 a0=7f2945e27b30 a1=0 a2=0 a3=7fff4cbc7020 items=0 ppid=19550 pid=19564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0-s0:c0.c1023 key=(null)

>>> stroubleshoot message end <<<
Also, I forgot to mention that I followed the setroubleshoot recommendation -
    # setsebool -P allow_mount_anyfile=1

I can verify that this is still in effect -
    # /usr/sbin/getsebool allow_mount_anyfile
    allow_mount_anyfile --> on
Comment 3 Daniel Walsh 2008-10-20 11:22:16 EDT
You can allow this for now.

# audit2allow -M mypol -l -i /var/log/audit/audit.log
# semodule -i mypol.pp

Fixed in selinux-policy-3.3.1-103.fc9.noarch
Comment 4 Philip Ashmore 2008-10-20 16:21:08 EDT
Thanks - that worked!

Do I need to reverse these steps (and if so how do I do that) once selinux-policy-3.3.1-103.fc9.noarch is available?
Comment 5 Daniel Walsh 2008-10-21 09:25:03 EDT
semodule -r mypol

would remove the local policy.
Comment 6 Bug Zapper 2009-06-09 22:58:29 EDT
This message is a reminder that Fedora 9 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 9.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '9'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 9's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 9 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 

Note You need to log in before you can comment on or make changes to this bug.