Description of problem: I've got the Fedora 9 x86_64 DVD iso on an ntfs partition I mount with ntfs-3g in /etc/rc.local as follows touch /var/lock/subsys/local ntfs-3g /dev/sda1 /mnt/vista/ I've omitted the full path in the iso location for clarity, replacing it with "..." I tried adding mount -o,ro,loop -t iso9660 /mnt/vista/.../Fedora-9-x86_64-DVD.iso /mnt/f9 on the next line but that didn't work. So instead I added /mnt/vista/.../Fedora-9-x86_64-DVD.iso /mnt/f9 iso9660 ro,loop 0 0 to /etc/fstab I can run # mount /mnt/f9 # unmount /mnt/f9 and they both work. When I resume from hibernate, I get a setroubleshoot 2.0.8 pop-up and when I look in the log I see SELinux prevented mount from mounting on the file or directory "./Fedora 9-x86_64-DVD.iso" (type "fusefs_t") Version-Release number of selected component (if applicable): How reproducible: Every time I resume from hibernate Steps to Reproduce: 1. Install Fedora on an x86_64 machine with an ntfs partition. 2. Store the Fedora 9 x86_64 iso on the partition. 3. As root "mkdir /mnt/f9" (edit as appropriate). 3. As root "mkdir /mnt/vista" (edit as appropriate). 4. As root in /etc/rc.local add "ntfs-3g /dev/sda1 /mnt/vista/" (edit as appropriate). 5. As root in /etc/fstab add "/mnt/vista/.../Fedora-9-x86_64-DVD.iso /mnt/f9 iso9660 ro,loop 0 0" (edit as appropriate). 6. Check that you can mount and unmount the iso. 7. Hibernate Actual results: SELinux prevented mount from mounting on the file or directory "./Fedora 9-x86_64-DVD.iso" (type "fusefs_t") Expected results: No errors. Additional info:
Please attach the entire troubleshoot message or at least the avc message.
>>> setroubleshoot message begin <<< Summary: SELinux prevented mount from mounting on the file or directory "./Fedora-9-x86_64-DVD.iso" (type "fusefs_t"). Detailed Description: SELinux prevented mount from mounting a filesystem on the file or directory "./Fedora-9-x86_64-DVD.iso" of type "fusefs_t". By default SELinux limits the mounting of filesystems to only some files or directories (those with types that have the mountpoint attribute). The type "fusefs_t" does not have this attribute. You can either relabel the file or directory or set the boolean "allow_mount_anyfile" to true to allow mounting on any file or directory. Allowing Access: Changing the "allow_mount_anyfile" boolean to true will allow this access: "setsebool -P allow_mount_anyfile=1." Fix Command: setsebool -P allow_mount_anyfile=1 Additional Information: Source Context system_u:system_r:mount_t:s0-s0:c0.c1023 Target Context system_u:object_r:fusefs_t:s0 Target Objects ./Fedora-9-x86_64-DVD.iso [ file ] Source mount Source Path /bin/mount Port <Unknown> Host mypc Source RPM Packages util-linux-ng-2.13.1-8.3.fc9 Target RPM Packages Policy RPM selinux-policy-3.3.1-99.fc9 Selinux Enabled True Policy Type targeted MLS Enabled True Enforcing Mode Enforcing Plugin Name allow_mount_anyfile Host Name mypc Platform Linux mypc 2.6.26.5-45.fc9.x86_64 #1 SMP Sat Sep 20 03:23:12 EDT 2008 x86_64 x86_64 Alert Count 1 First Seen Sat 18 Oct 2008 12:10:11 AM IST Last Seen Sat 18 Oct 2008 12:10:11 AM IST Local ID f30d5302-9782-4643-8fab-bc4e8f312d26 Line Numbers Raw Audit Messages host=mypc type=AVC msg=audit(1224285011.690:96): avc: denied { read } for pid=19564 comm="mount" name="Fedora-9-x86_64-DVD.iso" dev=sda1 ino=125613 scontext=system_u:system_r:mount_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fusefs_t:s0 tclass=file host=mypc type=SYSCALL msg=audit(1224285011.690:96): arch=c000003e syscall=2 success=no exit=-13 a0=7f2945e27b30 a1=0 a2=0 a3=7fff4cbc7020 items=0 ppid=19550 pid=19564 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0-s0:c0.c1023 key=(null) >>> stroubleshoot message end <<< Also, I forgot to mention that I followed the setroubleshoot recommendation - # setsebool -P allow_mount_anyfile=1 I can verify that this is still in effect - # /usr/sbin/getsebool allow_mount_anyfile allow_mount_anyfile --> on
You can allow this for now. # audit2allow -M mypol -l -i /var/log/audit/audit.log # semodule -i mypol.pp Fixed in selinux-policy-3.3.1-103.fc9.noarch
Thanks - that worked! Do I need to reverse these steps (and if so how do I do that) once selinux-policy-3.3.1-103.fc9.noarch is available?
semodule -r mypol would remove the local policy.
This message is a reminder that Fedora 9 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 9. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '9'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 9's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 9 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping