Bug 472288 - SELinux is preventing autofs from reading global.map file on an NFS share
SELinux is preventing autofs from reading global.map file on an NFS share
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
x86_64 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2008-11-19 15:51 EST by Geoff G
Modified: 2009-06-10 07:06 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-06-10 07:06:29 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Geoff G 2008-11-19 15:51:40 EST
Description of problem:
SELinux is preventing autofs from reading the global.map file on an NFS share even when use_nfs_home_dirs=1 . 

Nov 18 12:59:06 XXXX automount[4867]: Starting automounter version 5.0.3-15, master map auto.master
Nov 18 12:59:06 XXXX automount[4867]: using kernel protocol version 5.00
Nov 18 12:59:06 XXXX automount[4867]: lookup(file): file map /xxx/dist/xxx/automaps/incr/common/etc/x.xxx.xxx.xxxx.xxx.com/global.map missing or not readable
Nov 18 12:59:06 XXXX automount[4867]: mount_autofs_indirect: failed to read map for /.efsglobal
Nov 18 12:59:06 XXXX automount[4867]: handle_mounts: mount of /.efsglobal failed!
Nov 18 12:59:06 XXXX automount[4867]: master_do_mount: failed to startup mount
Nov 18 12:59:06 XXXX automount[4867]: no mounts in table
Nov 18 12:59:06 XXXX setroubleshoot: SELinux prevented automount from reading files stored on a NFS filesytem. For complete SELinux messages. run sealert -l 67a06831-1f71-407c-acf5-505bdffc125c

[root@XXXX init.d]# sealert -l 67a06831-1f71-407c-acf5-505bdffc125c


SELinux prevented automount from reading files stored on a NFS filesytem.

Detailed Description:

[SELinux is in permissive mode, the operation would have been denied but was
permitted due to permissive mode.]

SELinux prevented automount from reading files stored on a NFS filesystem. NFS
(Network Filesystem) is a network filesystem commonly used on Unix / Linux
systems. automount attempted to read one or more files or directories from a
mounted filesystem of this type. As NFS filesystems do not support fine-grained
SELinux labeling, all files and directories in the filesystem will have the same
security context. If you have not configured automount to read files from a NFS
filesystem this access attempt could signal an intrusion attempt.

Allowing Access:

Changing the "use_nfs_home_dirs" boolean to true will allow this access:
"setsebool -P use_nfs_home_dirs=1"

Fix Command:

setsebool -P use_nfs_home_dirs=1

Additional Information:

Source Context                unconfined_u:system_r:automount_t:s0
Target Context                system_u:object_r:nfs_t:s0
Target Objects                ./global.map [ file ]
Source                        automount
Source Path                   /usr/sbin/automount
Port                          <Unknown>
Host                          XXXX.xxx.xxx.xx.xx.com
Source RPM Packages           autofs-5.0.3-15
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-107.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Permissive
Plugin Name                   use_nfs_home_dirs
Host Name                     XXX.xxx.xxx.xx.xx.com
Platform                      Linux XXXX.xxx.xxx.xx.xx.com
                     #1 SMP Wed Nov 12 18:31:37
                              EST 2008 x86_64 x86_64
Alert Count                   10
First Seen                    Fri Nov 14 14:39:14 2008
Last Seen                     Tue Nov 18 13:36:18 2008
Local ID                      67a06831-1f71-407c-acf5-505bdffc125c
Line Numbers                  

Raw Audit Messages            

host=XXXX.xxx.xxx.xx.xx.com type=AVC msg=audit(1227033378.300:183): avc:  denied  { read } for  pid=5096 comm="automount" name="global.map" dev=0:17 ino=2185111 scontext=unconfined_u:system_r:automount_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=file

host=XXXX.xxx.xxx.xx.xx.com type=SYSCALL msg=audit(1227033378.300:183): arch=c000003e syscall=21 success=yes exit=0 a0=7f1b47ca60f0 a1=4 a2=7f1b47ca07b0 a3=ccaa70 items=0 ppid=5090 pid=5096 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="automount" exe="/usr/sbin/automount" subj=unconfined_u:system_r:automount_t:s0 key=(null)

[root@XXXX init.d]# getsebool -a | grep nfs
allow_ftpd_use_nfs --> off
allow_nfsd_anon_write --> off
httpd_use_nfs --> off
nfs_export_all_ro --> on
nfs_export_all_rw --> on
qemu_use_nfs --> on
samba_share_nfs --> off
use_nfs_home_dirs --> on
virt_use_nfs --> off
xen_use_nfs --> off

Version-Release number of selected component (if applicable):
uname -a
Linux XXXX.xxx.xxx.xx.xx.com #1 SMP Wed Nov 12 18:31:37 EST 2008 x86_64 x86_64 x86_64 GNU/Linux

How reproducible:
Every time! 

Steps to Reproduce:
1. setsebool -P use_nfs_home_dirs=1
2. Setup autofs to use a global.map file from an NFS share. 
3. Start autofs

Actual results:
autofs is blocked from reading file. 

Expected results:
autofs will read file.
Comment 2 Daniel Walsh 2008-11-20 11:09:46 EST
You can allow this for now.

# audit2allow -M mypol -l -i /var/log/audit/audit.log
# semodule -i mypol.pp

Fixed in selinux-policy-3.3.1-112.fc9.noarch
Comment 3 Bug Zapper 2009-06-09 23:18:36 EDT
This message is a reminder that Fedora 9 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 9.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '9'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 9's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 9 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 

Note You need to log in before you can comment on or make changes to this bug.