Bug 494415 - SELinux is preventing mount.nfs4 (gssd_t) "signal" mount_t
SELinux is preventing mount.nfs4 (gssd_t) "signal" mount_t
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
rawhide
All Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-04-06 15:16 EDT by CJ van den Berg
Modified: 2009-04-07 11:00 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-04-07 11:00:14 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description CJ van den Berg 2009-04-06 15:16:26 EDT
Description of problem:
Mounting an NFS4 share with autofs triggers this AVC:

avc: denied { signal } for pid=8274 comm="mount.nfs4" scontext=system_u:system_r:gssd_t:s0 tcontext=system_u:system_r:mount_t:s0 tclass=process

Version-Release number of selected component (if applicable):
selinux-policy-3.6.10

How reproducible:
Mount an NFS4 share via autofs
  
Additional info:
If rpc.gssd is run by hand, as opposed to using 'service rpc.gssd start' then the mount operation succeeds.
Comment 1 Daniel Walsh 2009-04-06 15:28:35 EDT
You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Fixed in selinux-policy-3.6.11-1.fc11.noarch
Comment 2 CJ van den Berg 2009-04-06 16:17:01 EDT
That fixed the gssd_t avc, but now I am left with various rpcd_t avcs:

type=AVC msg=audit(1239046342.527:332): avc:  denied  { signal } for  pid=15065 comm="umount.nfs4" scontext=system_u:system_r:rpcd_t:s0 tcontext=unconfined_u:system_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=process

type=AVC msg=audit(1239046342.564:333): avc:  denied  { signal } for  pid=2279 comm="rpciod/1" scontext=system_u:system_r:rpcd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process

type=AVC msg=audit(1239046413.283:334): avc:  denied  { signal } for  pid=15124 comm="mount.nfs4" scontext=system_u:system_r:rpcd_t:s0 tcontext=unconfined_u:system_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=process

type=AVC msg=audit(1239046413.275:335): avc:  denied  { signal } for  pid=7936 comm="nautilus" scontext=system_u:system_r:rpcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process

type=AVC msg=audit(1239046835.121:25): avc:  denied  { signal } for  pid=3778 comm="bash" scontext=system_u:system_r:rpcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_execmem_t:s0-s0:c0.c1023 tclass=process
Comment 3 Daniel Walsh 2009-04-07 08:35:15 EDT
What process is running as unconfined_execmem_t?

ps -eZ | grep unconfined_execmem_t
Comment 4 CJ van den Berg 2009-04-07 09:57:43 EDT
My terminal is running as unconfined_exemem_t (and therefore also bash). That, I guess, is because compiz is running as unconfined_execmem and I start my terminals with a WM hotkey. compiz is running as unconfined_execmem_t due to AVCs raised by nvidia’s GL lib.
Comment 5 Daniel Walsh 2009-04-07 11:00:14 EDT
You can add these rules for now using

# grep avc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Fixed in selinux-policy-3.6.11-2.fc11.noarch

Note You need to log in before you can comment on or make changes to this bug.