Summary: SELinux prevented mount from mounting on the file or directory "/mnt/xtra/Fedora-12-i386-DVD/Fedora-12-i386-DVD.iso". Detailed Description: SELinux prevented mount from mounting a filesystem on the file or directory "/mnt/xtra/Fedora-12-i386-DVD/Fedora-12-i386-DVD.iso" of type "mnt_t". By default SELinux limits the mounting of filesystems to only some files or directories (those with types that have the mountpoint attribute). The type "mnt_t" does not have this attribute. You can either relabel the file or directory or set the boolean "allow_mount_anyfile" to true to allow mounting on any file or directory. Allowing Access: Changing the "allow_mount_anyfile" boolean to true will allow this access: "setsebool -P allow_mount_anyfile=1." Fix Command: setsebool -P allow_mount_anyfile=1 Additional Information: Source Context system_u:system_r:mount_t:s0 Target Context unconfined_u:object_r:mnt_t:s0 Target Objects /mnt/xtra/Fedora-12-i386-DVD/Fedora-12-i386-DVD.is o [ file ] Source mount Source Path /bin/mount Port <Unknown> Host (removed) Source RPM Packages util-linux-ng-2.16-10.3.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-49.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name allow_mount_anyfile Host Name (removed) Platform Linux (removed) 2.6.31.6-145.fc12.i686.PAE #1 SMP Sat Nov 21 16:12:37 EST 2009 i686 i686 Alert Count 13 First Seen Mon 30 Nov 2009 07:31:49 PM IST Last Seen Fri 04 Dec 2009 05:09:54 PM IST Local ID d3d3b5d7-6a7d-4bdc-8049-8d438c386f5a Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1259926794.277:31): avc: denied { write } for pid=4156 comm="mount" name="Fedora-12-i386-DVD.iso" dev=sda1 ino=655363 scontext=system_u:system_r:mount_t:s0 tcontext=unconfined_u:object_r:mnt_t:s0 tclass=file node=(removed) type=SYSCALL msg=audit(1259926794.277:31): arch=40000003 syscall=5 success=no exit=-13 a0=1f17970 a1=8002 a2=0 a3=0 items=0 ppid=4144 pid=4156 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0 key=(null) Hash String generated from selinux-policy-3.6.32-49.fc12,allow_mount_anyfile,mount,mount_t,mnt_t,file,write audit2allow suggests: #============= mount_t ============== allow mount_t mnt_t:file write;
My fstab entry: --------------- /dev/sda1 /mnt/xtra auto defaults 0 0 /mnt/xtra/Fedora-12-i386-DVD//Fedora-12-i386-DVD.iso /home/F12ISO iso9660 loop,defaults 0 0 setsebool -P allow_mount_anyfile=1 was executed as suggested but did not stop these audit messages. Thanks
Are you redirecting output to something in /mnt? When does this happen?
Sorry, I didn't get it. ISO lies in one dir. I mount that dir first then I Sorry for the delay. mount the ISO on another dir. Please re-frame the question if my explanation is not enough. This happens at boot time itself when init is parsing the fstab itself. I get failed message. plymouth isn't showing the log. I will post it asap. below is the mount output Thanks [root@localhost ~]# mount /dev/sdb6 on / type ext4 (rw) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) devpts on /dev/pts type devpts (rw,gid=5,mode=620) tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_u:object_r:tmpfs_t:s0") /dev/sdb2 on /boot type ext4 (rw) /dev/sda2 on /home type ext3 (rw) /dev/sda1 on /mnt/xtra type ext3 (rw) /dev/sdb1 on /mnt/win7 type fuseblk (rw,allow_other,blksize=4096) /dev/sda3 on /mnt/drvd type fuseblk (rw,allow_other,blksize=4096) /dev/loop0 on /home/F12ISO type iso9660 (ro) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw) gvfs-fuse-daemon on /home/vikram/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=vikram)
Ok I have figured this out. The mount command is checking to see if the file system is read only. static int is_readonly(const char *node) { int res = 0; if (getuid() == geteuid()) { if (access(node, W_OK) == -1 && errno == EROFS) res = 1; } Since the access check generates the same access as if it was writing, I have to give mount the ability to write to any label. Miroslav, You need to add files_rw_all_inherited_files(mount_t) to tunable_policy(`allow_mount_anyfile',` In mount.te
Fixed in selinux-policy-3.6.32-69.fc12
selinux-policy-3.6.32-69.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-0362
selinux-policy-3.6.32-69.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.