Summary: SELinux is preventing /sbin/mount.cifs "getcap" access . Detailed Description: this happend when trying to mount cifs storage using autofs [mount.cifs has a permissive type (mount_t). This access was not denied.] SELinux denied access requested by mount.cifs. It is not expected that this access is required by mount.cifs and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:mount_t:s0 Target Context system_u:system_r:mount_t:s0 Target Objects None [ process ] Source mount.cifs Source Path /sbin/mount.cifs Port <Unknown> Host (removed) Source RPM Packages cifs-utils-4.3-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.15-4.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name (removed) Platform Linux (removed) 2.6.33.2-47.fc13.x86_64 #1 SMP Wed Apr 14 21:34:20 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Fri 16 Apr 2010 09:32:34 AM CEST Last Seen Fri 16 Apr 2010 09:32:34 AM CEST Local ID 1216107b-853d-4248-9605-829ccd1efa00 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1271403154.372:20084): avc: denied { getcap } for pid=3195 comm="mount.cifs" scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:mount_t:s0 tclass=process node=(removed) type=SYSCALL msg=audit(1271403154.372:20084): arch=c000003e syscall=125 success=yes exit=128 a0=7f7a0cd7f6f4 a1=7f7a0cd7f6fc a2=1 a3=30 items=0 ppid=3194 pid=3195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount.cifs" exe="/sbin/mount.cifs" subj=system_u:system_r:mount_t:s0 key=(null) Hash String generated from catchall,mount.cifs,mount_t,mount_t,process,getcap audit2allow suggests: #============= mount_t ============== allow mount_t self:process getcap;
also setcap denial poped up: Summary: SELinux is preventing /sbin/mount.cifs "setcap" access . Detailed Description: [mount.cifs has a permissive type (mount_t). This access was not denied.] SELinux denied access requested by mount.cifs. It is not expected that this access is required by mount.cifs and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context system_u:system_r:mount_t:s0 Target Context system_u:system_r:mount_t:s0 Target Objects None [ process ] Source mount.cifs Source Path /sbin/mount.cifs Port <Unknown> Host nbone.mihlnet Source RPM Packages cifs-utils-4.3-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.15-4.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name catchall Host Name nbone.mihlnet Platform Linux nbone.mihlnet 2.6.33.2-47.fc13.x86_64 #1 SMP Wed Apr 14 21:34:20 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Fri 16 Apr 2010 09:32:34 AM CEST Last Seen Fri 16 Apr 2010 09:32:34 AM CEST Local ID d26919f2-a9c9-44d2-8c1b-cf7f83938d3a Line Numbers Raw Audit Messages node=nbone.mihlnet type=AVC msg=audit(1271403154.374:20085): avc: denied { setcap } for pid=3195 comm="mount.cifs" scontext=system_u:system_r:mount_t:s0 tcontext=system_u:system_r:mount_t:s0 tclass=process node=nbone.mihlnet type=SYSCALL msg=audit(1271403154.374:20085): arch=c000003e syscall=126 success=yes exit=128 a0=7f7a0cd7f6f4 a1=7f7a0cd7f6fc a2=1 a3=30 items=0 ppid=3194 pid=3195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount.cifs" exe="/sbin/mount.cifs" subj=system_u:system_r:mount_t:s0 key=(null)
Fixed in selinux-policy-3.7.19-2.fc13.noarch Miroslav add this one to F12.
and still one missing. Above reports were from only unsuccessful mounting (autofs was not set correctly). During/after successful mounting I got also: Summary: SELinux is preventing /sbin/mount.cifs "setpcap" access . Detailed Description: [SELinux is in permissive mode. This access was not denied.] SELinux denied access requested by mount.cifs. It is not expected that this access is required by mount.cifs and this access may signal an intrusion attempt. It is also possible that the specific version or configuration of the application is causing it to require additional access. Allowing Access: You can generate a local policy module to allow this access - see FAQ (http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug report. Additional Information: Source Context unconfined_u:system_r:mount_t:s0 Target Context unconfined_u:system_r:mount_t:s0 Target Objects None [ capability ] Source mount.cifs Source Path /sbin/mount.cifs Port <Unknown> Host nbone.mihlnet Source RPM Packages cifs-utils-4.3-1.fc13 Target RPM Packages Policy RPM selinux-policy-3.7.15-4.fc13 Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Plugin Name catchall Host Name nbone.mihlnet Platform Linux nbone.mihlnet 2.6.33.2-47.fc13.x86_64 #1 SMP Wed Apr 14 21:34:20 UTC 2010 x86_64 x86_64 Alert Count 1 First Seen Fri 16 Apr 2010 06:26:06 PM CEST Last Seen Fri 16 Apr 2010 06:26:06 PM CEST Local ID c99a3ff6-a969-49c5-bfff-78540b45d076 Line Numbers Raw Audit Messages node=nbone.mihlnet type=AVC msg=audit(1271435166.740:20160): avc: denied { setpcap } for pid=15673 comm="mount.cifs" capability=8 scontext=unconfined_u:system_r:mount_t:s0 tcontext=unconfined_u:system_r:mount_t:s0 tclass=capability node=nbone.mihlnet type=SYSCALL msg=audit(1271435166.740:20160): arch=c000003e syscall=157 success=yes exit=0 a0=18 a1=0 a2=0 a3=0 items=0 ppid=15672 pid=15673 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="mount.cifs" exe="/sbin/mount.cifs" subj=unconfined_u:system_r:mount_t:s0 key=(null)
Fixed in selinux-policy-3.7.19-3.fc13.noarch
selinux-policy-3.7.19-2.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-2.fc13
selinux-policy-3.7.19-2.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/selinux-policy-3.7.19-2.fc13
selinux-policy-3.7.19-2.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.