This is probably the worst bug you will get today because it contains almost no useful information. Despite un-hiding dontaudit messages, I have no avcs to show you. mrepo --remount fails when selinux is running in enforcing mode and works when in permissive mode. This is because mrepo is labelled as a type for apache and apache isn't allowed to do touch loop devices or mount things. The audit log and message log have no entries at all. This is worrying :) dmesg shows security_context_to_sid(system_u:object_r:httpd_sys_content_t) failed for (dev loop0, type iso9660) errno=-22 Any chance of a boolean for this or a new type?
This looks wrong system_u:object_r:httpd_sys_content_t Should be system_u:object_r:httpd_sys_content_t:s0
# getenforce Enforcing # dmesg -c # mrepo --remount /usr/bin/mrepo:18: DeprecationWarning: The popen2 module is deprecated. Use the subprocess module. import os, sys, glob, re, shutil, getopt, popen2 /usr/bin/mrepo:19: DeprecationWarning: the sha module is deprecated; use the hashlib module instead import ConfigParser, urlparse, sha, types, traceback mount: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error In some cases useful info is found in syslog - try dmesg | tail or so # dmesg -c ISO 9660 Extensions: Microsoft Joliet Level 3 ISO 9660 Extensions: RRIP_1991A SELinux: security_context_to_sid(system_u:object_r:httpd_sys_content_t) failed for (dev loop0, type iso9660) errno=-22 # mount|grep loop # setenforce 0 # mrepo --remount /usr/bin/mrepo:18: DeprecationWarning: The popen2 module is deprecated. Use the subprocess module. import os, sys, glob, re, shutil, getopt, popen2 /usr/bin/mrepo:19: DeprecationWarning: the sha module is deprecated; use the hashlib module instead import ConfigParser, urlparse, sha, types, traceback # dmesg -c ISO 9660 Extensions: Microsoft Joliet Level 3 ISO 9660 Extensions: RRIP_1991A SELinux: initialized (dev loop0, type iso9660), uses genfs_contexts # mount|grep loop /dev/loop0 on /var/www/mrepo/RHEL5.4-i386/disc1 type iso9660 (ro)
-rwxr-xr-x. root root system_u:object_r:bin_t:s0 /usr/bin/mrepo
Created attachment 412439 [details] patch to fix selinux code in mrepo You need to specify a :s0 on the end of the mount command. We have selinux python bindings also.
Need Real Name Can you try this patch to see if it fixes your problem.
Works perfectly - thanks. There is another avc bug, but in the init script. I will file a separate bug.
mrepo-0.8.6-6.el5 has been submitted as an update for Fedora EPEL 5. http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.el5
mrepo-0.8.6-6.fc13 has been submitted as an update for Fedora 13. http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc13
mrepo-0.8.6-6.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc12
Thanks for the patch.
mrepo-0.8.6-6.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update mrepo'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc12
mrepo-0.8.6-6.el5 has been pushed to the Fedora EPEL 5 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update mrepo'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.el5
mrepo-0.8.6-6.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update mrepo'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc13
mrepo-0.8.6-6.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
mrepo-0.8.6-6.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report.
mrepo-0.8.6-6.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.