Bug 589755 - selinux policy prevents mrepo mounting isos
selinux policy prevents mrepo mounting isos
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: mrepo (Show other bugs)
12
All Linux
low Severity medium
: ---
: ---
Assigned To: Susi Lehtola
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-05-06 16:03 EDT by Need Real Name
Modified: 2011-04-12 06:32 EDT (History)
5 users (show)

See Also:
Fixed In Version: mrepo-0.8.6-6.el5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-05-31 14:16:56 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
patch to fix selinux code in mrepo (825 bytes, text/plain)
2010-05-07 16:46 EDT, Daniel Walsh
no flags Details

  None (edit)
Description Need Real Name 2010-05-06 16:03:24 EDT
This is probably the worst bug you will get today because it contains almost no useful information.

Despite un-hiding dontaudit messages, I have no avcs to show you.

mrepo --remount fails when selinux is running in enforcing mode and works when in permissive mode.

This is because mrepo is labelled as a type for apache and apache isn't allowed to do touch loop devices or mount things.

The audit log and message log have no entries at all. This is worrying :)

dmesg shows
 security_context_to_sid(system_u:object_r:httpd_sys_content_t) failed for (dev loop0, type iso9660) errno=-22

Any chance of a boolean for this or a new type?
Comment 1 Daniel Walsh 2010-05-06 16:36:47 EDT
This looks wrong

system_u:object_r:httpd_sys_content_t

Should be

system_u:object_r:httpd_sys_content_t:s0
Comment 2 Need Real Name 2010-05-06 17:37:49 EDT
# getenforce 
Enforcing
# dmesg -c
# mrepo --remount
/usr/bin/mrepo:18: DeprecationWarning: The popen2 module is deprecated.  Use the subprocess module.
  import os, sys, glob, re, shutil, getopt, popen2
/usr/bin/mrepo:19: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
  import ConfigParser, urlparse, sha, types, traceback
mount: wrong fs type, bad option, bad superblock on /dev/loop0,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so
# dmesg -c
ISO 9660 Extensions: Microsoft Joliet Level 3
ISO 9660 Extensions: RRIP_1991A
SELinux: security_context_to_sid(system_u:object_r:httpd_sys_content_t) failed for (dev loop0, type iso9660) errno=-22
# mount|grep loop

# setenforce 0
# mrepo --remount
/usr/bin/mrepo:18: DeprecationWarning: The popen2 module is deprecated.  Use the subprocess module.
  import os, sys, glob, re, shutil, getopt, popen2
/usr/bin/mrepo:19: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
  import ConfigParser, urlparse, sha, types, traceback
# dmesg -c
ISO 9660 Extensions: Microsoft Joliet Level 3
ISO 9660 Extensions: RRIP_1991A
SELinux: initialized (dev loop0, type iso9660), uses genfs_contexts
# mount|grep loop
/dev/loop0 on /var/www/mrepo/RHEL5.4-i386/disc1 type iso9660 (ro)
Comment 3 Need Real Name 2010-05-06 17:39:08 EDT
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/bin/mrepo
Comment 4 Daniel Walsh 2010-05-07 16:46:18 EDT
Created attachment 412439 [details]
patch to fix selinux code in mrepo

You need to specify a :s0 on the end of the mount command.  We have selinux python bindings also.
Comment 5 Daniel Walsh 2010-05-07 16:46:52 EDT
Need Real Name

Can you try this patch to see if it fixes your problem.
Comment 6 Need Real Name 2010-05-08 04:55:40 EDT
Works perfectly - thanks.

There is another avc bug, but in the init script. I will file a separate bug.
Comment 7 Fedora Update System 2010-05-11 02:07:46 EDT
mrepo-0.8.6-6.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.el5
Comment 8 Fedora Update System 2010-05-11 02:07:51 EDT
mrepo-0.8.6-6.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc13
Comment 9 Fedora Update System 2010-05-11 02:07:55 EDT
mrepo-0.8.6-6.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc12
Comment 10 Susi Lehtola 2010-05-11 02:11:25 EDT
Thanks for the patch.
Comment 11 Fedora Update System 2010-05-11 15:44:35 EDT
mrepo-0.8.6-6.fc12 has been pushed to the Fedora 12 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mrepo'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc12
Comment 12 Fedora Update System 2010-05-11 21:52:49 EDT
mrepo-0.8.6-6.el5 has been pushed to the Fedora EPEL 5 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mrepo'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.el5
Comment 13 Fedora Update System 2010-05-12 08:18:26 EDT
mrepo-0.8.6-6.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update mrepo'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/mrepo-0.8.6-6.fc13
Comment 14 Fedora Update System 2010-05-31 14:16:50 EDT
mrepo-0.8.6-6.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 Fedora Update System 2010-05-31 14:20:40 EDT
mrepo-0.8.6-6.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 16 Fedora Update System 2010-06-03 11:01:29 EDT
mrepo-0.8.6-6.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.