Bug 608403 - SELinux is preventing /bin/mount "getattr" access to device /dev/sdc.
Summary: SELinux is preventing /bin/mount "getattr" access to device /dev/sdc.
Keywords:
Status: CLOSED DUPLICATE of bug 605771
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 13
Hardware: x86_64
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:16118762bc5...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-06-27 10:30 UTC by Tobias Mueller
Modified: 2010-06-28 11:06 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2010-06-28 11:06:32 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Tobias Mueller 2010-06-27 10:30:54 UTC
Summary:

SELinux is preventing /bin/mount "getattr" access to device /dev/sdc.

Detailed Description:

[SELinux is in permissive mode. This access was not denied.]

SELinux has denied mount "getattr" access to device /dev/sdc. /dev/sdc is
mislabeled, this device has the default label of the /dev directory, which
should not happen. All Character and/or Block Devices should have a label. You
can attempt to change the label of the file using restorecon -v '/dev/sdc'. If
this device remains labeled device_t, then this is a bug in SELinux policy.
Please file a bg report. If you look at the other similar devices labels, ls -lZ
/dev/SIMILAR, and find a type that would work for /dev/sdc, you can use chcon -t
SIMILAR_TYPE '/dev/sdc', If this fixes the problem, you can make this permanent
by executing semanage fcontext -a -t SIMILAR_TYPE '/dev/sdc' If the restorecon
changes the context, this indicates that the application that created the
device, created it without using SELinux APIs. If you can figure out which
application created the device, please file a bug report against this
application.

Allowing Access:

Attempt restorecon -v '/dev/sdc' or chcon -t SIMILAR_TYPE '/dev/sdc'

Additional Information:

Source Context                system_u:system_r:mount_t:s0
Target Context                system_u:object_r:device_t:s0
Target Objects                /dev/sdc [ blk_file ]
Source                        mount
Source Path                   /bin/mount
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           util-linux-ng-2.17.2-5.fc13
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-28.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Plugin Name                   device
Host Name                     (removed)
Platform                      Linux (removed) 2.6.33.5-124.fc13.x86_64 #1 SMP Fri
                              Jun 11 09:38:12 UTC 2010 x86_64 x86_64
Alert Count                   34
First Seen                    Do 17 Jun 2010 20:52:06 CEST
Last Seen                     So 27 Jun 2010 11:35:24 CEST
Local ID                      a023f1c6-74ca-4680-b292-b563b6a40d31
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1277631324.704:28245): avc:  denied  { getattr } for  pid=14677 comm="mount" path="/dev/sdc" dev=devtmpfs ino=6182187 scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=blk_file

node=(removed) type=SYSCALL msg=audit(1277631324.704:28245): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7fff79661c40 a2=7fff79661c40 a3=1 items=0 ppid=14665 pid=14677 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:mount_t:s0 key=(null)




I was resuming my suspended machine with my external harddrive attache via FireWire.
See also bug 605771.
Hash String generated from  device,mount,mount_t,device_t,blk_file,getattr
audit2allow suggests:

#============= mount_t ==============
allow mount_t device_t:blk_file getattr;

Comment 1 Miroslav Grepl 2010-06-28 11:06:32 UTC

*** This bug has been marked as a duplicate of bug 605771 ***


Note You need to log in before you can comment on or make changes to this bug.