Bug 800458 - let dovecot use fusefs_t files if use_fusefs_home_dirs is on
let dovecot use fusefs_t files if use_fusefs_home_dirs is on
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2012-03-06 09:06 EST by Michael J. Chudobiak
Modified: 2012-03-23 20:36 EDT (History)
1 user (show)

See Also:
Fixed In Version: selinux-policy-3.10.0-80.fc16
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-03-23 20:36:37 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Michael J. Chudobiak 2012-03-06 09:06:32 EST
My home folders are mounted using fuse (from a moosefs server).

dovecot can not access these home folders, even though 
use_fusefs_home_dirs --> on

It would be nice if dovecot could have full access to fuse-mounted home folders when use_fusefs_home_dirs --> on.

audit2allow output is below. It may not be complete, since I may not have exercised all dovecot functions.

- Mike

#============= dovecot_t ==============
#!!!! The source type 'dovecot_t' can write to a 'dir' of the following types:
# dovecot_tmp_t, user_home_t, data_home_t, var_run_t, var_log_t, dovecot_spool_t, dovecot_var_log_t, postfix_private_t, dovecot_var_lib_t, dovecot_var_run_t, user_home_dir_t, mail_spool_t, tmp_t, root_t

allow dovecot_t fusefs_t:dir { read write add_name remove_name };
#!!!! The source type 'dovecot_t' can write to a 'file' of the following types:
# dovecot_tmp_t, user_home_t, data_home_t, dovecot_spool_t, dovecot_var_log_t, dovecot_var_lib_t, dovecot_var_run_t, mail_spool_t, root_t

allow dovecot_t fusefs_t:file { rename read lock create write getattr link unlink open };
Comment 1 Michael J. Chudobiak 2012-03-06 09:08:21 EST
Forgot to add - I'm using:

Comment 2 Michael J. Chudobiak 2012-03-06 09:13:54 EST
A similar request was filed in bug 583448.
Comment 3 Michael J. Chudobiak 2012-03-06 11:12:10 EST
And procmail should have the same capability.
Comment 4 Daniel Walsh 2012-03-06 16:55:30 EST
These were all fixed in Fedora 17.

Maybe we should start backporting the fix from there.

Comment 5 Miroslav Grepl 2012-03-07 07:39:58 EST
commit 4e27965a30def089ceccde2f5b98942ccb8f6009
Author: Miroslav Grepl <mgrepl@redhat.com>
Date:   Wed Mar 7 14:37:58 2012 +0000

    Started to backport userdom_home_reader and userdom_home_manager concept fro
      * added for dovecot
Comment 6 Fedora Update System 2012-03-13 08:25:25 EDT
selinux-policy-3.10.0-80.fc16 has been submitted as an update for Fedora 16.
Comment 7 Fedora Update System 2012-03-20 22:24:29 EDT
Package selinux-policy-3.10.0-80.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-80.fc16'
as soon as you are able to.
Please go to the following url:
then log in and leave karma (feedback).
Comment 8 Fedora Update System 2012-03-23 20:36:37 EDT
selinux-policy-3.10.0-80.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.