Hide Forgot
Description of problem: service nfs-server restart causes avc denial and its not started Version-Release number of selected component (if applicable): nfs-utils-1.2.5-3.el7.x86_64 selinux-policy-3.10.0-56.el7.noarch How reproducible: deterministic Steps to Reproduce: 1. service nfs-server restart Actual results: # restorecon /bin/mount # getenforce Enforcing # ls -laZ /bin/mount -rwsr-xr-x. root root system_u:object_r:mount_exec_t:s0 /bin/mount # service nfs-server restart Redirecting to /bin/systemctl restart nfs-server.service type=AVC msg=audit(1331129342.367:1159): avc: denied { execute } for pid=14480 comm="sh" name="mount" dev=dm-1 ino=397106 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file type=AVC msg=audit(1331129342.368:1160): avc: denied { execute } for pid=14480 comm="sh" name="mount" dev=dm-1 ino=397106 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file Job failed. See system logs and 'systemctl status' for details. # find / -inum 397106 /bin/mount Expected results: no denial nfs-server can start Additional info:
If you run in permissive mode, do you see any other AVC's?
Yes, following AVCs appear in permissive mode: ---- time->Tue Apr 10 11:12:19 2012 type=SYSCALL msg=audit(1334049139.673:71): arch=c000003e syscall=59 success=yes exit=0 a0=177c2b0 a1=177c3d0 a2=177af60 a3=7fff88b1cfa0 items=0 ppid=1319 pid=1320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:nfsd_t:s0 key=(null) type=AVC msg=audit(1334049139.673:71): avc: denied { execute_no_trans } for pid=1320 comm="sh" path="/bin/mount" dev=sda4 ino=2883655 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file type=AVC msg=audit(1334049139.673:71): avc: denied { execute } for pid=1320 comm="sh" name="mount" dev=sda4 ino=2883655 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file ---- time->Tue Apr 10 11:12:19 2012 type=SYSCALL msg=audit(1334049139.677:72): arch=c000003e syscall=2 success=yes exit=3 a0=7fb3682c14f0 a1=42 a2=1a4 a3=7fffbc3a5dc0 items=0 ppid=1319 pid=1320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:nfsd_t:s0 key=(null) type=AVC msg=audit(1334049139.677:72): avc: denied { write } for pid=1320 comm="mount" name="utab" dev=tmpfs ino=1970 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:mount_var_run_t:s0 tclass=file ---- time->Tue Apr 10 11:12:19 2012 type=SYSCALL msg=audit(1334049139.678:73): arch=c000003e syscall=165 success=yes exit=0 a0=7fb3693dd1d0 a1=7fb3693dd1f0 a2=7fb3693dd210 a3=ffffffffc0ed0000 items=0 ppid=1319 pid=1320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:nfsd_t:s0 key=(null) type=AVC msg=audit(1334049139.678:73): avc: denied { module_request } for pid=1320 comm="mount" kmod="nfsd" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system type=AVC msg=audit(1334049139.678:73): avc: denied { mounton } for pid=1320 comm="mount" path="/proc/fs/nfsd" dev=proc ino=4026531845 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=dir ---- time->Tue Apr 10 11:12:19 2012 type=SYSCALL msg=audit(1334049139.803:74): arch=c000003e syscall=21 success=yes exit=0 a0=7fb3693dd1f0 a1=2 a2=0 a3=7fffbc3a5f80 items=0 ppid=1319 pid=1320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount" subj=system_u:system_r:nfsd_t:s0 key=(null) type=AVC msg=audit(1334049139.803:74): avc: denied { write } for pid=1320 comm="mount" name="/" dev=nfsd ino=1 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:nfsd_fs_t:s0 tclass=dir ----
Fixed in selinux-policy-3.10.0-114.fc17
This request was resolved in Red Hat Enterprise Linux 7.0. Contact your manager or support representative in case you have further questions about the request.