Bug 803422 - SELinux denies writing /sbin/quotacheck to nfs_t folder
SELinux denies writing /sbin/quotacheck to nfs_t folder
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.2
All Linux
unspecified Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-14 13:06 EDT by Tom Marek
Modified: 2013-01-08 23:42 EST (History)
3 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-142.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-20 08:32:11 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tom Marek 2012-03-14 13:06:11 EDT
Description of problem:
When running xfstest (test 230) on ext4 partition test fails because selinux denies writing to this partition. Partition is mounted with these options:
'-o context=system_u:object_r:nfs_t:s0 -o grpquota,usrquota'.
After mounting the partition /sbin/quotacheck is started but it outputs Permission denied for writing to mounted partition.

When selinux is turned off everything runs as it should.

Version-Release number of selected component (if applicable):
Quota utilities version 3.17.

Steps to Reproduce:
1. create ext4 partition
2. mount it with '-o context=system_u:object_r:nfs_t:s0 -o grpquota,usrquota'
3. run '/sbin/quotacheck -g -u -m /partition/mountpoint' (fails here)
(following steps were not tested)
4. run '/sbin/quotaon /partition/mountpoint'
5. run '/usr/sbin/setquota -u user 1000 2000 3 5 /partition/mountpoint'
6. run '/usr/sbin/setquota -g user 1000 2000 3 5 /partition/mountpoint'

Actual results:
step 3 prits out:
quotacheck: Cannot create new quotafile /partition/mountpoint/aquota.user.new: Permission denied
quotacheck: Cannot initialize IO on new quotafile: Permission denied
quotacheck: Cannot create new quotafile /partition/mountpoint/aquota.group.new: Permission denied
quotacheck: Cannot initialize IO on new quotafile: Permission denied


output in /var/log/audit/audit.log:
type=AVC msg=audit(1330758684.492:658): avc:  denied  { write } for  pid=10360 comm="quotacheck" name="/" dev=dm-1 ino=2 scontext=unconfined_u:unconfined_r:quota_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1330758684.492:658): arch=c000003e syscall=2 success=no exit=-13 a0=7fffee502160 a1=c2 a2=180 a3=7fffee501eb0 items=0 ppid=10173 pid=10360 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="quotacheck" exe="/sbin/quotacheck" subj=unconfined_u:unconfined_r:quota_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1330758684.492:659): avc:  denied  { write } for  pid=10360 comm="quotacheck" name="/" dev=dm-1 ino=2 scontext=unconfined_u:unconfined_r:quota_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1330758684.492:659): arch=c000003e syscall=2 success=no exit=-13 a0=7fffee502160 a1=c2 a2=180 a3=7fffee502180 items=0 ppid=10173 pid=10360 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="quotacheck" exe="/sbin/quotacheck" subj=unconfined_u:unconfined_r:quota_t:s0-s0:c0.c1023 key=(null)


Expected results:
step 3 should create two files in /parrtition/mountpoint - aquota.group and aquota.user
steps 4,5,6 should then write into these files
Comment 2 Miroslav Grepl 2012-03-14 13:57:55 EDT
We don't have quota support for NFS in the policy.
Comment 3 Daniel Walsh 2012-03-15 10:22:28 EDT
I guess we should just allow it to write to all non XAttr file systems.
Comment 5 Miroslav Grepl 2012-03-20 10:37:20 EDT
Fixed in selinux-policy-3.7.19-142.el6
Comment 8 errata-xmlrpc 2012-06-20 08:32:11 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0780.html

Note You need to log in before you can comment on or make changes to this bug.