Bug 803422 - SELinux denies writing /sbin/quotacheck to nfs_t folder
Summary: SELinux denies writing /sbin/quotacheck to nfs_t folder
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.2
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-14 17:06 UTC by Tom Marek
Modified: 2013-01-09 04:42 UTC (History)
3 users (show)

Fixed In Version: selinux-policy-3.7.19-142.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-06-20 12:32:11 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0780 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2012-06-19 20:34:59 UTC

Description Tom Marek 2012-03-14 17:06:11 UTC
Description of problem:
When running xfstest (test 230) on ext4 partition test fails because selinux denies writing to this partition. Partition is mounted with these options:
'-o context=system_u:object_r:nfs_t:s0 -o grpquota,usrquota'.
After mounting the partition /sbin/quotacheck is started but it outputs Permission denied for writing to mounted partition.

When selinux is turned off everything runs as it should.

Version-Release number of selected component (if applicable):
Quota utilities version 3.17.

Steps to Reproduce:
1. create ext4 partition
2. mount it with '-o context=system_u:object_r:nfs_t:s0 -o grpquota,usrquota'
3. run '/sbin/quotacheck -g -u -m /partition/mountpoint' (fails here)
(following steps were not tested)
4. run '/sbin/quotaon /partition/mountpoint'
5. run '/usr/sbin/setquota -u user 1000 2000 3 5 /partition/mountpoint'
6. run '/usr/sbin/setquota -g user 1000 2000 3 5 /partition/mountpoint'

Actual results:
step 3 prits out:
quotacheck: Cannot create new quotafile /partition/mountpoint/aquota.user.new: Permission denied
quotacheck: Cannot initialize IO on new quotafile: Permission denied
quotacheck: Cannot create new quotafile /partition/mountpoint/aquota.group.new: Permission denied
quotacheck: Cannot initialize IO on new quotafile: Permission denied


output in /var/log/audit/audit.log:
type=AVC msg=audit(1330758684.492:658): avc:  denied  { write } for  pid=10360 comm="quotacheck" name="/" dev=dm-1 ino=2 scontext=unconfined_u:unconfined_r:quota_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1330758684.492:658): arch=c000003e syscall=2 success=no exit=-13 a0=7fffee502160 a1=c2 a2=180 a3=7fffee501eb0 items=0 ppid=10173 pid=10360 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="quotacheck" exe="/sbin/quotacheck" subj=unconfined_u:unconfined_r:quota_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1330758684.492:659): avc:  denied  { write } for  pid=10360 comm="quotacheck" name="/" dev=dm-1 ino=2 scontext=unconfined_u:unconfined_r:quota_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=dir
type=SYSCALL msg=audit(1330758684.492:659): arch=c000003e syscall=2 success=no exit=-13 a0=7fffee502160 a1=c2 a2=180 a3=7fffee502180 items=0 ppid=10173 pid=10360 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="quotacheck" exe="/sbin/quotacheck" subj=unconfined_u:unconfined_r:quota_t:s0-s0:c0.c1023 key=(null)


Expected results:
step 3 should create two files in /parrtition/mountpoint - aquota.group and aquota.user
steps 4,5,6 should then write into these files

Comment 2 Miroslav Grepl 2012-03-14 17:57:55 UTC
We don't have quota support for NFS in the policy.

Comment 3 Daniel Walsh 2012-03-15 14:22:28 UTC
I guess we should just allow it to write to all non XAttr file systems.

Comment 5 Miroslav Grepl 2012-03-20 14:37:20 UTC
Fixed in selinux-policy-3.7.19-142.el6

Comment 8 errata-xmlrpc 2012-06-20 12:32:11 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0780.html


Note You need to log in before you can comment on or make changes to this bug.