Bug 835146 - libselinux does not correctly support readonly mount point on RHEL6
libselinux does not correctly support readonly mount point on RHEL6
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: libselinux (Show other bugs)
6.3
All Linux
unspecified Severity medium
: rc
: ---
Assigned To: Petr Lautrbach
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-25 12:48 EDT by Giuseppe Ragusa
Modified: 2015-12-16 02:52 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-12-16 02:52:16 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
LibSELinux patch for readonly mountpoint support (4.99 KB, patch)
2012-06-25 12:48 EDT, Giuseppe Ragusa
no flags Details | Diff

  None (edit)
Description Giuseppe Ragusa 2012-06-25 12:48:56 EDT
Created attachment 594237 [details]
LibSELinux patch for readonly mountpoint support

Description of problem:
SELinux library must treat a readonly mount point as a disabled SELinux to correctly work in LXC (probably chroot too) setups, otherwise problems occur with cronie (jobs do not run) and PAM (logins not allowed unless pam_selinux is commented out).

Version-Release number of selected component (if applicable):
libselinux-2.0.94-5.3.el6.src.rpm

How reproducible:
Set up a (albeit Technology Preview) libvirt-based LXC container (of "/sbin/init" type) and try to log in (locally or through SSH) or check scheduled cron jobs results.

Steps to Reproduce:
1.
2.
3.
  
Actual results:
"Authentication failed" on login and errors in /var/log/cron

Expected results:
No errors and cron jobs / logins working.

Additional info:
Added patch from upstream (slightly edited in place) which seems to solve above problems.
Comment 2 RHEL Product and Program Management 2012-07-10 04:39:09 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 3 RHEL Product and Program Management 2012-07-10 19:50:08 EDT
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development.  This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Comment 4 RHEL Product and Program Management 2012-09-07 01:36:13 EDT
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 6 Petr Lautrbach 2015-12-16 02:52:16 EST
I believe this is already fixed in libselinux-2.0.94-5.6.el6 - https://rhn.redhat.com/errata/RHBA-2014-1469.html. If the problem persists for you feel free to reopen.

Note You need to log in before you can comment on or make changes to this bug.