Red Hat Bugzilla – Bug 856565
Selinux prevents automount from writing its pid file if it already exists
Last modified: 2012-09-26 05:01:41 EDT
Description of problem: If the file /var/run/autofs.pid exists when autofs is started Selinux will prevent automount from opening (and truncating) the pid file to write the pid to it. Version-Release number of selected component (if applicable): selinux-policy-2.4.6-331.el5 How reproducible: Always. Steps to Reproduce: 1. touch /var/run/autofs.pid 2. service autofs start Actual results: ls -l /var/run/autofs.pid shows a zero length file and a automount logs a permission denied message. Expected results: The pid file is truncated and the pid of the daemon is written to the pid file.
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux release for currently deployed products. This request is not yet committed for inclusion in a release.
Could you attach AVC msgs?
The problem is that /var/run/autofs.pid is mislabelled when you "touch" it. # service autofs status automount is stopped # touch /var/run/autofs.pid # ls -Z /var/run/autofs.pid -rw-r--r-- root root root:object_r:var_run_t /var/run/autofs.pid # restorecon -v /var/run/autofs.pid restorecon reset /var/run/autofs.pid context root:object_r:var_run_t:s0->system_u:object_r:automount_var_run_t:s0 # ls -Z /var/run/autofs.pid -rw-r--r-- root root system_u:object_r:automount_var_run_t /var/run/autofs.pid # service autofs start Starting automount: [ OK ] # service autofs status automount (pid 27733) is running... #
Seen in /var/log/messages: ---- Sep 26 08:13:01 rhel59 automount[3027]: become_daemon:1099: failed to write pid file /var/run/autofs.pid: Permission denied Sep 26 08:13:02 rhel59 setroubleshoot: SELinux is preventing automount (automount_t) "write" to ./autofs.pid (var_run_t). For complete SELinux messages. run sealert -l 80dde560-7fb3-4c9b-b373-9231263b78c5 ---- Here is the AVC: ---- type=PATH msg=audit(09/26/2012 08:13:01.833:42) : item=0 name=/var/run/autofs.pid inode=65946 dev=03:03 mode=file,644 ouid=root ogid=root rdev=00:00 obj=root:object_r:var_run_t:s0 type=CWD msg=audit(09/26/2012 08:13:01.833:42) : cwd=/ type=SYSCALL msg=audit(09/26/2012 08:13:01.833:42) : arch=i386 syscall=open success=no exit=-13(Permission denied) a0=bfa32f71 a1=8241 a2=1b6 a3=8cd01f0 items=1 ppid=3026 pid=3027 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=5 comm=automount exe=/usr/sbin/automount subj=root:system_r:automount_t:s0 key=(null) type=AVC msg=audit(09/26/2012 08:13:01.833:42) : avc: denied { write } for pid=3027 comm=automount name=autofs.pid dev=hda3 ino=65946 scontext=root:system_r:automount_t:s0 tcontext=root:object_r:var_run_t:s0 tclass=file ---- Very similar AVC can be seen on RHEL-6.4, but I still blame the mislabelled file. When you call "restorecon -Rv /var/run" the problem disappears.
Yes, the pid file will be mislabeled if you just touch it or if you start a service by hand.