Bug 856565 - Selinux prevents automount from writing its pid file if it already exists
Selinux prevents automount from writing its pid file if it already exists
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy (Show other bugs)
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Milos Malik
Depends On:
Blocks: 845503
  Show dependency treegraph
Reported: 2012-09-12 06:38 EDT by Ian Kent
Modified: 2012-09-26 05:01 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-09-26 05:01:41 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Ian Kent 2012-09-12 06:38:30 EDT
Description of problem:
If the file /var/run/autofs.pid exists when autofs is started
Selinux will prevent automount from opening (and truncating)
the pid file to write the pid to it.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. touch /var/run/autofs.pid
2. service autofs start
Actual results:
ls -l /var/run/autofs.pid shows a zero length file and a
automount logs a permission denied message.

Expected results:
The pid file is truncated and the pid of the daemon is
written to the pid file.
Comment 1 RHEL Product and Program Management 2012-09-12 06:58:40 EDT
This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux release.  Product Management has
requested further review of this request by Red Hat Engineering, for
potential inclusion in a Red Hat Enterprise Linux release for currently
deployed products.  This request is not yet committed for inclusion in
a release.
Comment 2 Miroslav Grepl 2012-09-12 07:42:18 EDT
Could you attach AVC msgs?
Comment 3 Milos Malik 2012-09-12 07:55:26 EDT
The problem is that /var/run/autofs.pid is mislabelled when you "touch" it.

# service autofs status
automount is stopped
# touch /var/run/autofs.pid
# ls -Z /var/run/autofs.pid
-rw-r--r--  root root root:object_r:var_run_t          /var/run/autofs.pid
# restorecon -v /var/run/autofs.pid
restorecon reset /var/run/autofs.pid context root:object_r:var_run_t:s0->system_u:object_r:automount_var_run_t:s0
# ls -Z /var/run/autofs.pid
-rw-r--r--  root root system_u:object_r:automount_var_run_t /var/run/autofs.pid
# service autofs start
Starting automount:                                        [  OK  ]
# service autofs status
automount (pid  27733) is running...
Comment 4 Milos Malik 2012-09-26 02:21:06 EDT
Seen in /var/log/messages:
Sep 26 08:13:01 rhel59 automount[3027]: become_daemon:1099: failed to write pid file /var/run/autofs.pid: Permission denied
Sep 26 08:13:02 rhel59 setroubleshoot: SELinux is preventing automount (automount_t) "write" to ./autofs.pid (var_run_t). For complete SELinux messages. run sealert -l 80dde560-7fb3-4c9b-b373-9231263b78c5

Here is the AVC:
type=PATH msg=audit(09/26/2012 08:13:01.833:42) : item=0 name=/var/run/autofs.pid inode=65946 dev=03:03 mode=file,644 ouid=root ogid=root rdev=00:00 obj=root:object_r:var_run_t:s0 
type=CWD msg=audit(09/26/2012 08:13:01.833:42) :  cwd=/ 
type=SYSCALL msg=audit(09/26/2012 08:13:01.833:42) : arch=i386 syscall=open success=no exit=-13(Permission denied) a0=bfa32f71 a1=8241 a2=1b6 a3=8cd01f0 items=1 ppid=3026 pid=3027 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=5 comm=automount exe=/usr/sbin/automount subj=root:system_r:automount_t:s0 key=(null) 
type=AVC msg=audit(09/26/2012 08:13:01.833:42) : avc:  denied  { write } for  pid=3027 comm=automount name=autofs.pid dev=hda3 ino=65946 scontext=root:system_r:automount_t:s0 tcontext=root:object_r:var_run_t:s0 tclass=file 

Very similar AVC can be seen on RHEL-6.4, but I still blame the mislabelled file. When you call "restorecon -Rv /var/run" the problem disappears.
Comment 5 Miroslav Grepl 2012-09-26 05:01:41 EDT
Yes, the pid file will be mislabeled if you just touch it or if you start a service by hand.

Note You need to log in before you can comment on or make changes to this bug.