Description of problem: Mounting home over NFS via automount. Boolean use_nfs_home_dirs is set as is openvpn_enable_homedirs however this seems to be a NM policy problem. $ ls -lZ .cert/ -rw-r--r--. karl users system_u:object_r:nfs_t:s0 ca.crt -rw-r--r--. karl users system_u:object_r:nfs_t:s0 klatiss.crt -rw-------. karl users system_u:object_r:nfs_t:s0 klatiss.key restorecon -v -R .cert doesn't change anything but I believe that's correct (as per https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-Mounting_File_Systems.html) Additional info: libreport version: 2.0.16 kernel: 3.6.3-1.fc17.x86_64 description: :SELinux is preventing /usr/libexec/nm-openvpn-service from 'open' accesses on the file /home/karl/.cert/klatiss.key. : :***** Plugin catchall (100. confidence) suggests *************************** : :If you believe that nm-openvpn-service should be allowed open access on the klatiss.key file by default. :Then you should report this as a bug. :You can generate a local policy module to allow this access. :Do :allow this access for now by executing: :# grep nm-openvpn-serv /var/log/audit/audit.log | audit2allow -M mypol :# semodule -i mypol.pp : :Additional Information: :Source Context system_u:system_r:NetworkManager_t:s0 :Target Context system_u:object_r:nfs_t:s0 :Target Objects /home/karl/.cert/klatiss.key [ file ] :Source nm-openvpn-serv :Source Path /usr/libexec/nm-openvpn-service :Port <Unknown> :Host (removed) :Source RPM Packages :Target RPM Packages :Policy RPM selinux-policy-3.10.0-156.fc17.noarch :Selinux Enabled True :Policy Type targeted :Enforcing Mode Permissive :Host Name (removed) :Platform Linux (removed) 3.6.3-1.fc17.x86_64 #1 SMP Mon Oct : 22 15:32:35 UTC 2012 x86_64 x86_64 :Alert Count 2 :First Seen 2012-11-03 12:40:20 EST :Last Seen 2012-11-04 10:43:25 EST :Local ID c19cf10f-a0a5-4b95-a2d8-0858c09cbb24 : :Raw Audit Messages :type=AVC msg=audit(1351986205.211:1132): avc: denied { open } for pid=6293 comm="nm-openvpn-serv" path="/home/karl/.cert/klatiss.key" dev="0:33" ino=24174596 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=file : : :type=SYSCALL msg=audit(1351986205.211:1132): arch=x86_64 syscall=open success=yes exit=EIO a0=1d40140 a1=0 a2=79656b2e737369 a3=616b2f656d6f682f items=0 ppid=606 pid=6293 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=nm-openvpn-serv exe=/usr/libexec/nm-openvpn-service subj=system_u:system_r:NetworkManager_t:s0 key=(null) : :Hash: nm-openvpn-serv,NetworkManager_t,nfs_t,file,open : :audit2allow : :#============= NetworkManager_t ============== :allow NetworkManager_t nfs_t:file open; : :audit2allow -R : :#============= NetworkManager_t ============== :allow NetworkManager_t nfs_t:file open; :
Created attachment 637852 [details] File: type
Created attachment 637853 [details] File: hashmarkername
Added. commit 8559a7c0302d636062e7658e98af467f5a22c3d7 Author: Miroslav Grepl <mgrepl> Date: Mon Nov 5 10:34:59 2012 +0100 Allow NM to read certs on NFS/CIFS using use_nfs_*, use_samba_* booleans
selinux-policy-3.10.0-159.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-159.fc17
Installed selinux-policy-targeted-3.10.0-159.fc17.noarch.rpm and selinux-policy-3.10.0-159.fc17.noarch.rpm from koji and this resolved the issue. This can be marked as fixed.
Package selinux-policy-3.10.0-159.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-159.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-17782/selinux-policy-3.10.0-159.fc17 then log in and leave karma (feedback).
Thank you for testing.