Bug 980509 - some *_use_nfs booleans don't contain rules for autofs_t access
some *_use_nfs booleans don't contain rules for autofs_t access
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.5
All Linux
unspecified Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
Michal Trunecka
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-07-02 10:42 EDT by Michal Trunecka
Modified: 2014-09-30 19:35 EDT (History)
3 users (show)

See Also:
Fixed In Version: selinux-policy-3.7.19-212.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-11-21 05:32:19 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Michal Trunecka 2013-07-02 10:42:22 EDT
Description of problem:
Some booleans which allow access to nfs don't contain rules to allow access to autofs as well.

Following booleans allow autofs_t access in RHEL7, but not in RHEL6:

allow_ftpd_anon_write
allow_ftpd_use_nfs
cobbler_use_nfs
git_system_enable_homedirs
git_system_use_nfs
openvpn_enable_homedirs
qemu_use_nfs
samba_share_nfs
sanlock_use_nfs
ssh_chroot_rw_homedirs
virt_use_nfs
virt_use_samba
xen_use_nfs

Following booleans allow access to nfs_t, but not autofs_t on both RHEL6 and 7 (is this correct or is it a bug in RHEL7 as well?):

allow_guest_exec_content
allow_staff_exec_content
allow_sysadm_exec_content
allow_user_exec_content
allow_xguest_exec_content
httpd_enable_cgi


Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-205.el6.noarch
Comment 2 Michal Trunecka 2013-08-15 08:27:48 EDT
These three booleans are still missing the autofs_t rules:

git_system_enable_homedirs
git_system_use_nfs
openvpn_enable_homedirs

selinux-policy-3.7.19-211.el6.noarch
Comment 3 Michal Trunecka 2013-08-15 08:30:01 EDT
And regarding this list:

allow_guest_exec_content
allow_staff_exec_content
allow_sysadm_exec_content
allow_user_exec_content
allow_xguest_exec_content
httpd_enable_cgi

is it ok not to have rules for autofs_t while having rules for nfs_t in these?
Comment 4 Miroslav Grepl 2013-08-23 03:42:04 EDT
(In reply to Michal Trunecka from comment #2)
> These three booleans are still missing the autofs_t rules:
> 
> git_system_enable_homedirs
> git_system_use_nfs
> openvpn_enable_homedirs
> 
> selinux-policy-3.7.19-211.el6.noarch

Fixing these booleans.
Comment 7 errata-xmlrpc 2013-11-21 05:32:19 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1598.html

Note You need to log in before you can comment on or make changes to this bug.