Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 452889 - SELinux prevented groupadd from reading files stored on a NFS filesytem.
Summary: SELinux prevented groupadd from reading files stored on a NFS filesytem.
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 9
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2008-06-25 16:16 UTC by Jeff Moyer
Modified: 2008-11-17 22:04 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2008-11-17 22:04:49 UTC

Attachments (Terms of Use)

Description Jeff Moyer 2008-06-25 16:16:05 UTC
Description of problem:


SELinux prevented groupadd from reading files stored on a NFS filesytem.

Detailed Description:

SELinux prevented groupadd from reading files stored on a NFS filesystem. NFS
(Network Filesystem) is a network filesystem commonly used on Unix / Linux
systems. groupadd attempted to read one or more files or directories from a
mounted filesystem of this type. As NFS filesystems do not support fine-grained
SELinux labeling, all files and directories in the filesystem will have the same
security context. If you have not configured groupadd to read files from a NFS
filesystem this access attempt could signal an intrusion attempt.

Allowing Access:

Changing the "use_nfs_home_dirs" boolean to true will allow this access:
"setsebool -P use_nfs_home_dirs=1"

Fix Command:

setsebool -P use_nfs_home_dirs=1

Additional Information:

Source Context                unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023
Target Context                system_u:object_r:nfs_t:s0
Target Objects                ./ [ dir ]
Source                        groupadd
Source Path                   /usr/sbin/groupadd
Port                          <Unknown>
Source RPM Packages           shadow-utils-4.1.1-2.fc9
Target RPM Packages           filesystem-2.4.13-1.fc9
Policy RPM                    selinux-policy-3.3.1-64.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   use_nfs_home_dirs
Host Name           
Platform                      Linux
                     #1 SMP Tue Jun 10 16:05:21
                              EDT 2008 x86_64 x86_64
Alert Count                   2
First Seen                    Wed 25 Jun 2008 12:12:40 PM EDT
Last Seen                     Wed 25 Jun 2008 12:12:40 PM EDT
Local ID                      85ac57ac-7a6b-4cf6-b13d-8a598be77f0c
Line Numbers                  

Raw Audit Messages     type=AVC msg=audit(1214410360.511:381):
avc:  denied  { search } for  pid=21579 comm="groupadd" name="" dev=0:18
ino=15375843 scontext=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:nfs_t:s0 tclass=dir type=SYSCALL
msg=audit(1214410360.511:381): arch=c000003e syscall=2 success=no exit=-13
a0=956730 a1=0 a2=1b6 a3=7ff9e556a780 items=0 ppid=21578 pid=21579 auid=3734
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=9
comm="groupadd" exe="/usr/sbin/groupadd"
subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 key=(null)

How reproducible:

Steps to Reproduce:
1. yum install mock while having an NFS-mounted directory (in my case, my homedir).

Comment 1 Daniel Walsh 2008-06-26 12:07:51 UTC
You can allow this for now.

# audit2allow -M mypol -l -i /var/log/audit/audit.log
# semodule -i mypol.pp

Fixed in selinux-policy-3.3.1-72.fc9.noarch

Comment 2 Daniel Walsh 2008-11-17 22:04:49 UTC
Closing all bugs that have been in modified for over a month.  Please reopen if the bug is not actually fixed.

Note You need to log in before you can comment on or make changes to this bug.