Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 453904 - autofs is unable to mount Novell netware filesystems (ncpfs/ncpmount) due to SELinux issues
Summary: autofs is unable to mount Novell netware filesystems (ncpfs/ncpmount) due to ...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 9
Hardware: All
OS: Linux
low
medium
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-07-03 03:54 UTC by James Hunt
Modified: 2008-11-17 22:04 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-11-17 22:04:59 UTC


Attachments (Terms of Use)

Description James Hunt 2008-07-03 03:54:48 UTC
Description of problem:

SELinux is preventing autofs from auto-mounting any Novell Netware filesystems
under Fedora 9.

Version-Release number of selected component (if applicable):

# rpm -qa|egrep "autofs|selinux|policy|ncp"|sort
autofs-5.0.3-15.i386
checkpolicy-2.0.14-1.fc9.i386
libselinux-2.0.64-2.fc9.i386
libselinux-devel-2.0.64-2.fc9.i386
libselinux-python-2.0.64-2.fc9.i386
ncpfs-2.2.6-10.fc9.i386
policycoreutils-2.0.49-7.fc9.i386
policycoreutils-gui-2.0.49-7.fc9.i386
policycoreutils-newrole-2.0.49-7.fc9.i386
selinux-doc-1.26-1.1.noarch
selinux-policy-3.3.1-72.fc9.noarch
selinux-policy-devel-3.3.1-72.fc9.noarch
selinux-policy-targeted-3.3.1-72.fc9.noarch

How reproducible:

Every time.

Steps to Reproduce:
1. echo "/netware        /etc/auto.netware" >> /etc/auto.master
2.cat > /etc/auto.netware<<EOF
myfs      
-fstype=ncpfs,ro,nosuid,nodev,tcp,owner=me,uid=me,gid=mygroup,multiple,ipserver=myserver,volume=myvolume,password=mypassword
 myserver/me
EOF
3. service autofs restart
4. cd /netware/myfs
  
Actual results:

- "cd" hangs and gives "Interrupted system call" error if CONTROL-C'd.
- SELinux's "setroubleshoot 2.0.6" gui pops up stating...

Summary:

SELinux is preventing mount (mount_t) "read" to mount.ncpfs (mount_exec_t).

Detailed Description:

SELinux denied access requested by mount. It is not expected that this access is
required by mount and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

Sometimes labeling problems can cause SELinux denials. You could try to restore
the default system file context for mount.ncpfs,

restorecon -v 'mount.ncpfs'

If this does not work, there is currently no automatic way to allow this access.
Instead, you can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                system_u:system_r:mount_t:s0
Target Context                system_u:object_r:mount_exec_t:s0
Target Objects                mount.ncpfs [ lnk_file ]
Source                        mount
Source Path                   /bin/mount
Port                          <Unknown>
Host                          jamesh-ll
Source RPM Packages           util-linux-ng-2.13.1-6.fc9
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-72.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall_file
Host Name                     jamesh-ll
Platform                      Linux jamesh-ll 2.6.25.9-76.fc9.i686 #1 SMP Fri
                              Jun 27 16:14:35 EDT 2008 i686 i686
Alert Count                   2
First Seen                    Thu 03 Jul 2008 02:23:30 PM NZST
Last Seen                     Thu 03 Jul 2008 02:23:30 PM NZST
Local ID                      f09a8489-f9e5-4537-b303-f32ea2652019
Line Numbers                  

Raw Audit Messages            

host=jamesh-ll type=AVC msg=audit(1215051810.864:71): avc:  denied  { read } for
 pid=24289 comm="mount" name="mount.ncpfs" dev=dm-1 ino=65823
scontext=system_u:system_r:mount_t:s0 tcontext=system_u:object_r:mount_exec_t:s0
tclass=lnk_file

host=jamesh-ll type=SYSCALL msg=audit(1215051810.864:71): arch=40000003
syscall=195 success=no exit=-13 a0=bf8a8b90 a1=bf8a8b04 a2=2bdff4 a3=b97ddfb0
items=0 ppid=2322 pid=24289 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mount" exe="/bin/mount"
subj=system_u:system_r:mount_t:s0 key=(null)


# ls -alZ /bin/mount /sbin/mount.ncp /sbin/mount.ncpfs /usr/bin/ncpmount
/usr/bin/ncpumount
-rwsr-xr-x  root root system_u:object_r:mount_exec_t:s0 /bin/mount
lrwxrwxrwx  root root system_u:object_r:bin_t:s0       /sbin/mount.ncp ->
../usr/bin/ncpmount
lrwxrwxrwx  root root system_u:object_r:bin_t:s0       /sbin/mount.ncpfs ->
../usr/bin/ncpmount
-rwxr-xr-x  root root system_u:object_r:bin_t:s0 /usr/bin/ncpmount
-rwxr-xr-x  root root system_u:object_r:bin_t:s0       /usr/bin/ncpumount


So, the first problem appears that ncpmount should have the mount_exec_t context:

chcon system_u:object_r:mount_exec_t:s0 /usr/bin/ncpmount
service autofs restart
Now we get another SELinux error:


Summary:

SELinux is preventing mount.ncpfs (mount_t) "mount" to / (unlabeled_t).

Detailed Description:

SELinux denied access requested by mount.ncpfs. It is not expected that this
access is required by mount.ncpfs and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                unconfined_u:system_r:mount_t:s0
Target Context                system_u:object_r:unlabeled_t:s0
Target Objects                / [ filesystem ]
Source                        mount.ncpfs
Source Path                   /usr/bin/ncpmount
Port                          <Unknown>
Host                          jamesh-ll
Source RPM Packages           ncpfs-2.2.6-10.fc9
Target RPM Packages           filesystem-2.4.13-1.fc9
Policy RPM                    selinux-policy-3.3.1-72.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     jamesh-ll
Platform                      Linux jamesh-ll 2.6.25.9-76.fc9.i686 #1 SMP Fri
                              Jun 27 16:14:35 EDT 2008 i686 i686
Alert Count                   6
First Seen                    Thu 26 Jun 2008 11:29:39 AM NZST
Last Seen                     Thu 03 Jul 2008 03:39:50 PM NZST
Local ID                      ac957367-9a6d-4c4e-ac26-6282fe1e152e
Line Numbers                  

Raw Audit Messages            

host=jamesh-ll type=AVC msg=audit(1215056390.509:163): avc:  denied  { mount }
for  pid=2898 comm="mount.ncpfs" name="/" dev=ncpfs ino=2
scontext=unconfined_u:system_r:mount_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem

host=jamesh-ll type=SYSCALL msg=audit(1215056390.509:163): arch=40000003
syscall=21 success=no exit=-13 a0=873e6a8 a1=8090fc0 a2=8081a87 a3=c0ed0007
items=0 ppid=2897 pid=2898 auid=1390 uid=1390 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=1 comm="mount.ncpfs" exe="/usr/bin/ncpmount"
subj=unconfined_u:system_r:mount_t:s0 key=(null)


Expected results:

- "cd /netware/myfs" should work.

Additional info:

Adding the Netware FS into /etc/fstab and mounting that way works fine!

Comment 1 James Hunt 2008-07-03 23:35:36 UTC
Changed component from ncpfs to selinux-policy-targeted.

Comment 2 Daniel Walsh 2008-07-07 16:20:57 UTC
Fixed in selinux-policy-3.3.1-77.fc9.noarch

It will be treated as an NFS file system.

Comment 3 James Hunt 2008-07-17 20:41:08 UTC
Thanks Dan - when will this version become available? I'm running the latest
stable selinux-policy package (selinux-policy-3.3.1-74.fc9.noarch) which has
been around since July 5th.


Comment 4 Daniel Walsh 2008-07-17 20:44:18 UTC
I just marked it as stable.

Comment 5 James Hunt 2008-07-20 21:16:48 UTC
I've just updated to selinux-policy-targeted-3.3.1-78.fc9.noarch and it works!!

Thanks,

James.

Comment 6 James Hunt 2008-07-21 02:24:00 UTC
...actually, although mounting works, unmounting doesn't. If I manually run
"sudo /sbin/service autofs stop" it fails:

> sudo /sbin/service autofs stop
Stopping automount:                                        [FAILED]
> ps -ef|grep automount
root      2304     1  0 14:03 ?        00:00:00 automount
> sudo strace -p 2304
Process 2304 attached - interrupt to quit
rt_sigtimedwait(~[CHLD CONT RTMIN RT_1],

It just hangs forever on that last call. If I "kill -9 2304", I do get an
SELinux error though:


Summary:

SELinux is preventing automount (automount_t) "write" to <Unknown> (mount_t).

Detailed Description:

SELinux denied access requested by automount. It is not expected that this
access is required by automount and this access may signal an intrusion attempt.
It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                system_u:system_r:automount_t:s0
Target Context                system_u:system_r:mount_t:s0
Target Objects                None [ tcp_socket ]
Source                        automount
Source Path                   <Unknown>
Port                          <Unknown>
Host                          jamesh-ll
Source RPM Packages           autofs-5.0.3-15
Target RPM Packages           
Policy RPM                    selinux-policy-3.3.1-78.fc9
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     jamesh-ll
Platform                      Linux jamesh-ll 2.6.25.10-86.fc9.i686 #1 SMP Mon
                              Jul 7 20:46:03 EDT 2008 i686 i686
Alert Count                   1
First Seen                    Mon 21 Jul 2008 09:20:43 AM NZST
Last Seen                     Mon 21 Jul 2008 02:12:59 PM NZST
Local ID                      e73892d5-a340-47ca-8adb-7b92247af69d
Line Numbers                  

Raw Audit Messages            

host=jamesh-ll type=AVC msg=audit(1216606379.443:25): avc:  denied  { write }
for  pid=6116 comm="automount" laddr=10.33.21.56 lport=36478 faddr=10.32.18.4
fport=524 scontext=system_u:system_r:automount_t:s0
tcontext=system_u:system_r:mount_t:s0 tclass=tcp_socket

host=jamesh-ll type=SYSCALL msg=audit(1216606379.443:25): arch=40000003
syscall=268 success=yes exit=0 a0=b7bb3367 a1=54 a2=b7bb32cc a3=b9aa0c68 items=0
ppid=1 pid=6116 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
fsgid=0 tty=(none) ses=4294967295 comm="automount" exe="/usr/sbin/automount"
subj=system_u:system_r:automount_t:s0 key=(null)




Comment 7 Daniel Walsh 2008-11-17 22:04:59 UTC
Closing all bugs that have been in modified for over a month.  Please reopen if the bug is not actually fixed.


Note You need to log in before you can comment on or make changes to this bug.