I'm exploring new territory: the first time I've ever tried to mount a
loop device (a ro file) at boot using fstab.
My fstab entry works fine from the command line, but it fails at boot
time due to a selinux avc error, I dont understand why but I suspect
it is because the file context is unsuitable.
The file and context are:
[david@kablamm ~]$ ls -lZ
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso
-r--r----- root share unconfined_u:object_r:default_t:s0
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso
The fstab line is:
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso /mnt/Fedora-09-i386-DVD iso9660 loop,ro,gid=share
0 0
The command line that works is:
# mount /mnt/Fedora-09-i386-DVD
The boot-time error messages are:
Mounting local filesystems:
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso: Permission
denied [FAILED]
Mounting other filesystems:
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso: Permission
denied [FAILED]
and from dmesg:
type=1400 audit(1241411595.523:4): avc: denied { read } for
pid=1335 comm="mount" name="Fedora-09-i386-DVD.iso" dev=sdb2 ino=1922
scontext=system_u:system_r:mount_t:s0
tcontext=unconfined_u:object_r:default_t:s0 tclass=file
and my selinux status is:
[root@kablamm ~]# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 22
Policy from config file: targeted
QUESTIONS:
I'm guessing that the problem is the file's tcontext .. what should it
be? Is it just a matter of changing it to mount_t, the same as the
error message scontext?
The command
# sesearch --allow -s mount_t -c file -p read
gives 1292 results. How could I decide which one of these to use?
And if anyone can say why it does not matter after boot time, I'd
appreciate understanding that. Possibly something to do with context
transitions?
I've not attempted any trial and error solution, prefer to comprehend
security tools if possible.
Thanks.
Show replies by date
Reading
http://fedoraproject.org/wiki/SELinux/Troubleshooting/AVCMessages
I think I understand that this trouble is likely caused by my file
/HUGE/get/iso/Fedora-09-i386-DVD/Fedora-09-i386-DVD.iso having
context=default_t because it occurs under the top level filesystem
branch /HUGE created by me which would completely lack any context or
policy.
That would be why 'touch /.autorelabel; shutdown -r now' did not fix
the problem.
The questions are, before I can use restorecon, what is the best way
to fix this, and what tools do I use to determine what is the
appropriate context for mount to access this file at boot time