Re: [gentoo-hardened] SELinux and NFS

[Loren Bandiera]

On Mon, 2008-02-25 at 17:17 +0100, xake@×××××××××.net wrote:
> As I can see the strange thing is that rpc.mountd tries to access
> /dev/sd{a2,b1} on your system.  I can not really see why it tries
> that.
> You can remove the ending "0 0" in your /etc/fstab for the nfs-
> shares,
> but I do not see how that would change things.

I'll try that later on.

> Just to clear out some things:
> Are you able to mount the shares on the client?
> DOes it work and what messages  do you get in dmesg if you connect
> with
> SELinux in non-enforce mode?

I am able to mount/use the shares on the client if SELinux is disabled
or in permissive mode.

In permissive mode, I get the following messages on the server's dmesg
when I try to access the mount from a client:

audit(1203952206.545:207): avc:  denied  { getattr } for  pid=10453
comm="rpc.mountd" path="/dev/sda2" dev=tmpfs ino=3372
scontext=user_u:system_r:nfsd_t
tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file

audit(1203952206.545:208): avc:  denied  { read } for  pid=10453
comm="rpc.mountd" name="sdb1" dev=tmpfs ino=2553
scontext=user_u:system_r:nfsd_t
tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file

audit(1203956454.493:209): avc:  denied  { getattr } for  pid=10453
comm="rpc.mountd" path="/dev/sda2" dev=tmpfs ino=3372
scontext=user_u:system_r:nfsd_t
tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file

audit(1203956454.493:210): avc:  denied  { read } for  pid=10453
comm="rpc.mountd" name="sdb1" dev=tmpfs ino=2553
scontext=user_u:system_r:nfsd_t
tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file

-- 
Loren Bandiera <lorenb@××××××××××××××.com>
LB Technology Services, Inc.


-- 
gentoo-hardened@l.g.o mailing list