Giving httpd access to a mounted NTFS volume

[Chris Lopes]

Hi,

I am using selinux under Fedora 10 (2.6.27.37).
I have Apache httpd running, and I would like it to be able to serve requests 
for files which are on a mounted NTFS volume.

I have tried to mount the volume with an appropriate context:
mount -o context=system_u:object_r:httpd_sys_content_t:s0 /dev/somedevice 
/mnt/somemountpoint

But the resulting context on files within the mount is 
still: system_u:object_r:fusefs_t:s0
The mount itself doesn't generate any noteworthy warnings/errors in my logs.
So of course seliux disallows apache to read the files and generates 
corresponding denials in my logs.
No other partition on this device is already mounted.

Is this a known bug?
Others seem to have similar issues:
http://old.nabble.com/mounting-nfs-as-httpd_sys_content_t-under-selinux-t...

http://forums.fedoraforum.org/archive/index.php/t-246937.html
http://old.nabble.com/SELinux-enforcing,-an-external-ntfs-3g-mount,-Samba...


I guess an alternative is to create a policy that tells selinux to allow httpd 
to read fuse files, as is described here:
https://bugzilla.redhat.com/show_bug.cgi?id=631616#c2

Any ideas?

Thanks

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/09/2010 07:46 AM, Chris Lopes wrote:
>  Hi,
>  
>  I am using selinux under Fedora 10 (2.6.27.37).
>  I have Apache httpd running, and I would like it to be able to serve requests 
>  for files which are on a mounted NTFS volume.
>   
First off, please update to a Fedora Release that is supported F12, F13,
F14.


>  I have tried to mount the volume with an appropriate context:
>  mount -o context=system_u:object_r:httpd_sys_content_t:s0 /dev/somedevice 
>  /mnt/somemountpoint
>  
>  But the resulting context on files within the mount is 
>  still: system_u:object_r:fusefs_t:s0 
Open a bug on this, again on an OS that is
supported.

I would just add allow rules using audit2allow for now.

# grep http /var/log/audit/audit.log | audit2allow -M myhttp
# semodule -i myhttp.pp

>  The mount itself doesn't generate any noteworthy warnings/errors
> in my logs.
>  So of course seliux disallows apache to read the files and generates 
>  corresponding denials in my logs.
>  No other partition on this device is already mounted.
>  
>  Is this a known bug?
>  Others seem to have similar issues:
>  http://old.nabble.com/mounting-nfs-as-httpd_sys_content_t-under-selinux-t...
>  
>  http://forums.fedoraforum.org/archive/index.php/t-246937.html
>
> http://old.nabble.com/SELinux-enforcing,-an-external-ntfs-3g-mount,-Samba...
>  
>  
>  I guess an alternative is to create a policy that tells selinux to allow httpd 
>  to read fuse files, as is described here:
>  https://bugzilla.redhat.com/show_bug.cgi?id=631616#c2
>  
>  Any ideas?
>  
>  Thanks
>  
>  
>        
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.16 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkyIzKEACgkQrlYvE4MpobM3XwCfaRvhpwGXloNJ5WHU59HVb3sO
> 1WUAoIFK6U7TAFcc8EY4UI0yJFlib/zW
> =G6S8
> -----END PGP SIGNATURE-----

[Chris Lopes]

I am not able to update to a supported release at this time.

I will try audit2allow, as you have suggested


----- Original Message ----
From: Daniel J Walsh <dwalsh(a)redhat.com&gt;
To: Chris Lopes <clopes(a)yahoo.com&gt;
Cc: selinux(a)lists.fedoraproject.org
Sent: Thu, September 9, 2010 7:01:37 PM
Subject: Re: Giving httpd access to a mounted NTFS volume

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/09/2010 07:46 AM, Chris Lopes wrote:
>  Hi,
>  
>  I am using selinux under Fedora 10 (2.6.27.37).
>  I have Apache httpd running, and I would like it to be able to serve requests 
>  for files which are on a mounted NTFS volume.
>   
First off, please update to a Fedora Release that is supported F12, F13,
F14.


>  I have tried to mount the volume with an appropriate context:
>  mount -o context=system_u:object_r:httpd_sys_content_t:s0 /dev/somedevice 
>  /mnt/somemountpoint
>  
>  But the resulting context on files within the mount is 
>  still: system_u:object_r:fusefs_t:s0 
Open a bug on this, again on an OS that is
supported.

I would just add allow rules using audit2allow for now.

# grep http /var/log/audit/audit.log | audit2allow -M myhttp
# semodule -i myhttp.pp

>  The mount itself doesn't generate any noteworthy warnings/errors
> in my logs.
>  So of course seliux disallows apache to read the files and generates 
>  corresponding denials in my logs.
>  No other partition on this device is already mounted.
>  
>  Is this a known bug?
>  Others seem to have similar issues:
> http://old.nabble.com/mounting-nfs-as-httpd_sys_content_t-under-selinux-t...
> l
>  
>  http://forums.fedoraforum.org/archive/index.php/t-246937.html
> http://old.nabble.com/SELinux-enforcing,-an-external-ntfs-3g-mount,-Samba...
> l
>  
>  
>  I guess an alternative is to create a policy that tells selinux to allow httpd  
>  to read fuse files, as is described here:
>  https://bugzilla.redhat.com/show_bug.cgi?id=631616#c2
>  
>  Any ideas?
>  
>  Thanks
>  
>  
>       
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.16 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkyIzKEACgkQrlYvE4MpobM3XwCfaRvhpwGXloNJ5WHU59HVb3sO
> 1WUAoIFK6U7TAFcc8EY4UI0yJFlib/zW
> =G6S8
> -----END PGP SIGNATURE-----

[Cristian Ciupitu]

>  From: Chris Lopes <clopes(a)yahoo.com&gt;
>  Subject: Giving httpd access to a mounted NTFS volume
>  To: selinux(a)lists.fedoraproject.org
>  Date: Thursday, September 9, 2010, 2:46 PM
>  Hi,
>  
>  I am using selinux under Fedora 10 (2.6.27.37).
>  I have Apache httpd running, and I would like it to be able
>  to serve requests 
>  for files which are on a mounted NTFS volume.
>  
>  I have tried to mount the volume with an appropriate
>  context:
>  mount -o context=system_u:object_r:httpd_sys_content_t:s0
>  /dev/somedevice 
>  /mnt/somemountpoint
>  
>  But the resulting context on files within the mount is 
>  still: system_u:object_r:fusefs_t:s0
>  The mount itself doesn't generate any noteworthy
>  warnings/errors in my logs.
>  So of course seliux disallows apache to read the files and
>  generates 
>  corresponding denials in my logs.
>  No other partition on this device is already mounted.
>  
>  Is this a known bug? 
https://bugzilla.redhat.com/show_bug.cgi?id=502946

Cheers,
Cristian

[Chris Lopes]

Great, thanks for the confirmation.
The audit2allow way works fine.


----- Original Message ----
From: Cristian Ciupitu <cristian.ciupitu(a)yahoo.com&gt;
To: selinux(a)lists.fedoraproject.org; Chris Lopes <clopes(a)yahoo.com&gt;
Sent: Thu, September 9, 2010 7:27:12 PM
Subject: Re: Giving httpd access to a mounted NTFS volume

>  From: Chris Lopes <clopes(a)yahoo.com&gt;
>  Subject: Giving httpd access to a mounted NTFS volume
>  To: selinux(a)lists.fedoraproject.org
>  Date: Thursday, September 9, 2010, 2:46 PM
>  Hi,
>  
>  I am using selinux under Fedora 10 (2.6.27.37).
>  I have Apache httpd running, and I would like it to be able
>  to serve requests 
>  for files which are on a mounted NTFS volume.
>  
>  I have tried to mount the volume with an appropriate
>  context:
>  mount -o context=system_u:object_r:httpd_sys_content_t:s0
>  /dev/somedevice 
>  /mnt/somemountpoint
>  
>  But the resulting context on files within the mount is 
>  still: system_u:object_r:fusefs_t:s0
>  The mount itself doesn't generate any noteworthy
>  warnings/errors in my logs.
>  So of course seliux disallows apache to read the files and
>  generates 
>  corresponding denials in my logs.
>  No other partition on this device is already mounted.
>  
>  Is this a known bug? 
https://bugzilla.redhat.com/show_bug.cgi?id=502946

Cheers,
Cristian