SELinux enforcing, an external ntfs-3g mount, Samba and Fedora 8

[Craig Niederberger]

Hi Fedora SELinux gurus, question from a very perplexed newbie.

I'm trying to access an external ntfs-3g drive from vmware on Fedora,
with the drive seen through vmware as a networked samba drive.  I have
Fedora 8 as the host, VMware Workstation 6.0.2 with Windows XP Pro as
the guest OS, and SELinux set to enforcing.

I have the host visible as a networked drive in My Network Places on
the guest, and can access files in my Fedora 8 home directory, so
SELinux is at least allowing that.

The external ntfs-3g drive that I'd like to also access is visible in
My Network Places on the guest. However, whenever I click on it, I get
an SELinux AVC Denial, which says SELinux is preventing the samba
daemon from serving r/o local files to remote clients, and tells me
that I need to turn on the samba_export_all_ro boolean, which is
already on.

The raw audit message that I get in the SELinux popup is:
avc: denied { read } for comm=smbd dev=sdd1 name=/ pid=4347
scontext=system_u:system_r:smbd_t:s0 tclass=dir
tcontext=system_u:object_r:fusefs_t:s0

I have mounted the ntfs-3g drive so that it matches the ownership of
my home drive, e.g. the fstab entry is:
/dev/sdd1 /mnt/media ntfs-3g rw,locale=en_US.utf8,uid=500,gid=1000 0 0
$ ls -al media
total 233
drwxrwxrwx 1 craign family 4096 2007-12-12 23:04 .
drwxr-xr-x 6 root root 4096 2007-12-02 14:13 ..
drwxrwxrwx 1 craign family 0 2007-09-16 11:31 Craig
...

Can anyone help?

Many TIA,
Craig

[Josef Kubin]

Hello Craig,

Craig Niederberger wrote:
>  Hi Fedora SELinux gurus, question from a very perplexed newbie.
>  
>  I'm trying to access an external ntfs-3g drive from vmware on Fedora,
>  with the drive seen through vmware as a networked samba drive.  I have
>  Fedora 8 as the host, VMware Workstation 6.0.2 with Windows XP Pro as
>  the guest OS, and SELinux set to enforcing.
>  
>  I have the host visible as a networked drive in My Network Places on
>  the guest, and can access files in my Fedora 8 home directory, so
>  SELinux is at least allowing that.
>  
>  The external ntfs-3g drive that I'd like to also access is visible in
>  My Network Places on the guest. However, whenever I click on it, I get
>  an SELinux AVC Denial, which says SELinux is preventing the samba
>  daemon from serving r/o local files to remote clients, and tells me
>  that I need to turn on the samba_export_all_ro boolean, which is
>  already on.
>  
>  The raw audit message that I get in the SELinux popup is:
>  avc: denied { read } for comm=smbd dev=sdd1 name=/ pid=4347
>  scontext=system_u:system_r:smbd_t:s0 tclass=dir
>  tcontext=system_u:object_r:fusefs_t:s0
>  
>  I have mounted the ntfs-3g drive so that it matches the ownership of
>  my home drive, e.g. the fstab entry is:
>  /dev/sdd1 /mnt/media ntfs-3g rw,locale=en_US.utf8,uid=500,gid=1000 0 0 
Did you tried to mount your drive with proper context?

/dev/sdd1 /mnt/media ntfs-3g 
rw,locale=en_US.utf8,uid=500,gid=1000,context=system_u:system_r:samba_share_t 
0 0

>  $ ls -al media
>  total 233
>  drwxrwxrwx 1 craign family 4096 2007-12-12 23:04 .
>  drwxr-xr-x 6 root root 4096 2007-12-02 14:13 ..
>  drwxrwxrwx 1 craign family 0 2007-09-16 11:31 Craig
>  ...
>  
>  Can anyone help?
>  
>  Many TIA,
>  Craig
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Cheers,
Josef Kubin

[Craig Niederberger]

Thanks for answering my post, Josef.  Unfortunately, I'm getting
exactly the same AVC denial and message when trying to access the
drive from vmware.  The odd thing is, I can access my home directory
from vmware without problem.  The /etc/fstab entry now reads:

/dev/sdd1 /mnt/media ntfs-3g
rw,locale=en_US.utf8,uid=500,gid=1000,context=system_u:system_r:samba_share_t
0 0

Thanks,
Craig

On Dec 15, 2007 7:10 PM, Josef Kubin <jkubin(a)redhat.com&gt; wrote:
>  Hello Craig,
>
>  Craig Niederberger wrote:
>  > Hi Fedora SELinux gurus, question from a very perplexed newbie.
>  >
>  > I'm trying to access an external ntfs-3g drive from vmware on Fedora,
>  > with the drive seen through vmware as a networked samba drive.  I have
>  > Fedora 8 as the host, VMware Workstation 6.0.2 with Windows XP Pro as
>  > the guest OS, and SELinux set to enforcing.
>  >
>  > I have the host visible as a networked drive in My Network Places on
>  > the guest, and can access files in my Fedora 8 home directory, so
>  > SELinux is at least allowing that.
>  >
>  > The external ntfs-3g drive that I'd like to also access is visible in
>  > My Network Places on the guest. However, whenever I click on it, I get
>  > an SELinux AVC Denial, which says SELinux is preventing the samba
>  > daemon from serving r/o local files to remote clients, and tells me
>  > that I need to turn on the samba_export_all_ro boolean, which is
>  > already on.
>  >
>  > The raw audit message that I get in the SELinux popup is:
>  > avc: denied { read } for comm=smbd dev=sdd1 name=/ pid=4347
>  > scontext=system_u:system_r:smbd_t:s0 tclass=dir
>  > tcontext=system_u:object_r:fusefs_t:s0
>  >
>  > I have mounted the ntfs-3g drive so that it matches the ownership of
>  > my home drive, e.g. the fstab entry is:
>  > /dev/sdd1 /mnt/media ntfs-3g rw,locale=en_US.utf8,uid=500,gid=1000 0 0
>
>  Did you tried to mount your drive with proper context?
>
>  /dev/sdd1 /mnt/media ntfs-3g
>  rw,locale=en_US.utf8,uid=500,gid=1000,context=system_u:system_r:samba_share_t
>  0 0
>
>  > $ ls -al media
>  > total 233
>  > drwxrwxrwx 1 craign family 4096 2007-12-12 23:04 .
>  > drwxr-xr-x 6 root root 4096 2007-12-02 14:13 ..
>  > drwxrwxrwx 1 craign family 0 2007-09-16 11:31 Craig
>  > ...
>  >
>  > Can anyone help?
>  >
>  > Many TIA,
>  > Craig
>  >
>
>  > --
>  > fedora-selinux-list mailing list
>  > fedora-selinux-list(a)redhat.com
>  > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
>  Cheers,
>  Josef Kubin
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>

[Josef Kubin]

Hi, it looks that you rediscovered a bug ...

Craig Niederberger wrote:
>  Thanks for answering my post, Josef.  Unfortunately, I'm getting
>  exactly the same AVC denial and message when trying to access the
>  drive from vmware.  The odd thing is, I can access my home directory
>  from vmware without problem.  The /etc/fstab entry now reads:
>  
>  /dev/sdd1 /mnt/media ntfs-3g
>  rw,locale=en_US.utf8,uid=500,gid=1000,context=system_u:system_r:samba_share_t
>  0 0 
I've tried to a little bit investigate things,
in this case the forced context is completely ignored ...

[root@localhost vmware]# ls -Z /mnt/
drwxr-xr-x  root root system_u:object_r:mnt_t:s0       foo

[root@localhost vmware]# mount -t ntfs-3g -o 
loop,offset=32256,context=blabla ntfsImg-flat /mnt/foo/

[root@localhost vmware]# ls -Z /mnt/
drwxrwxrwx  root root system_u:object_r:fusefs_t:s0    foo

[root@localhost vmware]# umount /mnt/foo/

[root@localhost vmware]# mount -t ntfs-3g -o 
context=blabla:bleble:blabla,loop,offset=32256 ntfsImg-flat /mnt/foo/

[root@localhost vmware]# ls -Z /mnt/
drwxrwxrwx  root root system_u:object_r:fusefs_t:s0    foo

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

But not in this case.

[root@localhost vmware]# cat /dev/zero > file
[root@localhost vmware]# mkfs.ext3 file
...
[root@localhost vmware]# mount -o 
loop,context=system_u:object_r:httpd_sys_content_t:s0 file /mnt/foo/

[root@localhost vmware]# ls -Z /mnt/
drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t:s0 foo

Similar bug(s) has been already reported.
https://bugzilla.redhat.com/show_bug.cgi?id=216846


Following command should help :-(

# setsebool -P samba_run_unconfined 1

Bye.
Josef

[Craig Niederberger]

sudo /usr/sbin/setsebool -P samba_run_unconfined 1

Strangely, exactly the same AVC denial.  Anything else I can try,
short of turning off SELinux, which I'd prefer not to do?

Many thanks,
Craig

On Dec 16, 2007 11:09 AM, Josef Kubin <jkubin(a)redhat.com&gt; wrote:
>  Hi, it looks that you rediscovered a bug ...
>
>  Craig Niederberger wrote:
>  > Thanks for answering my post, Josef.  Unfortunately, I'm getting
>  > exactly the same AVC denial and message when trying to access the
>  > drive from vmware.  The odd thing is, I can access my home directory
>  > from vmware without problem.  The /etc/fstab entry now reads:
>  >
>  > /dev/sdd1 /mnt/media ntfs-3g
>  > rw,locale=en_US.utf8,uid=500,gid=1000,context=system_u:system_r:samba_share_t
>  > 0 0
>
>  I've tried to a little bit investigate things,
>  in this case the forced context is completely ignored ...
>
>  [root@localhost vmware]# ls -Z /mnt/
>  drwxr-xr-x  root root system_u:object_r:mnt_t:s0       foo
>
>  [root@localhost vmware]# mount -t ntfs-3g -o
>  loop,offset=32256,context=blabla ntfsImg-flat /mnt/foo/
>
>  [root@localhost vmware]# ls -Z /mnt/
>  drwxrwxrwx  root root system_u:object_r:fusefs_t:s0    foo
>
>  [root@localhost vmware]# umount /mnt/foo/
>
>  [root@localhost vmware]# mount -t ntfs-3g -o
>  context=blabla:bleble:blabla,loop,offset=32256 ntfsImg-flat /mnt/foo/
>
>  [root@localhost vmware]# ls -Z /mnt/
>  drwxrwxrwx  root root system_u:object_r:fusefs_t:s0    foo
>
>  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>  But not in this case.
>
>  [root@localhost vmware]# cat /dev/zero > file
>  [root@localhost vmware]# mkfs.ext3 file
>  ...
>  [root@localhost vmware]# mount -o
>  loop,context=system_u:object_r:httpd_sys_content_t:s0 file /mnt/foo/
>
>  [root@localhost vmware]# ls -Z /mnt/
>  drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t:s0 foo
>
>  Similar bug(s) has been already reported.
>  https://bugzilla.redhat.com/show_bug.cgi?id=216846
>
>
>  Following command should help :-(
>
>  # setsebool -P samba_run_unconfined 1
>
>  Bye.
>  Josef
>
>
>

[Chris Danezis]

I am facing the exact same issues, not only when dealing with ntfs-3g
drives, but with my RAID hard drive and my external drive also (both mounted
as vfat). I went through all the aforementioned steps and I still haven't
managed to resolve the issue.

On Dec 17, 2007 1:27 AM, Craig Niederberger <craignied(a)gmail.com&gt; wrote:

>  sudo /usr/sbin/setsebool -P samba_run_unconfined 1
>
>  Strangely, exactly the same AVC denial.  Anything else I can try,
>  short of turning off SELinux, which I'd prefer not to do?
>
>  Many thanks,
>  Craig
>
>  On Dec 16, 2007 11:09 AM, Josef Kubin <jkubin(a)redhat.com&gt; wrote:
>  > Hi, it looks that you rediscovered a bug ...
>  >
>  > Craig Niederberger wrote:
>  > > Thanks for answering my post, Josef.  Unfortunately, I'm getting
>  > > exactly the same AVC denial and message when trying to access the
>  > > drive from vmware.  The odd thing is, I can access my home directory
>  > > from vmware without problem.  The /etc/fstab entry now reads:
>  > >
>  > > /dev/sdd1 /mnt/media ntfs-3g
>  > >
>  rw,locale=en_US.utf8,uid=500,gid=1000,context=system_u:system_r:samba_share_t
>  > > 0 0
>  >
>  > I've tried to a little bit investigate things,
>  > in this case the forced context is completely ignored ...
>  >
>  > [root@localhost vmware]# ls -Z /mnt/
>  > drwxr-xr-x  root root system_u:object_r:mnt_t:s0       foo
>  >
>  > [root@localhost vmware]# mount -t ntfs-3g -o
>  > loop,offset=32256,context=blabla ntfsImg-flat /mnt/foo/
>  >
>  > [root@localhost vmware]# ls -Z /mnt/
>  > drwxrwxrwx  root root system_u:object_r:fusefs_t:s0    foo
>  >
>  > [root@localhost vmware]# umount /mnt/foo/
>  >
>  > [root@localhost vmware]# mount -t ntfs-3g -o
>  > context=blabla:bleble:blabla,loop,offset=32256 ntfsImg-flat /mnt/foo/
>  >
>  > [root@localhost vmware]# ls -Z /mnt/
>  > drwxrwxrwx  root root system_u:object_r:fusefs_t:s0    foo
>  >
>  > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>  >
>  > But not in this case.
>  >
>  > [root@localhost vmware]# cat /dev/zero > file
>  > [root@localhost vmware]# mkfs.ext3 file
>  > ...
>  > [root@localhost vmware]# mount -o
>  > loop,context=system_u:object_r:httpd_sys_content_t:s0 file /mnt/foo/
>  >
>  > [root@localhost vmware]# ls -Z /mnt/
>  > drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t:s0 foo
>  >
>  > Similar bug(s) has been already reported.
>  > https://bugzilla.redhat.com/show_bug.cgi?id=216846
>  >
>  >
>  > Following command should help :-(
>  >
>  > # setsebool -P samba_run_unconfined 1
>  >
>  > Bye.
>  > Josef
>  >
>  >
>  >
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Chris Danezis wrote:
>  I am facing the exact same issues, not only when dealing with
> ntfs-3g
>  drives, but with my RAID hard drive and my external drive also (both mounted
>  as vfat). I went through all the aforementioned steps and I still haven't
>  managed to resolve the issue.
>  
>  On Dec 17, 2007 1:27 AM, Craig Niederberger <craignied(a)gmail.com&gt; wrote:
>  
> > sudo /usr/sbin/setsebool -P samba_run_unconfined 1
> >
> > Strangely, exactly the same AVC denial.  Anything else I can try,
> > short of turning off SELinux, which I'd prefer not to do?
> >
> > Many thanks,
> > Craig
> >
> > On Dec 16, 2007 11:09 AM, Josef Kubin <jkubin(a)redhat.com&gt; wrote:
> >> Hi, it looks that you rediscovered a bug ...
> >>
> >> Craig Niederberger wrote:
> >>> Thanks for answering my post, Josef.  Unfortunately, I'm getting
> >>> exactly the same AVC denial and message when trying to access the
> >>> drive from vmware.  The odd thing is, I can access my home directory
> >>> from vmware without problem.  The /etc/fstab entry now reads:
> >>>
> >>> /dev/sdd1 /mnt/media ntfs-3g
> >>>
> > rw,locale=en_US.utf8,uid=500,gid=1000,context=system_u:system_r:samba_share_t
> >>> 0 0
> >> I've tried to a little bit investigate things,
> >> in this case the forced context is completely ignored ...
> >>
> >> [root@localhost vmware]# ls -Z /mnt/
> >> drwxr-xr-x  root root system_u:object_r:mnt_t:s0       foo
> >>
> >> [root@localhost vmware]# mount -t ntfs-3g -o
> >> loop,offset=32256,context=blabla ntfsImg-flat /mnt/foo/
> >>
> >> [root@localhost vmware]# ls -Z /mnt/
> >> drwxrwxrwx  root root system_u:object_r:fusefs_t:s0    foo
> >>
> >> [root@localhost vmware]# umount /mnt/foo/
> >>
> >> [root@localhost vmware]# mount -t ntfs-3g -o
> >> context=blabla:bleble:blabla,loop,offset=32256 ntfsImg-flat /mnt/foo/
> >>
> >> [root@localhost vmware]# ls -Z /mnt/
> >> drwxrwxrwx  root root system_u:object_r:fusefs_t:s0    foo
> >>
> >> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >>
> >> But not in this case.
> >>
> >> [root@localhost vmware]# cat /dev/zero > file
> >> [root@localhost vmware]# mkfs.ext3 file
> >> ...
> >> [root@localhost vmware]# mount -o
> >> loop,context=system_u:object_r:httpd_sys_content_t:s0 file /mnt/foo/
> >>
> >> [root@localhost vmware]# ls -Z /mnt/
> >> drwxr-xr-x  root root system_u:object_r:httpd_sys_content_t:s0 foo
> >>
> >> Similar bug(s) has been already reported.
> >> https://bugzilla.redhat.com/show_bug.cgi?id=216846
> >>
> >>
> >> Following command should help :-(
> >>
> >> # setsebool -P samba_run_unconfined 1
> >>
> >> Bye.
> >> Josef
> >>
> >>
> >>
> > --
> > fedora-selinux-list mailing list
> > fedora-selinux-list(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
>  
>  
>  ------------------------------------------------------------------------
>  
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list 
You can update your
policy to allow this

# grep fusefs_t /var/log/audit/audit.log | audit2allow -M mysamba
# semodule -i mysamba.pp

Then please open a bugzilla on this.  It might be a kernel problem.   Or
we can fix it in policy.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.8 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkd5WGAACgkQrlYvE4MpobOkHQCgomIisTsODRTk7fZhawRTNUtK
> zDQAoNJN/8ipYiE0WrqElrQIE8AUhqFJ
> =MygV
> -----END PGP SIGNATURE-----