selinux: rhel5 x fedora 14

[Paulo Cavalcanti]

On Thu, Jan 13, 2011 at 12:47 PM, Stephen Smalley <sds at tycho.nsa.gov> wrote:

> On Thu, 2011-01-13 at 09:12 -0500, Stephen Smalley wrote:
> > On Thu, 2011-01-13 at 11:51 -0200, Paulo Cavalcanti wrote:
> >
> > > Here it goes:
> >
> > > ----
> > > type=SYSCALL msg=audit(01/13/2011 07:31:09.287:39) : arch=x86_64
> > > syscall=lstat success=no exit=-13(Permission denied) a0=7ff594509d50
> > > a1=7ffff3924c40 a2=7ffff3924c40 a3=2f534d50522f6c6d items=0 ppid=2230
> > > pid=2270 auid=unset uid=apache gid=apache euid=apache suid=apache
> > > fsuid=apache egid=apache sgid=apache fsgid=apache tty=(none) ses=unset
> > > comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0
> > > key=(null)
> > > type=AVC msg=audit(01/13/2011 07:31:09.287:39) : avc:  denied
> > > { getattr } for  pid=2270 comm=httpd
> > > path=/home/packages/rpms/myrpms-el5-x86_64/repodata dev=sda4
> > > ino=31331129 scontext=system_u:system_r:httpd_t:s0
> > > tcontext=system_u:object_r:file_t:s0 tclass=dir
> >
> > Was this while running RHEL-5 or F-14?  Is /home mounted with a context=
> > mount option?  What does 'mount' show for /home and/or /home/packages
> > (if a separate mount)?
>
> Oh, and under what OS were those files created?  RHEL-5 or F-14?
>
>
The files were created in rhel5 and /home there was mounted using the
context I posted before:

LABEL=/home             /home                   ext4
defaults,context=user_u:
object_r:user_home_t:s0        1 2

The avc denial was produced when reading the created files on F14.

Basically, what I did was:

1) I booted on rhel5, and updated my rhel5 RPM repo (createrepo+repoview).

2) I booted on F14 again and tried to use mock to create some rhel5 rpms
accessing the local repo updated on step 1.

3) I reset the context on F14, and mock could access the files normally.

I have two different users, with the same ID (500), in fedora 14 and rhel5,
and basically these users share some directories in /home used for keeping
rpms,
and a few directories accessed by httpd, and kept in the home of the fedora
user.



-- 
Paulo Roma Cavalcanti
LCG - UFRJ
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.fedoraproject.org/pipermail/devel/attachments/20110113/669a246b/attachment.html