selinux: rhel5 x fedora 14

[Stephen Smalley]

On Thu, 2011-01-13 at 18:21 -0200, Paulo Cavalcanti wrote:
> 
> 
> On Thu, Jan 13, 2011 at 12:47 PM, Stephen Smalley <sds at tycho.nsa.gov>
> wrote:
>         On Thu, 2011-01-13 at 09:12 -0500, Stephen Smalley wrote:
>         > On Thu, 2011-01-13 at 11:51 -0200, Paulo Cavalcanti wrote:
>         >
>         > > Here it goes:
>         >
>         > > ----
>         > > type=SYSCALL msg=audit(01/13/2011 07:31:09.287:39) :
>         arch=x86_64
>         > > syscall=lstat success=no exit=-13(Permission denied)
>         a0=7ff594509d50
>         > > a1=7ffff3924c40 a2=7ffff3924c40 a3=2f534d50522f6c6d
>         items=0 ppid=2230
>         > > pid=2270 auid=unset uid=apache gid=apache euid=apache
>         suid=apache
>         > > fsuid=apache egid=apache sgid=apache fsgid=apache
>         tty=(none) ses=unset
>         > > comm=httpd exe=/usr/sbin/httpd
>         subj=system_u:system_r:httpd_t:s0
>         > > key=(null)
>         > > type=AVC msg=audit(01/13/2011 07:31:09.287:39) : avc:
>          denied
>         > > { getattr } for  pid=2270 comm=httpd
>         > > path=/home/packages/rpms/myrpms-el5-x86_64/repodata
>         dev=sda4
>         > > ino=31331129 scontext=system_u:system_r:httpd_t:s0
>         > > tcontext=system_u:object_r:file_t:s0 tclass=dir
>         >
>         > Was this while running RHEL-5 or F-14?  Is /home mounted
>         with a context=
>         > mount option?  What does 'mount' show for /home
>         and/or /home/packages
>         > (if a separate mount)?
>         
>         
>         Oh, and under what OS were those files created?  RHEL-5 or
>         F-14?
>         
>         
>         
> 
> The files were created in rhel5 and /home there was mounted using the
> context I posted before: 
> 
> LABEL=/home             /home                   ext4
> defaults,context=user_u:
> object_r:user_home_t:s0        1 2 
> 
> The avc denial was produced when reading the created files on F14.
> 
> Basically, what I did was:
> 
> 1) I booted on rhel5, and updated my rhel5 RPM repo (createrepo
> +repoview).
> 
> 2) I booted on F14 again and tried to use mock to create some rhel5
> rpms
> accessing the local repo updated on step 1.
> 
> 3) I reset the context on F14, and mock could access the files
> normally.
> 
> I have two different users, with the same ID (500), in fedora 14 and
> rhel5,
> and basically these users share some directories in /home used for
> keeping rpms,
> and a few directories accessed by httpd, and kept in the home of the
> fedora user.

Ok, your options are:
1) Use a context= mount on both RHEL-5 and F-14.  Then it won't use
on-disk contexts at all under either OS for those files.
-or-
2) Use the context= mount only under RHEL-5, but run restorecon on /home
(or at least on any locations where files might have been created when
running RHEL-5) under F-14 before you try accessing the files there.

-- 
Stephen Smalley
National Security Agency