On Sun, 2006-04-16 at 22:47 +0300, Lauri wrote:
Hi!
With SELinux enabled, the system won't mount ReiserFS partitions,
SELinux will deny it:
Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: found reiserfs
format "3.6" with standard journal
Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: using ordered data mode
Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: journal params:
device hdb1, size 8192, journal first block 18, max trans len 1024, max
batch 900, max commit age 30, max trans age 30
Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: checking
transaction log (hdb1)
Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: Using r5 hash to
sort names
Apr 15 14:19:38 localhost kernel: audit(1145099700.155:2): avc:
denied { search } for pid=1278 comm="mount" name="/" dev=hdb1 ino=2
scontext=system_u:system_r:mount_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir
Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: warning:
xattrs/ACLs enabled and couldn't find/create .reiserfs_priv. Failing mount.
and mount will output:
mount: Operation not supported
Added fedora-selinux-list to the cc line.
SELinux and the reiserfs xattr implementation (xattrs stored as regular
files) don't get along presently. There are a couple of problems, one
related to mount-time initialization (as above) since reiserfs ends up
trying to search the root directory for the xattr root before SELinux
has a chance to set up its security label incore, and one related to
atomic labeling of new inodes. If you are using reiserfs for your
primary filesystems (e.g. /, /usr, ...), then you likely just have to
disable SELinux. If you are only using it for e.g. /home or other kinds
of data repositories that can be handled at a single security label
(with some loss in granularity of control), you may be able to get by
via a local policy module and a context mount, details below.
You can workaround the above specific denial by creating a policy
module, ala:
$ mkdir reiser
$ cd reiser
$ vi reiser.te
i(nsert)
# Declare the policy module, with a name and version.
policy_module(reiser, 1.0)
# Tell the module infrastructure what we need from the base policy
# or other previously inserted modules.
require {
# Need these two types to already be defined.
type mount_t;
type unlabeled_t;
};
# Define the content of the actual policy module.
# In this case, just a single allow rule.
allow mount_t unlabeled_t:dir search;
:wq
$ make -f /usr/share/selinux/devel/Makefile
$ su
# /usr/sbin/semodule -i reiser.pp
This will add the permission required to search the root directory for
the xattr subtree. (audit2allow also can be used to generate such
modules, via the -M option).
Then, you likely want to do a context mount to force all files in the
reiserfs filesystem to a single label, because reiserfs doesn't support
proper labeling of new inodes yet. Ala:
# mount -o context=system_u:object_r:default_t:s0 <dirname>
But replacing default_t with some type appropriate to the data stored
there. If that works, then you'll want to add the context= option to
your fstab file for future mounting.
To try that I enabled SELinux again. It relabelled the system and now
gives new error:
Apr 17 18:33:08 localhost kernel: [drm] Loading R200 Microcode
Apr 17 18:33:10 localhost kernel: audit(1145287990.371:10): avc:
denied { execmod } for pid=3964 comm="metacity" name="libGL.so.1.2"
dev=hda5 ino=1235892 scontext=user_u:system_r:unconfined_t:s0
tcontext=system_u:object_r:lib_t:s0 tclass=file
As I understand, it tries to load some files from /usr/lib/ati-fglrx.
GNOME fails to start.
I'm using ext3 for / and reiserfs for some additional partitions
(/data1, /data2).
Lauri
SELinux also denys loading of some *.so files, for example a script of
XChat, I used following code to correct it:
chcon -t texrel_shlib_t /usr/lib/xhat/*.so
But this gets reset after reboot.
It shouldn't be reset upon reboot unless a relabel occurred.
Is /usr/lib on a reiserfs filesystem? If so, that is the problem.
If not, then you can make the above change permanent across
relabels/policy updates via semanage, e.g.
# /usr/sbin/semanage fcontext -a -t textrel_shlib_t '/usr/lib/xhat/.*\.so(\.[^/]*)*
Then a /sbin/restorecon -Rv /usr/lib/xhat shouldn't disturb those
settings.
During shutdown, umount will fail if the name of the CD contains a
whitespace. Something like this is used (from /etc/mtab):
/media/Led\040Zeppelin
When logging out, saving a session isn't offered as it was in FC4, so,
in order to save the session, I have to switch on automatic saving, log
out and then switch it off again.
Running on FC5, kernel 2.6.16-1.2080_FC5 or
2.6.16-1.2080_2.rhfc5.cubbi_suspend2 (does it make any difference?).
