<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv=Content-Type content="text/html; charset=us-ascii"> <meta name=Generator content="Microsoft Word 11 (filtered medium)"> <style>  </style>  </head> <body lang=DE link=blue vlink=purple> <div class=Section1> Hello<o:p></o:p> <o:p> </o:p> I’m running Fedora Core 5 Server with unionfs file system to merge some directories and export them through nfs. SELinux is in enforcing mode and the targeted-policy is selected. Unionfs is build with extended attributes support (EXTRACFLAGS=-DUNIONFS_XATTR).<o:p></o:p> When I try to mount the union from a client I get a permission denied error from server.<o:p></o:p> The following is in my /var/log/messages on the server:<o:p></o:p> <o:p> </o:p> Nov 1 10:32:43 localhost kernel: SELinux: initialized (dev unionfs, type unionfs), not configured for labeling<o:p></o:p> Nov 1 10:32:43 localhost kernel: audit(1162373563.375:109): avc: denied { getattr } for pid=2021 comm="hald" name="/" dev=unionfs ino=744 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir<o:p></o:p> Nov 1 10:50:57 localhost kernel: audit(1162374657.604:110): avc: denied { getattr } for pid=1810 comm="rpc.mountd" name="/" dev=unionfs ino=744 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir<o:p></o:p> Nov 1 10:50:57 localhost mountd[1810]: authenticated mount request from 192.168.1.13:1011 for /test (/test)<o:p></o:p> Nov 1 10:50:57 localhost kernel: audit(1162374657.632:111): avc: denied { getattr } for pid=1810 comm="rpc.mountd" name="/" dev=unionfs ino=744 scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir<o:p></o:p> Nov 1 10:50:57 localhost mountd[1810]: can't stat exported dir /test: Permission denied<o:p></o:p> <o:p> </o:p> For the Red Hat Enterprise Linux there is a workaround: <o:p></o:p> <pre> 1. Install strict/targetted selinux policy sources<o:p></o:p></pre><pre> 2. Open /etc/selinux/<policy_type>/src/policy/fs_use<o:p></o:p></pre><pre> 3. Append "fs_use_xattr unionfs system_u:object_r:fs_t;"<o:p></o:p></pre> 4. Compile, install, and reload the selinux policy <o:p></o:p> <o:p> </o:p> How can I adopt the workaround to work on Fedora 5, because there are no policy sources available?<o:p></o:p> How can I define "fs_use_xattr unionfs system_u:object_r:fs_t;" on Fedora Core 5?<o:p></o:p> <o:p> </o:p> Thanks!<o:p></o:p> <o:p> </o:p> Andreas Sachs<o:p></o:p> <o:p> </o:p> </div> </body> </html>