Mount & SELinux problems, session saving in GNOME

[Stephen Smalley]

On Sun, 2006-04-16 at 22:47 +0300, Lauri wrote:
> Hi!
> 
> With SELinux enabled, the system won't mount ReiserFS partitions,
> SELinux will deny it:
> 
>    Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: found reiserfs 
> format "3.6" with standard journal
>    Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: using ordered data mode
>    Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: journal params: 
> device hdb1, size 8192, journal first block 18, max trans len 1024, max 
> batch 900, max commit age 30, max trans age 30
>    Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: checking 
> transaction log (hdb1)
>    Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: Using r5 hash to 
> sort names
>    Apr 15 14:19:38 localhost kernel: audit(1145099700.155:2): avc: 
> denied  { search } for  pid=1278 comm="mount" name="/" dev=hdb1 ino=2 
> scontext=system_u:system_r:mount_t:s0 
> tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir
>    Apr 15 14:19:38 localhost kernel: ReiserFS: hdb1: warning: 
> xattrs/ACLs enabled and couldn't find/create .reiserfs_priv. Failing mount.
> 
> and mount will output:
> 
>    mount: Operation not supported

Added fedora-selinux-list to the cc line.
SELinux and the reiserfs xattr implementation (xattrs stored as regular
files) don't get along presently.  There are a couple of problems, one
related to mount-time initialization (as above) since reiserfs ends up
trying to search the root directory for the xattr root before SELinux
has a chance to set up its security label incore, and one related to
atomic labeling of new inodes.  If you are using reiserfs for your
primary filesystems (e.g. /, /usr, ...), then you likely just have to
disable SELinux.  If you are only using it for e.g. /home or other kinds
of data repositories that can be handled at a single security label
(with some loss in granularity of control), you may be able to get by
via a local policy module and a context mount, details below. 

You can workaround the above specific denial by creating a policy
module, ala:
$ mkdir reiser
$ cd reiser
$ vi reiser.te
i(nsert)
# Declare the policy module, with a name and version.
policy_module(reiser, 1.0)

# Tell the module infrastructure what we need from the base policy 
# or other previously inserted modules.
require {
	# Need these two types to already be defined.
	type mount_t;
	type unlabeled_t;
};

# Define the content of the actual policy module.
# In this case, just a single allow rule.
allow mount_t unlabeled_t:dir search;
:wq
$ make -f /usr/share/selinux/devel/Makefile
$ su 
# /usr/sbin/semodule -i reiser.pp

This will add the permission required to search the root directory for
the xattr subtree.   (audit2allow also can be used to generate such
modules, via the -M option).

Then, you likely want to do a context mount to force all files in the
reiserfs filesystem to a single label, because reiserfs doesn't support
proper labeling of new inodes yet.  Ala:
# mount -o context=system_u:object_r:default_t:s0 <dirname>

But replacing default_t with some type appropriate to the data stored
there.  If that works, then you'll want to add the context= option to
your fstab file for future mounting.

> SELinux also denys loading of some *.so files, for example a script of
> XChat, I used following code to correct it:
> 
>    chcon -t texrel_shlib_t /usr/lib/xhat/*.so
> 
> But this gets reset after reboot.

It shouldn't be reset upon reboot unless a relabel occurred.
Is /usr/lib on a reiserfs filesystem?  If so, that is the problem.
If not, then you can make the above change permanent across
relabels/policy updates via semanage, e.g.
# /usr/sbin/semanage fcontext -a -t textrel_shlib_t '/usr/lib/xhat/.*\.so(\.[^/]*)*

Then a /sbin/restorecon -Rv /usr/lib/xhat shouldn't disturb those
settings.

> During shutdown, umount will fail if the name of the CD contains a
> whitespace. Something like this is used (from /etc/mtab):
> 
>    /media/Led\040Zeppelin
> 
> 
> When logging out, saving a session isn't offered as it was in FC4, so,
> in order to save the session, I have to switch on automatic saving, log
> out and then switch it off again.
> 
> 
> Running on FC5, kernel 2.6.16-1.2080_FC5 or
> 2.6.16-1.2080_2.rhfc5.cubbi_suspend2 (does it make any difference?).

-- 
Stephen Smalley
National Security Agency