Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using the Fedora 12 pam_mount / libHX RPMs on a RHEL 6 x86_64 system to automatically mount home directories from a NetApp system configured with NTFS-only security

AD-bound logins work fine - I'm having problems with making it automatically mount and map user homedir shares. It complains of permission denied initially, but then I can cd to the home directory fine.

$ ssh username@hostname

NOTE: This system is for the use of authorized users only

username@hostname's password: 
Last login: Mon Feb 27 10:54:09 2012 from another.hostname
Could not chdir to home directory /home/AD/username: Permission denied
-bash-4.1$ cd
-bash-4.1$ pwd

This is the /etc/security/pam_mount.conf.xml:

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
  <mntoptions allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other,workgroup,nosetuids,noexec,nosuid,noserverino" />
  <mntoptions require="nosuid,nodev" />
  <logout wait="2" hup="0" term="yes" kill="0" />
  <mkmountpoint enable="1" remove="true" />
  <debug enable="0" />
  <volume fstype="cifs" server="" path="%(USER)" mountpoint="/home/AD/%(USER)" options="workgroup=ad,uid=%(USER),dir_mode=0700,file_mode=0700,nosuid,nodev,noserverino" />

This is /etc/pam.d/password-auth:

# cat /etc/pam.d/password-auth
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required
auth        required
auth        sufficient nullok try_first_pass
auth        requisite uid >= 500 quiet
auth        sufficient use_first_pass
auth        sufficient use_first_pass
auth        required

account     required
account     required broken_shadow
account     sufficient
account     sufficient uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore]
account     [default=bad success=ok user_unknown=ignore]
account     required

password    requisite try_first_pass retry=3 type=
password    sufficient sha512 shadow nullok try_first_pass use_authtok
password    sufficient use_authtok
password    sufficient use_authtok
password    required

session     optional revoke
session     required
session     optional
session     [success=1 default=ignore] service in crond quiet use_uid
session     required
session     optional
session     optional

At login time, I see the following error in /var/log/messages:

Feb 27 14:28:49 hostname kernel: type=1400 audit(1330381729.009:4304): avc:  denied  { search } for  pid=3855 comm="sshd" name="/" dev=cifs ino=143 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cifs_t:s0 tclass=dir

Just turning off SELinux isn't an option - I'd like to work out how to fix it, as I assume this is the root cause. Can someone give me some pointers?

share|improve this question
up vote 0 down vote accepted

There doesnt appear to be any relevent policy that permits this by default. This is because pam is loading modules in the sshd_t context and trying to do funky stuff not normally associated with something sshd_t types should be doing.

To fix this stick the below in a file, probably calling it mysshd.te;

policy_module(mysshd, 0.0.1)

    type cifs_t;
    type sshd_t;

read_files_pattern(sshd_t, cifs_t, cifs_t, { file, dir})
# If that doesnt work, try this
#manage_files_pattern(sshd_t, cifs_t, cifs_t {file, dir})

Compile it by running the following command:

make -f /usr/share/selinux/devel/Makefile

To make it and load it:

make -f /usr/share/selinux/devel/Makefile load

Then, try again.

share|improve this answer
That worked perfectly! Thank you very much – theducks Feb 29 '12 at 18:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.