1

I keep getting an 'Operation not supported' message when trying to update the security context type of my cifs mount. I'm using logrotate to push logs off my server to a network location but the context of the script thats execute on the cifs mount is 'system_u:object_r:cifs_t:s0'

Here are the mount flags for my cifs folder:

(rw,relatime,vers=1.0,cache=strict,username=cifsuser,domain=.,uid=1000,forceuid,gid=1000,forcegid,addr=10.1.3.97,file_mode=0755,dir_mode=0755,nounix,rsize=61440,wsize=16580,actimeo=1)

I had my logrotate running from a cron.hourly and everytime it tried to move files to this mount I would get a selinux policy error. I tried to run the following to resolve:

sealert -l b9263b3e-d2f9-4b33-ba48-af9b3b7695fd
grep logrotate /var/log/audit/audit.log | audit2allow -M mypol
semodule -i mypol.pp

But I still have problems and it no longer gives me the sealert errors in /var/log/messages. Checking my /var/log/audit/audit.log logs I see this:

type=SYSCALL msg=audit(1474114505.460:25005): arch=c000003e syscall=21 success=no exit=-13 a0=10f33a0 a1=4 a2=7ffd34025160 a3=7ffd34025080 items=0 ppid=16240 pid=16241 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2773 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1474114506.695:25006): avc:  denied  { read } for  pid=16386 comm="sh" name="archive_logs.sh" dev="cifs" ino=60235645016091360 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cifs_t:s0 tclass=file

Any help would be greatly appreciated.

Thanks

2

I expanded the policy given its a bug. Install the RPM selinux-devel if not already present and then paste this content into a file called mylogrotate.te.

policy_module(mylogrotate, 1.0.0)

require {
  type logrotate_t;
  type cifs_t;
}

gen_tunable(logrotate_use_cifs, false)

tunable_policy(`logrotate_use_cifs',`
  fs_read_cifs_files(logrotate_t)
')

After which, do the following:

$ make -f /usr/share/selinux/devel/Makefile load
$ semanage boolean --modify --off logrotate_use_cifs

That should allow policy to read the cifs files.

1

Parsing the AVC denial message with audit2allow, I get:

$ echo 'type=SYSCALL msg=audit(1474114505.460:25005): arch=c000003e syscall=21 success=no exit=-13 a0=10f33a0 a1=4 a2=7ffd34025160 a3=7ffd34025080 items=0 ppid=16240 pid=16241 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2773 comm="sh" exe="/usr/bin/bash" subj=system_u:system_r:logrotate_t:s0-s0:c0.c1023 key=(null) \
        type=AVC msg=audit(1474114506.695:25006): avc:  denied  { read } for  pid=16386 comm="sh" name="archive_logs.sh" dev="cifs" ino=60235645016091360 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=system_u:object_r:cifs_t:s0 tclass=file' \
| audit2allow

#============= logrotate_t ==============
allow logrotate_t cifs_t:file read;

My guess is that the CIFS mount is not correctly labelled, as the policy allows logrotate to read from cifs_t labelled files, as shown by sesearch:

$ sesearch -s logrotate_t -t cifs_t -p read --allow -c dir 
Found 1 semantic av rules:
  allow logrotate_t cifs_t : dir { ioctl read getattr lock search open } ;
  • 2
    I think the policy is flawed, as a broader search shows that it only allows these operations on directories, but not files. – Michael Hampton Dec 30 '16 at 21:59
  • Given there is a boolean on my build of this for logrotate_use_nfs that does read from NFS and not for cifs, I suspect this is a oversight in policy too. – Matthew Ife Dec 30 '16 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.