With current git, /proc/mounts is unreadable on my system, with any attempts to
read it returning EINVAL. This breaks many init scripts, among other things.
I bisected it down to this commit:
commit 2069f457848f846cb31149c9aa29b330a6b66d1b
Author: Eric Paris <[email protected]>
Date: Fri Jul 4 09:47:13 2008 +1000
LSM/SELinux: show LSM mount options in /proc/mounts
This patch causes SELinux mount options to show up in /proc/mounts. As
with other code in the area seq_put errors are ignored. Other LSM's
will not have their mount options displayed until they fill in their own
security_sb_show_options() function.
In my case, selinux_get_mnt_opts() never gets very far because
sbsec->initialized never becomes true, and the function systematically returns
EINVAL which is then passed back up to the reader of /proc/mounts.
Changing show_sb_opts() to always return 0 (it was a void function before this
commit) makes the system behave normally.
Now it's possible that my selinux config is hosed - I have it enabled in
permissive mode but I don't pay much attention to it - but the failure mode in
that case should probably be more graceful. Seems like it would be better to
print out the available mount info minus the LSM options than to bail out
completely?
Thanks,
Marc
On Wed, 2008-07-16 at 20:53 -0400, Marc Dionne wrote:
> With current git, /proc/mounts is unreadable on my system, with any attempts to
> read it returning EINVAL. This breaks many init scripts, among other things.
>
> I bisected it down to this commit:
>
> commit 2069f457848f846cb31149c9aa29b330a6b66d1b
> Author: Eric Paris <[email protected]>
> Date: Fri Jul 4 09:47:13 2008 +1000
>
> LSM/SELinux: show LSM mount options in /proc/mounts
>
> This patch causes SELinux mount options to show up in /proc/mounts. As
> with other code in the area seq_put errors are ignored. Other LSM's
> will not have their mount options displayed until they fill in their own
> security_sb_show_options() function.
>
> In my case, selinux_get_mnt_opts() never gets very far because
> sbsec->initialized never becomes true, and the function systematically returns
> EINVAL which is then passed back up to the reader of /proc/mounts.
>
> Changing show_sb_opts() to always return 0 (it was a void function before this
> commit) makes the system behave normally.
>
> Now it's possible that my selinux config is hosed - I have it enabled in
> permissive mode but I don't pay much attention to it - but the failure mode in
> that case should probably be more graceful. Seems like it would be better to
> print out the available mount info minus the LSM options than to bail out
> completely?
Yes, your SELinux config is hosed. But I'll agree that we should just
pass over the LSM options in that case (since clearly there aren't any)
and not fail the read altogether. Patch will be forthcoming.
-Eric