From: cpebenito@tresys.com (Christopher J. PeBenito) Date: Thu, 03 Mar 2011 08:39:37 -0500 Subject: [refpolicy] [PATCH 32/34]: patch to allow mount use kernel file descriptors In-Reply-To: <1299095277.28492.13.camel@tesla.lan> References: <1297838523.3205.120.camel@tesla.lan> <4D6BB9CC.7060406@tresys.com> <1298920576.3123.12.camel@tesla.lan> <4D6D44C0.5090700@tresys.com> <1299013715.14035.52.camel@tesla.lan> <4D6E9579.1050105@redhat.com> <1299095277.28492.13.camel@tesla.lan> Message-ID: <4D6F9A19.7060109@tresys.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On 3/2/2011 2:47 PM, Guido Trentalancia wrote: > On Wed, 02/03/2011 at 14.07 -0500, Daniel J Walsh wrote: >> On 03/01/2011 04:08 PM, Guido Trentalancia wrote: >>> On Tue, 01/03/2011 at 14.10 -0500, Christopher J. PeBenito wrote: >>>> On 02/28/11 14:16, Guido Trentalancia wrote: >>>>> On Mon, 28/02/2011 at 10.05 -0500, Christopher J. PeBenito wrote: >>>>>> On 02/16/11 01:42, Guido Trentalancia wrote: >>>>>>> This patch allows mount to use kernel file descriptors. >>>>>>> >>>>>>> diff -pruN refpolicy-git-15022011-test/policy/modules/system/mount.te refpolicy-git-15022011-test-new/policy/modules/system/mount.te >>>>>>> --- refpolicy-git-15022011-test/policy/modules/system/mount.te 2011-02-16 02:34:33.253189215 +0100 >>>>>>> +++ refpolicy-git-15022011-test-new/policy/modules/system/mount.te 2011-02-16 03:54:18.732023725 +0100 >>>>>>> @@ -51,6 +51,7 @@ can_exec(mount_t, mount_exec_t) >>>>>>> >>>>>>> files_tmp_filetrans(mount_t, mount_tmp_t, { file dir }) >>>>>>> >>>>>>> +kernel_use_fds(mount_t) >>>>>>> kernel_read_system_state(mount_t) >>>>>>> kernel_read_kernel_sysctls(mount_t) >>>>>>> kernel_dontaudit_getattr_core_if(mount_t) >>>>>> >>>>>> How did you come across this? >>>>> >>>>> type=1400 audit(1295758153.958:3): avc: denied { use } for pid=1429 >>>>> comm="mount" path="/dev/pts/0" dev=devpts ino=3 >>>>> scontext=system_u:system_r:mount_t:s0 >>>>> tcontext=system_u:system_r:kernel_t:s0 tclass=fd >>>> >>>> Can you provide more detail? What was happening on the system? >>> >>> Unfortunately I cannot provide more details now. I believe it's >>> happening at boot-up. I am also quite sure it's not critical. And the >>> only "uncommon" thing that I am using is the /sbin/mount.tmpfs script >>> from Fedora (will be obsoleted soon by the way). >>> >>> You could just drop it for the time being... >> >> I would guess kernel_t opens the /dev/pts/0 file descriptor to stdout >> passes it to init, which passes it to initrc_t which passes it to >> mount_t. (init_t could pass it directly to mount_t). > > And mount_t uses it to print out messages such as "mount > point /proc/bus/usb does not exist" very early during boot-up. Does this > sound like a possible end of the story ? This scenario doesn't sound right to me. Why would the kernel be using a pty? I would expect it to be using /dev/console. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com