On Thu, Jan 13, 2011 at 12:47 PM, Stephen Smalley <s...@tycho.nsa.gov> wrote:
> On Thu, 2011-01-13 at 09:12 -0500, Stephen Smalley wrote:
> > On Thu, 2011-01-13 at 11:51 -0200, Paulo Cavalcanti wrote:
> >
> > > Here it goes:
> >
> > > ----
> > > type=SYSCALL msg=audit(01/13/2011 07:31:09.287:39) : arch=x86_64
> > > syscall=lstat success=no exit=-13(Permission denied) a0=7ff594509d50
> > > a1=7ffff3924c40 a2=7ffff3924c40 a3=2f534d50522f6c6d items=0 ppid=2230
> > > pid=2270 auid=unset uid=apache gid=apache euid=apache suid=apache
> > > fsuid=apache egid=apache sgid=apache fsgid=apache tty=(none) ses=unset
> > > comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0
> > > key=(null)
> > > type=AVC msg=audit(01/13/2011 07:31:09.287:39) : avc: denied
> > > { getattr } for pid=2270 comm=httpd
> > > path=/home/packages/rpms/myrpms-el5-x86_64/repodata dev=sda4
> > > ino=31331129 scontext=system_u:system_r:httpd_t:s0
> > > tcontext=system_u:object_r:file_t:s0 tclass=dir
> >
> > Was this while running RHEL-5 or F-14? Is /home mounted with a context=
> > mount option? What does 'mount' show for /home and/or /home/packages
> > (if a separate mount)?
>
> Oh, and under what OS were those files created? RHEL-5 or F-14?
>
>
The files were created in rhel5 and /home there was mounted using the
context I posted before:
LABEL=/home /home ext4
defaults,context=user_u:
object_r:user_home_t:s0 1 2
The avc denial was produced when reading the created files on F14.
Basically, what I did was:
1) I booted on rhel5, and updated my rhel5 RPM repo (createrepo+repoview).
2) I booted on F14 again and tried to use mock to create some rhel5 rpms
accessing the local repo updated on step 1.
3) I reset the context on F14, and mock could access the files normally.
I have two different users, with the same ID (500), in fedora 14 and rhel5,
and basically these users share some directories in /home used for keeping
rpms,
and a few directories accessed by httpd, and kept in the home of the fedora
user.
--
Paulo Roma Cavalcanti
LCG - UFRJ
--
devel mailing list
devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/devel
