Hello everyone,
I have a problem with oddjob_mkhomedir on a NFS mount point. The actual context is nfs_t
drwxr-xr-x. root root system_u:object_r:nfs_t:s0 users/
With this type, oddjob_mkhomedir cannot do is job of creating home user directories.
In the logs, I found about creating a new module with audi2allow and semodule:
[root@ audit]# sealert -l fe2d7f60-d3ff-405b-b518-38d0cf021598 X11 connection rejected because of wrong authentication. SELinux is preventing /usr/libexec/oddjob/mkhomedir from setattr access on the file .bash_logout.
***** Plugin catchall_boolean (89.3 confidence) suggests ******************
If you want to allow use to nfs home dirs Then you must tell SELinux about this by enabling the 'use_nfs_home_dirs' boolean. You can read 'None' man page for more details. Do setsebool -P use_nfs_home_dirs 1
***** Plugin catchall (11.6 confidence) suggests **************************
If you believe that mkhomedir should be allowed setattr access on the .bash_logout file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep mkhomedir /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
Additional Information: Source Context system_u:system_r:oddjob_mkhomedir_t:s0-s0:c0.c102 3 Target Context system_u:object_r:nfs_t:s0 Target Objects .bash_logout [ file ] Source mkhomedir Source Path /usr/libexec/oddjob/mkhomedir Port <Unknown> Host Source RPM Packages oddjob-mkhomedir-0.31.5-4.el7.x86_64 Target RPM Packages Policy RPM selinux-policy-3.13.1-60.el7_2.7.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name Platform Linux 3.10.0-327.28.3.el7.x86_64 #1 SMP Thu Aug 18 19:05:49 UTC 2016 x86_64 x86_64 Alert Count 1 First Seen 2016-09-15 15:12:48 EDT Last Seen 2016-09-15 15:12:48 EDT Local ID fe2d7f60-d3ff-405b-b518-38d0cf021598
Raw Audit Messages type=AVC msg=audit(1473966768.233:9091): avc: denied { setattr } for pid=28565 comm="mkhomedir" name=".bash_logout" dev="0:40" ino=1048581 scontext=system_u:system_r:oddjob_mkhomedir_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nfs_t:s0 tclass=file
type=SYSCALL msg=audit(1473966768.233:9091): arch=x86_64 syscall=fchown success=yes exit=0 a0=5 a1=2710 a2=2714 a3=5f7269645f656d6f items=0 ppid=1037 pid=28565 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=mkhomedir exe=/usr/libexec/oddjob/mkhomedir subj=system_u:system_r:oddjob_mkhomedir_t:s0-s0:c0.c1023 key=(null)
Hash: mkhomedir,oddjob_mkhomedir_t,nfs_t,file,setattr
I then created the module and the te file says this:
[root@ selinux]# cat mkhomedir_nfs.te
module mkhomedir_nfs 1.0;
require { type oddjob_mkhomedir_t; type nfs_t; class file { write create open setattr }; class dir { write create add_name setattr }; }
#============= oddjob_mkhomedir_t ==============
#!!!! This avc is allowed in the current policy allow oddjob_mkhomedir_t nfs_t:dir { write create add_name setattr };
#!!!! This avc is allowed in the current policy allow oddjob_mkhomedir_t nfs_t:file { write create open setattr };
Reading this output, I thought I had to add the context oddjob_mkhomedir_t to the users directory but I got another problem:
[root@ home]# semanage fcontext -a -t oddjob_mkhomedir_t "./users" ValueError: Type oddjob_mkhomedir_t is invalid, must be a file or device type
What I do wrong?
In the other hand, is it possible to disable SELinux to a directory and all is subdirectories?
Thanks, Bernard