LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 10-11-2006, 02:43 AM   #1
rhoekstra
Member
 
Registered: Aug 2004
Location: The Netherlands
Distribution: RedHat 2, 3, 4, 5, Fedora, SuSE, Gentoo
Posts: 356

Rep: Reputation: 40
ncpfs selinux policy


Hi,

I am using Fedora Core 5 with SELinux enabled. This works fine and I can tune SELinux fine to suit my needs, but not so for ncpfs mounts.

I happen to work in an organisation that uses Novell architecture, so I need to be able to mount a Novell network share, using the ncpfs tools. Now I am able to connect to the share, but after some idle time, it gets disconnected and won't reconnect. I went to ask another Linux user in the organization for help.

However, a colleague of mine, who disabled SELinux on his machine, has no problems, while I am unable to connect to the shares after the described idle time... Unless I get SELinux in permissive mode, that is.

Searching for policy information about how to permit ncpfs to be used, I get stuck.. Perhaps the context on the parent directory in which I want to mount the ncpfs mount is wrong?
Or the selinux-policy-targeted is missing ncpfs directives ??

Anyway, I am unable to work properly, currently, with ncpfs shares.

Does anyone have this same problem? Or is there someone who could point me in the right direction of solving this issue?

Besides this, I tried to put the ncpfs mounting in autofs, trying to see if that would solve my problem, but it seems automount is completely unable to mount ncpfs shares at all...

Any help would be appreciated on this..

Thanks.
 
Old 10-12-2006, 04:33 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 27,457
Blog Entries: 54

Rep: Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897Reputation: 2897
Are there any avc messages to work with here?
 
Old 10-17-2006, 03:58 AM   #3
rhoekstra
Member
 
Registered: Aug 2004
Location: The Netherlands
Distribution: RedHat 2, 3, 4, 5, Fedora, SuSE, Gentoo
Posts: 356

Original Poster
Rep: Reputation: 40
There are three configs in which I would want to mount the ncpfs share, being either:
- autofs, making automount mount the share when needed. This fails.. Accompanying config and messages:
/etc/auto.master being:
Code:
/server /etc/auto.server
/etc/auto.server being:
Code:
share     -fstype=ncpfs,ipserver=server.example.com,user=roh.example.com,volume=USR,passwd=secret123,uid=roh SERVER
When setenforce 0, the mount succeeds. with setenforce 1, I get these messages:
Code:
type=AVC msg=audit(1161075106.947:232): avc:  denied  { mount } for  pid=13652 comm="mount.ncpfs" name="/" dev=ncpfs ino=2 scontext=user_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1161075106.947:232): arch=40000003 syscall=21 success=no exit=-13 a0=8f04140 a1=8094c00 a2=808c3b2 a3=c0ed0000 items=1 pid=13652 auid=5015 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mount.ncpfs" exe="/usr/bin/ncpmount" subj=user_u:system_r:mount_t:s0
type=CWD msg=audit(1161075106.947:232):  cwd="/server"
type=PATH msg=audit(1161075106.947:232): item=0 name="/server/share" inode=1590189 dev=00:11 mode=040555 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:autofs_t:s0
type=AVC msg=audit(1161075107.235:233): avc:  denied  { mount } for  pid=13652 comm="mount.ncpfs" name="/" dev=ncpfs ino=2 scontext=user_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1161075107.235:233): arch=40000003 syscall=21 success=no exit=-13 a0=8f04140 a1=8094c00 a2=808c3b2 a3=c0ed0000 items=1 pid=13652 auid=5015 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mount.ncpfs" exe="/usr/bin/ncpmount" subj=user_u:system_r:mount_t:s0
type=CWD msg=audit(1161075107.235:233):  cwd="/server"
type=PATH msg=audit(1161075107.235:233): item=0 name="/server/share" inode=1590189 dev=00:11 mode=040555 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:autofs_t:s0
type=AVC msg=audit(1161075107.563:234): avc:  denied  { signal } for  pid=13652 comm="mount.ncpfs" scontext=user_u:system_r:mount_t:s0 tcontext=user_u:system_r:mount_t:s0 tclass=process
type=SYSCALL msg=audit(1161075107.563:234): arch=40000003 syscall=37 success=no exit=-13 a0=3555 a1=f a2=809104c a3=5 items=0 pid=13652 auid=5015 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mount.ncpfs" exe="/usr/bin/ncpmount" subj=user_u:system_r:mount_t:s0
Sorry if this is too verbose.


- automatic (boot time) mount through /etc/fstab. This fails though, without messages in dmesg nor /var/log/messages, nor /var/log/audit/audit.log. The content of /etc/fstab being:
Code:
SERVER                   /mnt/netmount                  ncpfs   defaults,auto,user=roh.example.com,passwd=secret123,volume=USR,ipserver=server.example.com,uid=roh,gid=users 0 0
No selinux output available

- possible mount as shown above by non-root user. Therefore I have set suid on /sbin/mount.ncpfs but it comes with Permission Denied, and no concrete evidence to why is found (nor messages, nor selinux audit)

Thanks in advance.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
selinux policy or attribute ?? dansawyer Linux - Security 3 09-12-2006 02:08 AM
SELinux policy and Cisco vpn client NetArch Linux - Security 1 10-28-2005 03:21 AM
selinux:policy.conf silvercloud Linux - Enterprise 0 08-23-2005 04:38 AM
FYI: FC3, Punkbuster, selinux-policy-targeted Jimbo99 Linux - Software 15 06-18-2005 09:32 PM
problem when emerging selinux-base-policy-20040906 Snerkel Linux - Distributions 0 10-24-2004 07:58 PM


All times are GMT -5. The time now is 01:55 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration