ncpfs selinux policy

rhoekstra · 10-11-2006, 02:43 AM

Hi,

I am using Fedora Core 5 with SELinux enabled. This works fine and I can tune SELinux fine to suit my needs, but not so for ncpfs mounts.

I happen to work in an organisation that uses Novell architecture, so I need to be able to mount a Novell network share, using the ncpfs tools. Now I am able to connect to the share, but after some idle time, it gets disconnected and won't reconnect. I went to ask another Linux user in the organization for help.

However, a colleague of mine, who disabled SELinux on his machine, has no problems, while I am unable to connect to the shares after the described idle time... Unless I get SELinux in permissive mode, that is.

Searching for policy information about how to permit ncpfs to be used, I get stuck.. Perhaps the context on the parent directory in which I want to mount the ncpfs mount is wrong?
Or the selinux-policy-targeted is missing ncpfs directives ??

Anyway, I am unable to work properly, currently, with ncpfs shares.

Does anyone have this same problem? Or is there someone who could point me in the right direction of solving this issue?

Besides this, I tried to put the ncpfs mounting in autofs, trying to see if that would solve my problem, but it seems automount is completely unable to mount ncpfs shares at all...

Any help would be appreciated on this..

Thanks.

unSpawn · 10-12-2006, 04:33 AM

Are there any avc messages to work with here?

rhoekstra · 10-17-2006, 03:58 AM

There are three configs in which I would want to mount the ncpfs share, being either:
- autofs, making automount mount the share when needed. This fails.. Accompanying config and messages:
/etc/auto.master being:

Code:

/server /etc/auto.server

/etc/auto.server being:

Code:

share     -fstype=ncpfs,ipserver=server.example.com,user=roh.example.com,volume=USR,passwd=secret123,uid=roh SERVER

When setenforce 0, the mount succeeds. with setenforce 1, I get these messages:

Code:

type=AVC msg=audit(1161075106.947:232): avc:  denied  { mount } for  pid=13652 comm="mount.ncpfs" name="/" dev=ncpfs ino=2 scontext=user_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1161075106.947:232): arch=40000003 syscall=21 success=no exit=-13 a0=8f04140 a1=8094c00 a2=808c3b2 a3=c0ed0000 items=1 pid=13652 auid=5015 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mount.ncpfs" exe="/usr/bin/ncpmount" subj=user_u:system_r:mount_t:s0
type=CWD msg=audit(1161075106.947:232):  cwd="/server"
type=PATH msg=audit(1161075106.947:232): item=0 name="/server/share" inode=1590189 dev=00:11 mode=040555 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:autofs_t:s0
type=AVC msg=audit(1161075107.235:233): avc:  denied  { mount } for  pid=13652 comm="mount.ncpfs" name="/" dev=ncpfs ino=2 scontext=user_u:system_r:mount_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem
type=SYSCALL msg=audit(1161075107.235:233): arch=40000003 syscall=21 success=no exit=-13 a0=8f04140 a1=8094c00 a2=808c3b2 a3=c0ed0000 items=1 pid=13652 auid=5015 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mount.ncpfs" exe="/usr/bin/ncpmount" subj=user_u:system_r:mount_t:s0
type=CWD msg=audit(1161075107.235:233):  cwd="/server"
type=PATH msg=audit(1161075107.235:233): item=0 name="/server/share" inode=1590189 dev=00:11 mode=040555 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:autofs_t:s0
type=AVC msg=audit(1161075107.563:234): avc:  denied  { signal } for  pid=13652 comm="mount.ncpfs" scontext=user_u:system_r:mount_t:s0 tcontext=user_u:system_r:mount_t:s0 tclass=process
type=SYSCALL msg=audit(1161075107.563:234): arch=40000003 syscall=37 success=no exit=-13 a0=3555 a1=f a2=809104c a3=5 items=0 pid=13652 auid=5015 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mount.ncpfs" exe="/usr/bin/ncpmount" subj=user_u:system_r:mount_t:s0

Sorry if this is too verbose.

- automatic (boot time) mount through /etc/fstab. This fails though, without messages in dmesg nor /var/log/messages, nor /var/log/audit/audit.log. The content of /etc/fstab being:

Code:

SERVER                   /mnt/netmount                  ncpfs   defaults,auto,user=roh.example.com,passwd=secret123,volume=USR,ipserver=server.example.com,uid=roh,gid=users 0 0

No selinux output available

- possible mount as shown above by non-root user. Therefore I have set suid on /sbin/mount.ncpfs but it comes with Permission Denied, and no concrete evidence to why is found (nor messages, nor selinux audit)

Thanks in advance.