mounting /home while RBAC enabled makes files inaccesssible

Discuss usability issues, general maintenance, and general support issues for a grsecurity-enabled system.

mounting /home while RBAC enabled makes files inaccesssible

Postby ThomasKeller » Sat May 23, 2015 11:51 am

when I mount /home while RBAC is enabled, the files on the mounted /home are being blocked by RBAC, even if the rules allow access.

With same RBAC policy, when I mount /home before RBAC, then everything works fine

step to reproduce:

1) login to my server (RBAC is already running)
2) gradm -a admin
3) mount /home

4) login from another terminal
5) su - testuser

and I get following errors in the logs:

grsec: (testuser:U:/bin/bash) denied access to hidden file /home/testuser by /bin/bash[bash:2315] uid/euid:1001/1001 gid/egid:1001/1001, parent /bin/bash[bash:2312] uid/euid:1001/1001 gid/egid:1001/1001
grsec: (testuser:U:/bin/bash) denied access to hidden file /home/testuser by /bin/bash[bash:2312] uid/euid:1001/1001 gid/egid:1001/1001, parent /bin/su[su:2311] uid/euid:0/0 gid/egid:1001/1001
grsec: (testuser:U:/bin/bash) denied access to hidden file /home/testuser/.profile by /bin/bash[bash:2312] uid/euid:1001/1001 gid/egid:1001/1001, parent /bin/su[su:2311] uid/euid:0/0 gid/egid:1001/1001

It seems that funny things happen with RBAC when mounting and remounting. I have already reported before, that symlinks stop working when I remount filesystem to read-only:
viewtopic.php?f=3&t=4191

I am using gradm v3.1 with kernel 3.14.40

I really need to fix this problem.
Can somebody please help me troubleshoot this?
I will be happy to provide more information
ThomasKeller
 
Posts: 11
Joined: Tue Mar 17, 2015 10:25 am

Re: mounting /home while RBAC enabled makes files inaccesssi

Postby spender » Sat May 23, 2015 9:35 pm

Mounting while RBAC is enabled is not currently supported.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Re: mounting /home while RBAC enabled makes files inaccesssi

Postby ThomasKeller » Fri May 29, 2015 4:54 am

thanks Brad.

Are there plans to make it supported in the near future ?

Also, does this explain the other mentioned problem, where remounting / to read-only messes up symlinks ?

And finally, is only "mount" unsupported or anything that mounts (i.e. using fuse)?
What about sshfs ?
ThomasKeller
 
Posts: 11
Joined: Tue Mar 17, 2015 10:25 am


Return to grsecurity support