selinux and AFS

[Forrest Whitcher <fw@fwsystems.com>]

Stephen et al.

I imagine you've had enough 'progress' reports from me, however
I *think* I have figured out the cause of the failure in getting
openAFS to run under the selinux kernel (2.2.19).

Diagnostics on attempting mount were:

>From afsd:
--afsd: Mounting the AFS root on '/afs', flags: 0.
--afsd: Can't mount AFS on /afs(22)

>From the kernel:
--security_compute_av:  unrecognized SID 0
--psid_release:  uninitialized super block

I traced the return call error (EINVAL) to two places. 

First in super.c lines 973, 981 - psid_release when afs attempts 
the mount.

Second in security/services.c at lines 727, 278 - security_compute_av.

I then modified the former to never return an error code, thus 
allowing the mount to proceed. At this point, every attempt to
touch an object at or below the /afs root results in a repetition
of the last diagnostic

--security_compute_av:  unrecognized SID 0

(in these instances it is failing on the 'tsid' lookup- services.c l 278;
in the mount attempt it is the ssid lookup - services.c l 272)

obviously I can  'echo /*' and see that the afs dir is there, however
the above error is returned by any attempt to actually read data
from the filesystem (ls || stat || ...)

Although I have not had time to further trace into the kernel 
sources (spent some time digging, but other things came up)..

I believe I have a good guess about what's causing the problem.

AFS identifies the inode of the 'AFS' type filesystem (mounted
on /afs) as '0'. Is it likely that your routines are seeing the
'0' inode number and giving up / returning the errors to the
callers?

Thanks for any comments, I will have time later in the month to 
delve into this further, meantime, I'd hope to understand the 
hangup prior to heading down to DC next week for the security 
symp.


-- 
Forrest Whitcher    Principal      FW Systems 
617.254.3506                       fw@fwsystems.com                 
fw@world.std.com                   6174803245@mobile.att.net
Information systems consulting     http://www.fwsystems.com

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.