10

We are using SSSD to authenticate users on CentOS servers. oddjobd-mkhomedir works perfectly fine when the default home directory is /home, but on a particular server, we had to change default home directory to /data, which is on a SAN mount.

Now, every time a user tries to log in, they are dropped into a bash shell with the following message.

Creating home directory for first.last.

Could not chdir to home directory /data/X.Y.local/first.last: No such file or directory

-bash-4.1$

I see the following AVC denial message for every attempt:

type=AVC msg=audit(1492004159.114:1428): avc:  denied  { create } for  pid=2832 
comm="mkhomedir" name="x.y.local"
scontext=system_u:system_r:oddjob_mkhomedir_t:s0-s0:c0.c1023
tcontext=system_u:object_r:default_t:s0 tclass=dir

Have made sure to change the context for /data.

 drwxr-xr-x. root root system_u:object_r:home_root_t:s0 data

If /data has the same context as /home, why is SELinux restricting oddjobd to create /data/X.Y.local/first.last ?

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

[UPDATE]

Not sure if this is the correct way to solve this, but after adding the following three entries user's are now able to log in and get to their home directories. For new user's directories are getting created based on the context's defined below.

semanage fcontext -a -t home_root_t /data
semanage fcontext -a -t user_home_dir_t /data/x.y.local
semanage fcontext -a -t user_home_t "/data/x.y.local(/.*)?"

Is this the correct way to get around this problem?

slm
  • 369,824
Abhi
  • 173
  • Not sure if this is relevant to your issue, but it has caused me grief in the past: https://linux.die.net/man/8/nfs_selinux – 0xSheepdog Jul 26 '17 at 12:38

2 Answers2

4

That last section with semanage fcontext is the correct way to permanently set the context yes. You will need to run restorecon to have it take effect though.

restorecon -Rv /data

restorecon will take into account anything in /etc/selinux/targeted/contexts/files/file_contexts.local, which should have your custom fcontexts that you just added using semanage

To set these contexts temporarily, refer to the chcon command:

chcon -Rv -t home_root_t /data
Patrick
  • 599
1

When relocating home directories, the best solution is probably to use the EQUAL mechanism of semanage fcontext as described in this answer on server fault:

semanage fcontext -a -e /home /data

This is to ensure that all rules of the original home location is also applied to the new one.

sebasth
  • 14,872
mnk
  • 21