SELinux: Correct way to install mount/automount units

Ask Fedora
, , ,
1

Hello all,
I’m using mount/automount units to mount the SMB shares of my NAS. I reinstalled F44 and did my post-install chores, e.g. put the unit files in place:

jpo@fedora-strix ~> ls -l /etc/systemd/system/nas-*
-rw-r--r--. 1 root root 171 25. Jul 2025  /etc/systemd/system/nas-backup.automount
-rw-r--r--. 1 root root 247 26. Jul 2025  /etc/systemd/system/nas-backup.mount
-rw-r--r--. 1 root root 168  7. Feb 18:01 /etc/systemd/system/nas-music.automount
-rw-r--r--. 1 root root 243  7. Feb 17:52 /etc/systemd/system/nas-music.mount
-rw-r--r--. 1 root root 171 14. Dez 18:55 /etc/systemd/system/nas-photos.automount
-rw-r--r--. 1 root root 244 14. Dez 18:54 /etc/systemd/system/nas-photos.mount
-rw-r--r--. 1 root root 168 26. Jul 2025  /etc/systemd/system/nas-video.automount
-rw-r--r--. 1 root root 243  7. Feb 18:00 /etc/systemd/system/nas-video.mount

This didn’t initially work, because SELinux prevented systemd from reading the unit files. Everything worked as expected with sudo setenforce permissive, but failed with sudo setenforce Enforcing. I kind of solved the issue by doing

ausearch -c 'systemd' --raw | audit2allow -M my-systemd
semodule -i my-systemd.pp

But this doesn’t feel right. So: Is this the correct way? If not, what is the correct way of doing this?

Thanks in advance

2

Replying to myself here. I did some more research and did this: chcon -t systemd_unit_file_t nas-*

Now systemd can read the unit files, but the documentation says, that this might not be enough:

The chcon command changes the SELinux context for files. However, changes made with the chcon command do not survive a file system relabel, or the execution of the restorecon command

3

You’ll need to use semanage
For reference:

4

Did you create those unit files in another directory then moved them there?

5

This is what you should start with:

sudo restorecon -v -R /etc/systemd

If the issue persists, proceed with inspecting the output:

journalctl -b -g avc | audit2allow
6

Thank you.

I’m not sure that did anything. It worked after my chcon changes (e.g. chcon -t systemd_unit_file_t nas-*), so for now the problem is kind of solved, I’m just not sure it’s solved correctly.

Here is the state AFTER sudo restorecon -v -R /etc/systemd

jpo@fedora-strix /e/s/system> ls -lZ /etc/systemd/system/nas-*
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 171 25. Jul 2025  /etc/systemd/system/nas-backup.automount
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 247 26. Jul 2025  /etc/systemd/system/nas-backup.mount
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 168  7. Feb 18:01 /etc/systemd/system/nas-music.automount
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 243  7. Feb 17:52 /etc/systemd/system/nas-music.mount
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 171 14. Dez 18:55 /etc/systemd/system/nas-photos.automount
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 244 14. Dez 18:54 /etc/systemd/system/nas-photos.mount
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 168 26. Jul 2025  /etc/systemd/system/nas-video.automount
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 243  7. Feb 18:00 /etc/systemd/system/nas-video.mount

which looks not different.

7

I tried that and got

semanage fcontext -a -t systemd_unit_file_t /etc/systemd/system/nas-backup.automount
ValueError: File spec /etc/systemd/system/nas-backup.automount conflicts with equivalency rule '/etc/systemd/system /usr/lib/systemd/system'; Try adding '/usr/lib/systemd/system/nas-backup.automount' instead
8

Yes. They are from my “post-install chores” backup.

9

You gotta use the -Z option.
cp -Z ~/.local/bin/post-install/nas-* /etc/systemd/system/
So that the labels change to the destination directory default label.

10

Mutt Manor notifications@fedoraproject.discoursemail.com writes:

I tried that and got

semanage fcontext -a -t systemd_unit_file_t /etc/systemd/system/nas-backup.automount
ValueError: File spec /etc/systemd/system/nas-backup.automount conflicts with equivalency rule '/etc/systemd/system /usr/lib/systemd/system'; Try adding '/usr/lib/systemd/system/nas-backup.automount' instead

Have you noticed the “Try adding ‘/usr/lib/systemd/system/nas-backup.automount’ instead”
message?

It means you should try:

semanage fcontext -a -t systemd_unit_file_t /usr/lib/systemd/system/nas-backup.automount