SELinux mount context causes Systemd issue

Hi,
I am asking about Fedora Server.

Mounting drives with this context: context=“system_u:object_r:samba_share_t:s0”

Causes issues with anything to do with sudo, systemd causing timeouts with the latter. Oddly, the problem is not resolved by disabling SELinux.

Mounting without the context works fine, but, I need this context as the drives are to be used as samba shares.

Additionally, the exact same lines in fstab worked a week ago.

Mounting with SELinux context means, for example, hostnamectl status will hang, eventually to return:
Failed to query system properties: Connection timed out

systemctl daemon-reload hangs, and returns Failed to reload daemon: Method call timed out

Is no-one able to offer any kind of remedy to this? I’ve used Fedora for several years but I am seriously considering switching distro recently, this is adding weight to the argument :frowning:

A

That is indeed very odd. When the timeouts occur, is there anything suggestive in the system logs?

That is odd as well. Could you have a look at dnf history list to ascertain what packages if any were updated or changed in this period?

Unfortunately both systemd and selinux have a reputation for being “tough”, and your title has them both :laughing:

Feel free to change distros if you have better experience with others. There’s no shortage of them, and that’s kind of the beauty of the diversity in FOSS. If you do stick around, someone from the community can try to help. You can switch to RHEL and get professional support if these systems are critical systems that need to be kept error free.

Hi Fransisco

Thanks for your answers. :slight_smile:

I believe this is be a solid bug, not a configuration issue, and I have reported it on Red Hat bugzilla at the request of someone upstream in SELinux.

I resolved the issue by removing the context from the fstab entries, mounting the drives normally, and then labelling them with: semanage fcontext -a -t samba_share_t “/var/eng(/.*)?” to allow samba to work.

I will leave this open in case anyone has a clue to the cause of the fstab/SELinux/systemd problem.

2 Likes

Therefore, SELinux has nothing to do with the issue. You write that you also have trouble with sudo if you use that context; what issues to you find, and do they go away if you unmount those drives?

Hi Sideburns

I said that mounting without the context cures the issue, however, then those drives will not be available to samba.

Therefore, correct, it would seem the issue is with systemd or something associated with it. The big problem is that journalcctl is not usable.

See above for my cure, which sidesteps the issue, rather than cures it.

Anyone finding themselves in the same situation I did at the weekend will end up spending a lot of time trying to resolve it, because its manifestation is so odd.

About sudo: It hangs. If you ever experienced the issue with changing hostname during installation, it’s a similar symptom. (and maybe related, but I don’t know how).

Yes, you did while I was composing my post. However, I also asked about sudo issues because they seem to be related. Does your workaround fix that too?

BTW, if you have to mount those drives on a fairly regular basis, you might want to create a little shell script owned by root and only executable by root that both mounts the drives and changed their context. Much simpler than having to type in both commands every time you need those drives.

Hi Sideburns

Yes, it fixes the sudo issue as well!

Using semanage fcontext and restorecon labels the drives and the label survives a reboot, so it seems like a good fix for now.

Good idea to make a script, just in case…

1 Like

Confirmed this is a Fedora specific issue. Not present with Scientific Linux.

1 Like

Good to know. Could you edit your solution to include the link to the bug please?