Description of problem:

rpc.mountd needs open & read access for fixed_disk_device_t.  Back in 2007 a change was made to rpc.mountd to make it use functionality provided by libblkid (nfs-utils commit e91ff017, "Use UUIDs to identify filesystems if kernel supports it.").  This commit first appeared in tag nfs-utils-1-0-11 upstream.

The first Fedora release to include that change was Fedora 7, released in May 2007.  

There were couple related bugs filed later in 2007:

426581 - SELinux nfs and rpc.mountd denials
426823 - SELinux generates blizzards of messages after upgrade

Unfortunately it doesn't look like anyone connected the dots... and since rpc.mountd soldiers on, generating device-number based FSIDs when it's unable to get the device UUIDs, the bug reporters indicated that it looked like everything was working properly.

As a result, a dontaudit rule was created to hide these errors.  Unfortunately, that can lead to stale filehandles, which is the very scenario that nfs-utils commit e91ff017 was intended to fix.


Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-224.fc25.noarch


How reproducible:

Easy.


Steps to Reproduce:

See https://bugzilla.redhat.com/show_bug.cgi?id=1326406#c0


Actual results:

rpc.mountd cannot call the blkid_* functions from libblkid due to the AVC violations and cannot generate UUID-based FSIDs as a result.


Expected results:

rpc.mountd should have read & open access for fixed_disk_device_t so it can call the blkid_* functions from libblkid.


Additional info:

This policy file generated by audit2allow fixes the problem for me.

# cat mountdlibblkid.te

module mountdlibblkid 1.0;

require {
	type nfsd_t;
	type fixed_disk_device_t;
	class blk_file { open read };
}

#============= nfsd_t ==============
allow nfsd_t fixed_disk_device_t:blk_file { open read };