lsetxattr error when doing send/receive
Hi!
I'm trying to do a send/receive of a snapshot between two disks on Fedora 20 with Linux 3.15-rc5 (and also tried with 3.14 and 3.11) and SELinux disabled, and then I'm receiving the following error:
[root@darwin /]# btrfs subvolume snapshot -r / @.$(date +%Y-%m-%d-%H%M%S)Create a readonly snapshot of '/' in './@.2014-05-13-203532' [root@darwin /]# btrfs send @.2014-05-13-203532 | btrfs receive /mnt/cold/
At subvol @.2014-05-13-203532
At subvol @.2014-05-13-203532
ERROR: lsetxattr bin security.selinux=system_u:object_r:bin_t:s0 failed. Operation not supported
I'm missing something? Is this a bug?
--
Bernardo Donadio
Quoted 12 lines · Bernardo Donadio
Hi!
I'm trying to do a send/receive of a snapshot between two disks on Fedora 20 with Linux 3.15-rc5 (and also tried with 3.14 and 3.11) and SELinux disabled, and then I'm receiving the following error:
[root@darwin /]# btrfs subvolume snapshot -r / @.$(date
+%Y-%m-%d-%H%M%S)Create a readonly snapshot of '/' in
'./@.2014-05-13-203532'
[root@darwin /]# btrfs send @.2014-05-13-203532 | btrfs receive/mnt/cold/
At subvol @.2014-05-13-203532
At subvol @.2014-05-13-203532
ERROR: lsetxattr bin security.selinux=system_u:object_r:bin_t:s0 failed. Operation not supported
Quoted 1 line
I'm missing something? Is this a bug?
Is selinux 'disabled' or just non-enforcing? If it is enabled, but even non-enforcing, it still won't allow the security attributes to be set.
$ selinuxenabled; echo $?
should give '1' if it is truly disabled. I believe you have to disable it at startup time, so if you've changed the config file, you might need to reboot.
David
Quoted 1 line · David Brown
$ selinuxenabled; echo $?
It does return '1'. I know SELinux is disabled because I can't boot with it on (and I have no fucking clue why).
What exactly is the error complaining about, BTW? A guy at #selinux@freenode said something about btrfs not supporting the FS security extensions, but he didn't know how to elaborate more.
Thanks.
--
Bernardo Donadio
Quoted 6 lines · Bernardo Donadio
Quoted 1 line · David Brown
$ selinuxenabled; echo $?It does return '1'. I know SELinux is disabled because I can't boot with it on (and I have no fucking clue why).
What exactly is the error complaining about, BTW?
How are you disabling it? I suggest enabling it. Then setting enforcing=0 so that it can maintain the proper labeling, and see if you still get the error.
Quoted 1 line
A guy at #selinux@freenode said something about btrfs not supporting the FS security extensions, but he didn't know how to elaborate more.
Oh dear, well that's wrong. There appear to be some xattrs that are not being restored on receive, there's another thread on that, but they aren't selinux labels.
Chris Murphy
Quoted 11 lines · David Brown
Quoted 10 lines · Bernardo Donadio
Hi!
I'm trying to do a send/receive of a snapshot between two disks on Fedora 20 with Linux 3.15-rc5 (and also tried with 3.14 and 3.11) and SELinux disabled, and then I'm receiving the following error:
[root@darwin /]# btrfs subvolume snapshot -r / @.$(date +%Y-%m-%d-%H%M%S)Create a readonly snapshot of '/' in './@.2014-05-13-203532' [root@darwin /]# btrfs send @.2014-05-13-203532 | btrfs receive
/mnt/cold/
At subvol @.2014-05-13-203532
At subvol @.2014-05-13-203532
ERROR: lsetxattr bin security.selinux=system_u:object_r:bin_t:s0 failed. Operation not supported
Quoted 5 lines
Quoted 1 line
I'm missing something? Is this a bug?
Is selinux 'disabled' or just non-enforcing? If it is enabled, but even non-enforcing, it still won't allow the security attributes to be set.
Reverse that. If selinux is disabled, labels can't be set. If not enforcing, you won't get AVC denials for the vast majority of events, but labels can be set and e.g. restorecon will still work.
selinux=0 kernel param is disabled.
enforcing=0 kernel param is enabled but not enforcing (for most things).
selinux=0 isn't recommended. enforcing=0 is better, and then ausearch -m AVC to find denials and report them so they get fixed.
Chris Murphy
Quoted 16 lines · Chris Murphy
Quoted 13 lines · David Brown
Quoted 11 lines · Bernardo Donadio
Hi!
I'm trying to do a send/receive of a snapshot between two disks on Fedora 20 with Linux 3.15-rc5 (and also tried with 3.14 and 3.11) and SELinux disabled, and then I'm receiving the following error:
[root@darwin /]# btrfs subvolume snapshot -r / @.$(date +%Y-%m-%d-%H%M%S)Create a readonly snapshot of '/' in './@.2014-05-13-203532' [root@darwin /]# btrfs send @.2014-05-13-203532 | btrfs receive
/mnt/cold/
At subvol @.2014-05-13-203532
At subvol @.2014-05-13-203532
ERROR: lsetxattr bin security.selinux=system_u:object_r:bin_t:s0 failed. Operation not supportedI'm missing something? Is this a bug?
Quoted 7 lines
Quoted 3 lines
Is selinux 'disabled' or just non-enforcing? If it is enabled, but even non-enforcing, it still won't allow the security attributes to be set.
Reverse that. If selinux is disabled, labels can't be set. If not enforcing, you won't get AVC denials for the vast majority of events, but labels can be set and e.g. restorecon will still work.
$ selinuxenabled ; echo $? 0 $ touch /var/tmp/foo $ sudo setfattr -n security.selinux -v system_u:object_r:bin_t:s0 /var/tmp/foo $ ls -lZ /var/tmp/foo -rw-rw-r--. davidb davidb system_u:object_r:bin_t:s0 /var/tmp/foo
and on a machine with selinux disabled:
$ selinuxenabled ; echo $? 1 $ touch /var/tmp/foo $ sudo setfattr -n security.selinux -v system_u:object_r:bin_t:s0 /var/tmp/foo $ ls -lZ /var/tmp/foo -rw-rw-r--. davidb davidb system_u:object_r:bin_t:s0 /var/tmp/foo
so it doesn't actually seem to matter. At this point, I'm suspecting this was actually a bug in a kernel I was running at some point, and I just haven't bothered trying to enable selinux since then. I definitely have received errors in the past from rsync that look like the above error that I could fix by booting with selinux disabled.
David
Quoted 1 line · Chris Murphy
Reverse that. If selinux is disabled, labels can't be set. If not enforcing, you won't get AVC denials for the vast majority of events, but labels can be set and e.g. restorecon will still work.
Indeed, enabling SELinux into permissive mode solved the problem.
Thanks.
Signature · 1 line
Bernardo Donadio