Can't remount loopback ext4 without /etc/mtab

Can't remount loopback ext4 without /etc/mtab

[Daniel Drake]

Hi,

In Fedora 14, the test case below worked fine. In Fedora 15, it fails.
I think this is due to the change to have /etc/mtab as a symlink to
/proc/mounts.

# dd if=/dev/zero of=fs.img bs=1M count=20
# mkfs.ext4 fs.img
# mkdir mountpt
# mount -o loop fs.img mountpt

Now try to remount it read-only:

# mount -o remount,ro mountpt
mount: /home/dsd/tmpdisk/mountpt not mounted already, or bad option

(On Fedora 14 no error was returned and the mount became read-only)

When the error occurs, dmesg says:
[ 5495.860391] EXT4-fs (loop0): Unrecognized mount option "seclabel"
or missing value

Here is the corresponding entry from /proc/mounts:
/dev/loop0 /home/dsd/tmpdisk/mountpt ext4
rw,seclabel,relatime,barrier=1,data=ordered 0 0

Is this a util-linux bug? Or an ext4 issue?

Thanks,
Daniel

Re: Can't remount loopback ext4 without /etc/mtab

[Ted Ts'o]

On Sun, Jul 24, 2011 at 07:09:47PM +0100, Daniel Drake wrote:
> 
> When the error occurs, dmesg says:
> [ 5495.860391] EXT4-fs (loop0): Unrecognized mount option "seclabel"
> or missing value
> 
> Here is the corresponding entry from /proc/mounts:
> /dev/loop0 /home/dsd/tmpdisk/mountpt ext4
> rw,seclabel,relatime,barrier=1,data=ordered 0 0
> 
> Is this a util-linux bug? Or an ext4 issue?

Or a selinux thing; "seclabel" seems to be SELinux's fault:

% git grep LABELSUPP_STR
security/selinux/hooks.c:       {Opt_labelsupport, LABELSUPP_STR},
security/selinux/hooks.c:                       seq_puts(m, LABELSUPP_STR);
security/selinux/hooks.c:               match_prefix(LABELSUPP_STR, sizeof(LABEL
security/selinux/include/security.h:#define LABELSUPP_STR "seclabel"

Personally, I find my life has been much happier since I gave up on
SELinux as being too complicated to be secure.

						- Ted

Re: Can't remount loopback ext4 without /etc/mtab

[Davidlohr Bueso]

On Sun, 2011-07-24 at 15:57 -0400, Ted Ts'o wrote:
> On Sun, Jul 24, 2011 at 07:09:47PM +0100, Daniel Drake wrote:
> > 
> > When the error occurs, dmesg says:
> > [ 5495.860391] EXT4-fs (loop0): Unrecognized mount option "seclabel"
> > or missing value
> > 
> > Here is the corresponding entry from /proc/mounts:
> > /dev/loop0 /home/dsd/tmpdisk/mountpt ext4
> > rw,seclabel,relatime,barrier=1,data=ordered 0 0
> > 
> > Is this a util-linux bug? Or an ext4 issue?
> 
> Or a selinux thing; "seclabel" seems to be SELinux's fault:
> 

It would seem so, I can't reproduce this issue on a "normal", non
SELinux box.

> % git grep LABELSUPP_STR
> security/selinux/hooks.c:       {Opt_labelsupport, LABELSUPP_STR},
> security/selinux/hooks.c:                       seq_puts(m, LABELSUPP_STR);
> security/selinux/hooks.c:               match_prefix(LABELSUPP_STR, sizeof(LABEL
> security/selinux/include/security.h:#define LABELSUPP_STR "seclabel"
> 
> Personally, I find my life has been much happier since I gave up on
> SELinux as being too complicated to be secure.

+1!!

- Davidlohr

Re: Can't remount loopback ext4 without /etc/mtab

[Karel Zak]

On Sun, Jul 24, 2011 at 03:57:13PM -0400, Ted Ts'o wrote:
> On Sun, Jul 24, 2011 at 07:09:47PM +0100, Daniel Drake wrote:
> > 
> > When the error occurs, dmesg says:
> > [ 5495.860391] EXT4-fs (loop0): Unrecognized mount option "seclabel"
> > or missing value
> > 
> > Here is the corresponding entry from /proc/mounts:
> > /dev/loop0 /home/dsd/tmpdisk/mountpt ext4
> > rw,seclabel,relatime,barrier=1,data=ordered 0 0
> > 
> > Is this a util-linux bug? Or an ext4 issue?

 mount(8) "bug"

 The kernel does not accept any SELinux specific mount options for
 MS_REMOUNT. We already have exception for this in mount(8) ... and I
 hate it, but our SELunux kernel guys are happy with this strange
 behavior:

 https://bugzilla.redhat.com/show_bug.cgi?id=563267#c9
 
> Personally, I find my life has been much happier since I gave up on
> SELinux as being too complicated to be secure.

 +1 

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com

Re: Can't remount loopback ext4 without /etc/mtab

[Daniel Drake]

On 25 July 2011 10:06, Karel Zak <kzak@redhat.com> wrote:
> =A0mount(8) "bug"
>
> =A0The kernel does not accept any SELinux specific mount options for
> =A0MS_REMOUNT. We already have exception for this in mount(8) ... and I
> =A0hate it, but our SELunux kernel guys are happy with this strange
> =A0behavior:
>
> =A0https://bugzilla.redhat.com/show_bug.cgi?id=3D563267#c9

That view might have changed, I found these commits:
http://git.kernel.org/?p=3Dlinux/kernel/git/torvalds/linux-2.6.git;a=3Dcomm=
itdiff;h=3Dff36fe2c845cab2102e4826c1ffa0a6ebf487c65
http://git.kernel.org/?p=3Dlinux/kernel/git/torvalds/linux-2.6.git;a=3Dcomm=
itdiff;h=3D026eb167ae77244458fa4b4b9fc171209c079ba7
(from https://bugzilla.redhat.com/show_bug.cgi?id=3D676630 )

I'm going to test them against F15 kernel later today.

Thanks,
Daniel

Re: Can't remount loopback ext4 without /etc/mtab

[Karel Zak]

On Mon, Jul 25, 2011 at 10:20:55AM +0100, Daniel Drake wrote:
> On 25 July 2011 10:06, Karel Zak <kzak@redhat.com> wrote:
> >  mount(8) "bug"
> >
> >  The kernel does not accept any SELinux specific mount options for
> >  MS_REMOUNT. We already have exception for this in mount(8) ... and I
> >  hate it, but our SELunux kernel guys are happy with this strange
> >  behavior:
> >
> >  https://bugzilla.redhat.com/show_bug.cgi?id=563267#c9
> 
> That view might have changed, I found these commits:
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ff36fe2c845cab2102e4826c1ffa0a6ebf487c65
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=026eb167ae77244458fa4b4b9fc171209c079ba7
> (from https://bugzilla.redhat.com/show_bug.cgi?id=676630 )

 WOW...

> I'm going to test them against F15 kernel later today.

 F-15 uses 2.6.38, the patches are in kernel >= v2.6.39-rc7
 (according to git describe --contains).

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com

Re: Can't remount loopback ext4 without /etc/mtab

[Daniel Drake]

On 25 July 2011 10:46, Karel Zak <kzak@redhat.com> wrote:
> =A0F-15 uses 2.6.38, the patches are in kernel >=3D v2.6.39-rc7
> =A0(according to git describe --contains).

Indeed. I'm hoping they will include the patches in 2.6.38 for the
next F15 kernel update.
https://bugzilla.redhat.com/show_bug.cgi?id=3D725867

Daniel