What SELinux to context to set for a USB used as podman data storage

Hey, I have an IOT device and one of the benefits of fedora is using SELINUX in fedora.

I’ve created a permanent mount of a usb on /mnt/usbd

I’m trying to use it to store the data used for applications in podman. I’m getting a couple of SELinux errors that I can’t seem to find the right SELinux context to set with chron or semanage to make the errors go away:

type=AVC msg=audit(1674087231.103:6824): avc: denied { read } for pid=282700 comm=“python3” name=“home-assistant-config” dev=“dm-2” ino=265 scontext=system_u:system_r:container_t:s0:c50,c306 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

type=AVC msg=audit(1674087236.563:6831): avc: denied { write } for pid=282887 comm=“node” name=“node-red-data” dev=“dm-2” ino=264 scontext=system_u:system_r:container_t:s0:c762,c924 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

type=AVC msg=audit(1674087223.98:6818): avc: denied { write } for pid=282226 comm=“python3” name=“home-assistant-config” dev=“dm-2” ino=265 scontext=system_u:system_r:container_t:s0:c50,c306 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

Any suggestions?

1 Like

If you look closely at those messages they are telling you the files that are a problem are
tcontext=unconfined_u:object_r:unlabeled_t:s0
and seems to indicate they should be
scontext=system_u:system_r:container_t:s0

Maybe you can manually set the appropriate context. Maybe you can set it with sudo restorecon -Rv /mnt. Or maybe you should create your own policy for that mount point and use case.

I am not sure what your SELinux context for /mnt is but on mine it is

# ls -ldZ /mnt
drwxr-xr-x. 8 root root system_u:object_r:mnt_t:s0 4096 Aug  9 08:27 /mnt
[root@eagle rtl8812au-5.6.4.2]# ls -ldZ /mnt/*
drwxr-xr-x. 4 root root system_u:object_r:mnt_t:s0     4096 Sep 26 18:28 /mnt/Backup

If you were to get the mount point (/mnt/usbd) (after mounting) to have the requested context then it would follow that everything under that should have the same context.