Problem accessing new USB Hard Drive in FC5

[dwflo]

Was able to get it formated as an ext3 with Qparted.
Able to access in console, but unable to access in Gnome.
dmesg
Initializing USB Mass Storage driver...
scsi2 : SCSI emulation for USB Mass Storage devices
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
usb-storage: device found at 2
usb-storage: waiting for device to settle before scanning
Vendor: SAMSUNG Model: HD300LD Rev: 0000
Type: Direct-Access ANSI SCSI revision: 00
SCSI device sda: 586072368 512-byte hdwr sectors (300069 MB)
sda: Write Protect is off
sda: Mode Sense: 27 00 00 00
sda: assuming drive cache: write through
SCSI device sda: 586072368 512-byte hdwr sectors (300069 MB)
sda: Write Protect is off
sda: Mode Sense: 27 00 00 00
sda: assuming drive cache: write through
sda: sda1
sd 2:0:0:0: Attached scsi disk sda
usb-storage: device scan complete
sd 2:0:0:0: Attached scsi generic sg0 type 0
kjournald starting. Commit interval 5 seconds
EXT3 FS on sda1, internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
The drive shows up in Computer, but clicking on icon, gives an error "unable to mount volume". Running the ls command, the lost+found directory is seen.
I have not made any entries to the fstab. Been unable to access it again with Qparted, as it compains the device is mounted. Go figure! :confused:

[dwflo]

Hoping to get some answers here, still trying to get access to the usb drive. I offer more inforamation, maybe this will get some reponse?
[root@c-68-35-132-93 dwflo]# dmesg | grep usb
usbcore: registered new driver usbfs
usbcore: registered new driver hub
usbcore: registered new driver libusual
usbcore: registered new driver hiddev
usbcore: registered new driver usbhid
drivers/usb/input/hid-core.c: v2.6:USB HID core driver
SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts
usb usb1: configuration #1 chosen from 1 choice
usb usb2: configuration #1 chosen from 1 choice
usb usb3: configuration #1 chosen from 1 choice
usb usb4: configuration #1 chosen from 1 choice
usb usb5: configuration #1 chosen from 1 choice
usb 5-3: new high speed USB device using ehci_hcd and address 2
usb 5-3: configuration #1 chosen from 1 choice
usbcore: registered new driver usb-storage
usb-storage: device found at 2
usb-storage: waiting for device to settle before scanning
usb-storage: device scan complete

[jcliburn]

What is the status of SELinux on your system: disabled, permissive, or enforcing? If enforcing, have you tried setting it to permissive before inserting your usb drive?

Try "tail -f /var/log/messages" before you insert the drive, then insert it and try to access it. Perhaps there's an error message being generated that you haven't yet caught. (I know you've already posted dmesg, but it's not clear to me if that's before or after you attempt to access the drive.)

[robin108]

Umm, my usb hdd works fine. i simply set fc5 to automount removable devices. i did not need to go into fstab. anyway, i am at work now, i will check properly when i get home.

[dwflo]

What is the status of SELinux on your system: disabled, permissive, or enforcing? If enforcing, have you tried setting it to permissive before inserting your usb drive?

Try "tail -f /var/log/messages" before you insert the drive, then insert it and try to access it. Perhaps there's an error message being generated that you haven't yet caught. (I know you've already posted dmesg, but it's not clear to me if that's before or after you attempt to access the drive.)
Thanks jcliburn, that did the trick. It was SELinux all along, preventing access. Did not show up in the log, when viewed previously. This time I was able to see it with "tail". Set SELinux to permissive and...hark, there were angels. :D
Now I can go back to some previous posts, and fix my problem to get it working with SELinux enforcing.

[dwflo]

jcliburn,
Just did some searching for a post that explained how to set SELinux enforcing, allowing access to devices, but can't find it. Would you kindly link me to that post, if you know where it is located? Would be apperciated.

[jcliburn]

Unfortunately, I don't know which post you're referring to. Sorry. Why don't you post the "avc: denied" message you're encountering.

[dwflo]

Here is the avc:denied message

avc: denied { getattr } for pid=2617 comm="hal-system-stor" name="/" dev=sda1 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir
Apr 13 13:37:37 xgl kernel: audit(1144957057.088:4): avc: denied { getattr } for pid=2617 comm="hal-system-stor" name="/" dev=sda1 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir
Apr 13 13:37:37 xgl kernel: audit(1144957057.096:5): avc: denied { search } for pid=2621 comm="touch" name="/" dev=sda1 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir
Apr 13 13:37:37 xgl kernel: audit(1144957057.096:6): avc: denied { search } for pid=2621 comm="touch" name="/" dev=sda1 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir
Apr 13 13:37:37 xgl kernel: audit(1144957057.096:7): avc: denied { getattr } for pid=2617 comm="hal-system-stor" name="/" dev=sda1 ino=2 scontext=system_u:system_r:hald_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=dir

[jcliburn]

Whenever you set selinux to permissive, where does sda1 mount?

Try running this (assuming your avc: denied msgs are logged in /var/log/messages):
# audit2allow -v -i /var/log/messages

[robin108]

i did not need to change selinux. it remained set at enforcing.
System -> Preferences -> Removable Drives & Media -> Storage ... itś right there. no need to mess with anything else

[jcliburn]

Okay dwflo, I've been learning about SELinux. From what I can tell, for some unexplained reason your SELinux policy isn't allowing HAL to interact correctly with your drive. I have no idea why. Here's what to do.
# yum install checkpolicy
# audit2allow -M local -l -i /var/log/messages
# semodule -i local.pp
If I'm right, that should fix you up. This creates a local targeted enforcement (te) policy for your particular configuration. You can see the policy if you cat local.te after running the audit2allow command.

I keep getting a bluetooth related avc:denied, so I tested the whole audit2allow thing using my own system. (I run auditd, so my avc:denied messages show up in var/log/audit/audit.log instead of /var/log/messages.) Here's what the process looked like.
[root@osprey ~]# audit2allow -M local -l -i /var/log/audit/audit.log
Generating type enforcment file: local.te
Compiling policy
checkmodule -M -m -o local.mod local.te
semodule_package -o local.pp -m local.mod

******************** IMPORTANT ***********************

In order to load this newly created policy package into the kernel,
you are required to execute

semodule -i local.pp


[root@osprey ~]# cat local.te
module local 1.0;

require {
class fd use;

type bluetooth_helper_t;
type xdm_t;
};

allow bluetooth_helper_t xdm_t:fd use;
[root@osprey ~]# semodule -i local.pp
[root@osprey ~]#
You should probably file a bug for your particular problem at bugzilla.redhat.com against selinux-policy-targeted so it can get changed.

I found the instructions here. http://fedora.redhat.com/docs/selinux-faq-fc5/#id2979106

So you don't feel quite so lonely, this guy has the exact same problem as you. http://www.mabula.net/tbfw/blosxom.cgi/tech/fedora

Post back if this does or doesn't work.

Cheers,
Jay

[dwflo]

[root@xgl dwflo]# audit2allow -M local -l -i /var/log/messages
Generating type enforcment file: local.te
Compiling policy
checkmodule -M -m -o local.mod local.te
/usr/bin/audit2allow: (unknown source)::ERROR 'syntax error' at token '13' on line 4:
class dir { 13 13:46:05 13:47:41 13:48:28 13:50:45 Apr NetworkManager_disable_trans:0, allow_cvs_read_shadow:0, allow_execheap:0, allow_execmem:1, allow_execmod:1, allow_execstack:1, allow_ftpd_anon_write:0, allow_gssd_read_tmp:1, allow_httpd_anon_write
require {
checkmodule: error(s) encountered while parsing configuration
checkmodule: loading policy configuration from local.te

[root@xgl dwflo]# cat local.te
module local 1.0;

require {
class dir { 13 13:46:05 13:47:41 13:48:28 13:50:45 Apr NetworkManager_disable_trans:0, allow_cvs_read_shadow:0, allow_execheap:0, allow_execmem:1, allow_execmod:1, allow_execstack:1, allow_ftpd_anon_write:0, allow_gssd_read_tmp:1, allow_httpd_anon_write:0, allow_httpd_sys_script_anon_write:0, allow_java_execstack:0, allow_kerberos:1, allow_ptrace:0, allow_rsync_anon_write:0, allow_saslauthd_read_shadow:0, allow_smbd_anon_write:0, allow_ypbind:0, amanda_disable_trans:0, apmd_disable_trans:0, arpwatch_disable_trans:0, auditd_disable_trans:0, automount_disable_trans:0, automount_disable_trans:1, avahi_disable_trans:0, bluetooth_disable_trans:0, canna_disable_trans:0, cardmgr_disable_trans:0, clvmd_disable_trans:0, comsat_disable_trans:0, crond_disable_trans:0, cupsd_config_disable_trans:0, cupsd_disable_trans:0, cupsd_lpd_disable_trans:0, cvs_disable_trans:0, cyrus_disable_trans:0, dbskkd_disable_trans:0, dhcpc_disable_trans:0, dhcpd_disable_trans:0, dovecot_disable_trans:0, e_dirs:0, fcron_crond:0, fetchmail_disable_trans:0, fingerd_disable_trans:0, ftp_home_dir:0, ftpd_disable_trans:0, ftpd_is_daemon:1, getattr global_ssp:0, gpm_disable_trans:0, gssd_disable_trans:0, hald_disable_trans:0, hald_disable_trans:1, hotplug_disable_trans:0, hotplug_disable_trans:1, howl_disable_trans:0, hplip_disable_trans:0, httpd_builtin_scripting:1, httpd_can_network_connect:0, httpd_can_network_connect_db:0, httpd_can_network_relay:0, httpd_disable_trans:0, httpd_enable_cgi:1, httpd_enable_ftp_server:0, httpd_enable_homedirs:1, httpd_ssi_exec:1, httpd_suexec_disable_trans:0, httpd_tty_comm:0, httpd_unified:1, inetd_child_disable_trans:0, inetd_disable_trans:0, innd_disable_trans:0, irqbalance_disable_trans:0, isable_trans:0, kadmind_disable_trans:0, kernel: klogd_disable_trans:0, krb5kdc_disable_trans:0, ktalkd_disable_trans:0, lpd_disable_trans:0, mailman_mail_disable_trans:0, mysqld_disable_trans:0, named_disable_trans:0, named_write_master_zones:0, nfs_export_all_ro:1, nfs_export_all_rw:1, nfsd_disable_trans:0, nmbd_disable_trans:0, nscd_disable_trans:0, ntpd_disable_trans:0, pegasus_disable_trans:0, portmap_disable_trans:0, postfix_disable_trans:0, postgresql_disable_trans:0, pppd_can_insmod:0, pppd_disable_trans:0, pptp_disable_trans:0, privoxy_disable_trans:0, ptal_disable_trans:0, radiusd_disable_trans:0, radvd_disable_trans:0, rans:0, rdisc_disable_trans:0, read_default_t:1, readahead_disable_trans:0, restorecond_disable_trans:0, rlogind_disable_trans:0, rpcd_disable_trans:0, rshd_disable_trans:0, rsync_disable_trans:0, run_ssh_inetd:0, samba_enable_home_dirs:0, saslauthd_disable_trans:0, search secure_mode:0, secure_mode_insmod:0, secure_mode_policyload:0, sla smbd_disable_trans:0, snmpd_disable_trans:0, spamassasin_can_network:0, spamd_disable_trans:0, spamd_enable_home_dirs:1, squid_connect_any:0, squid_disab ssh_sysadm_login:0, stunnel_disable_trans:0, stunnel_is_daemon:0, swat_disable_trans:0, syslogd_disable_trans:0, system_crond_disable_trans:0, tcpd_disable_trans:0, telnetd_disable_trans:0, tftpd_disable_trans:0, udev_disable_trans:0, use_nfs_home_dirs:0, use_samba_ho user_ping:1, uucpd_disable_trans:0, winbind_disable_trans:0, write xdm_disable_trans:0, xend_disable_trans:0, xfs_disable_trans:0, xgl ypbind_disable_trans:0, yppasswdd_disable_trans:0, ypserv_disable_trans:0, ypxfr_disable_trans:0, zebra_disable_trans:0 };
class fd use;
class fifo_file getattr;
class file { getattr read write };
class process transition;
class sock_file getattr;

type etc_t;
type file_t;
type fsadm_t;
type hald_t;
type mount_t;
type ramfs_t;
type restorecon_t;
type rpm_script_t;
type setfiles_t;
type unconfined_t;
type xdm_t;
};

allow fsadm_t file_t:file read;
allow hald_t file_t:dir { 13 13:46:05 13:47:41 13:48:28 13:50:45 Apr NetworkManager_disable_trans:0, allow_cvs_read_shadow:0, allow_execheap:0, allow_execmem:1, allow_execmod:1, allow_execstack:1, allow_ftpd_anon_write:0, allow_gssd_read_tmp:1, allow_httpd_anon_write:0, allow_httpd_sys_script_anon_write:0, allow_java_execstack:0, allow_kerberos:1, allow_ptrace:0, allow_rsync_anon_write:0, allow_saslauthd_read_shadow:0, allow_smbd_anon_write:0, allow_ypbind:0, amanda_disable_trans:0, apmd_disable_trans:0, arpwatch_disable_trans:0, auditd_disable_trans:0, automount_disable_trans:0, automount_disable_trans:1, avahi_disable_trans:0, bluetooth_disable_trans:0, canna_disable_trans:0, cardmgr_disable_trans:0, clvmd_disable_trans:0, comsat_disable_trans:0, crond_disable_trans:0, cupsd_config_disable_trans:0, cupsd_disable_trans:0, cupsd_lpd_disable_trans:0, cvs_disable_trans:0, cyrus_disable_trans:0, dbskkd_disable_trans:0, dhcpc_disable_trans:0, dhcpd_disable_trans:0, dovecot_disable_trans:0, e_dirs:0, fcron_crond:0, fetchmail_disable_trans:0, fingerd_disable_trans:0, ftp_home_dir:0, ftpd_disable_trans:0, ftpd_is_daemon:1, getattr global_ssp:0, gpm_disable_trans:0, gssd_disable_trans:0, hald_disable_trans:0, hald_disable_trans:1, hotplug_disable_trans:0, hotplug_disable_trans:1, howl_disable_trans:0, hplip_disable_trans:0, httpd_builtin_scripting:1, httpd_can_network_connect:0, httpd_can_network_connect_db:0, httpd_can_network_relay:0, httpd_disable_trans:0, httpd_enable_cgi:1, httpd_enable_ftp_server:0, httpd_enable_homedirs:1, httpd_ssi_exec:1, httpd_suexec_disable_trans:0, httpd_tty_comm:0, httpd_unified:1, inetd_child_disable_trans:0, inetd_disable_trans:0, innd_disable_trans:0, irqbalance_disable_trans:0, isable_trans:0, kadmind_disable_trans:0, kernel: klogd_disable_trans:0, krb5kdc_disable_trans:0, ktalkd_disable_trans:0, lpd_disable_trans:0, mailman_mail_disable_trans:0, mysqld_disable_trans:0, named_disable_trans:0, named_write_master_zones:0, nfs_export_all_ro:1, nfs_export_all_rw:1, nfsd_disable_trans:0, nmbd_disable_trans:0, nscd_disable_trans:0, ntpd_disable_trans:0, pegasus_disable_trans:0, portmap_disable_trans:0, postfix_disable_trans:0, postgresql_disable_trans:0, pppd_can_insmod:0, pppd_disable_trans:0, pptp_disable_trans:0, privoxy_disable_trans:0, ptal_disable_trans:0, radiusd_disable_trans:0, radvd_disable_trans:0, rans:0, rdisc_disable_trans:0, read_default_t:1, readahead_disable_trans:0, restorecond_disable_trans:0, rlogind_disable_trans:0, rpcd_disable_trans:0, rshd_disable_trans:0, rsync_disable_trans:0, run_ssh_inetd:0, samba_enable_home_dirs:0, saslauthd_disable_trans:0, search secure_mode:0, secure_mode_insmod:0, secure_mode_policyload:0, sla smbd_disable_trans:0, snmpd_disable_trans:0, spamassasin_can_network:0, spamd_disable_trans:0, spamd_enable_home_dirs:1, squid_connect_any:0, squid_disab ssh_sysadm_login:0, stunnel_disable_trans:0, stunnel_is_daemon:0, swat_disable_trans:0, syslogd_disable_trans:0, system_crond_disable_trans:0, tcpd_disable_trans:0, telnetd_disable_trans:0, tftpd_disable_trans:0, udev_disable_trans:0, use_nfs_home_dirs:0, use_samba_ho user_ping:1, uucpd_disable_trans:0, winbind_disable_trans:0, xdm_disable_trans:0, xend_disable_trans:0, xfs_disable_trans:0, xgl ypbind_disable_trans:0, yppasswdd_disable_trans:0, ypserv_disable_trans:0, ypxfr_disable_trans:0, zebra_disable_trans:0 };
allow mount_t etc_t:file write;
allow restorecon_t xdm_t:fd use;
allow setfiles_t ramfs_t:fifo_file getattr;
allow setfiles_t ramfs_t:file getattr;
allow setfiles_t ramfs_t:sock_file getattr;
allow unconfined_t rpm_script_t:process transition;
allow unconfined_t self:dir write;
[root@xgl dwflo]#
[root@xgl dwflo]# semodule -i local.pp
bash: semodule: command not found
As you can see when I do the audit2allow, there is a syntax error, then cat the local.te.
semodule command not found!!!

[jcliburn]

Pull out only the avc:denied messages relating to your usb drive mount problem (in post #8 above) and dump them into a file. Then feed that file instead of /var/log/messages to audit2allow. Obviously there are other avc:denied messages in your syslog unrelated to your mounting problem. I'd recommend tackling one thing at a time.

semanage is part of policycoreutils. "yum install policycoreutils". The command itself lives in /usr/sbin.

[dwflo]

Pull out only the avc:denied messages relating to your usb drive mount problem (in post #8 above) and dump them into a file. Then feed that file instead of /var/log/messages to audit2allow. Obviously there are other avc:denied messages in your syslog unrelated to your mounting problem. I'd recommend tackling one thing at a time.

semanage is part of policycoreutils. "yum install policycoreutils". The command itself lives in /usr/sbin.
Hey man, you are a life saver, got it working, just as you have instructed. :D
Thanks for all your help and being patient. I learned a lot from this experiance, and am starting to read up on selinux. I will print this message thread and keep it for reference.
BTW, are you on the fedora-list? Thought I saw a name that might be you, just courious.

[jcliburn]

Hey man, you are a life saver, got it working, just as you have instructed. :D
Thanks for all your help and being patient.
You're welcome.
I learned a lot from this experiance, and am starting to read up on selinux.
Me too.
BTW, are you on the fedora-list? Thought I saw a name that might be you, just courious.
Yeah, that's me.

[dwflo]

Now I can't access my printer...aaaaagggghhhh :mad:

[sairuk]

thanks guys this sorted me out as well, appreciate it.