encryptionselinuxluks

SELinux and cryptsetup: chown failed and can't access temporary keystore

I am trying to set up SELinux and an encrypted additional partition that I mount at startup using a systemd service.

If I run SELinux in permissive mode, everything runs ok (partition is correctly mounted, data can be accessed and service runs properly).

If I run SELinux in enforcing mode (enforcing=1), I am not able to mount such partition with the error:

/dev/mapper/temporary-cryptsetup-1808: chown failed: Permission denied
sh[1777]: Failed to open temporary keystore device.
sh[1777]: Command failed with code 5: Input/output error

Any ideas to fix that?

Audit2allow does not return any additional rules to be added

Solution

  • Solved assigning to cryptsetup the lvm_exec_t context.

    In the lvm.fc file cryptsetup was defined as /bin/cryptsetup but I had to change it to /usr/sbin/cryptsetup where it actually was.