# Permission denied rb\_file\_s\_lstat with SELinux and local home directories

**URL:** <https://discourse.openondemand.org/t/permission-denied-rb-file-s-lstat-with-selinux-and-local-home-directories/2338>\
**Category:** Get Help\
**Tags:** question\
**Created:** [October 25, 2022, 8:51pm UTC](https://discourse.openondemand.org/t/permission-denied-rb-file-s-lstat-with-selinux-and-local-home-directories/2338 "2022-10-25T20:51:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ghferrari](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/ghferrari/32/1064_2.png) [@ghferrari](https://discourse.openondemand.org/u/ghferrari)\
**Post date:** [October 25, 2022, 8:52pm UTC](https://discourse.openondemand.org/t/permission-denied-rb-file-s-lstat-with-selinux-and-local-home-directories/2338/1 "2022-10-25T20:52:00Z")

</div>

Hi,

I have OnDemand installed on two servers, both with SELinux enabled. Both servers use local (i.e. not NFS) home directories and appropriate SE booleans have been set, following the documentation:

```auto
use_nfs_home_dirs --> off
ondemand_use_nfs --> off
ondemand_manage_user_home_dir --> on

```

When I try to use the Files app, I see the following error message:

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/f/fba30156a8f7f6f5717aa1c92f051d6b60161719.png)

Initially, nothing relevant is shown within `/var/log/audit/audit.log` however, if I disable SELinux via `setenforce 0` then I can use the Files app without seeing this error. When I reactivate SELinux, this error returns.

Following some hints in [$Home Directory Doesn't Exist (CAS, SELinux, & University Controlled AD)](https://discourse.openondemand.org/t/home-directory-doesnt-exist-cas-selinux-university-controlled-ad/1880) I disabled the SELinux filtering via `semodule -DB` and then found the following relevant entry in `/var/log/audit/audit.log`:

```auto
type=AVC msg=audit(1666728916.263:393): avc: denied { getattr } for pid=3820 comm="utils.rb:110" path="/home/dvi322/.config" dev="vda1" ino=419446355 scontext=system_u:system_r:ood_pun_t:s0 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir permissive=0

```

Would you have any ideas on how to fix this? Many thanks in advance and thanks for all the great work you do for the OnDemand software.

---

<div class="post-metadata">

**Author:** ![travert](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/travert/32/3074_2.png) [@travert](https://discourse.openondemand.org/u/travert)\
**Post date:** [October 26, 2022, 4:21pm UTC](https://discourse.openondemand.org/t/permission-denied-rb-file-s-lstat-with-selinux-and-local-home-directories/2338/2 "2022-10-26T16:21:35Z")

</div>

Hey thanks for posting.

I am not sure what is happening here as SELinux can be a bit tricky. @tdockendorf you may have better insight into this, any clue what they need to do to clear the SELinux errors?

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [October 27, 2022, 1:12pm UTC](https://discourse.openondemand.org/t/permission-denied-rb-file-s-lstat-with-selinux-and-local-home-directories/2338/3 "2022-10-27T13:12:00Z")

</div>

First a word of warning. Local home directories almost never work with OnDemand since OnDemand will write files to user’s home that are expected to be accessible on compute nodes. The time when it works is if OnDemand is on the NFS server so the $HOME is local to OnDemand but served as NFS to compute.

That said, to address the SELinux issues first try this to see if the context on $HOME/.config is correct:

```auto
restorecon -R -n -v /home/dvi322/.config

```

If the command outputs anything, remove the `-n` flag to restore the correct contexts. OnDemand expects to be able to access things with `user_home_dir_t` when the `ondemand_manage_user_home_dir` is enabled.

If the contexts don’t change with restorecon the next step is to generate a custom SELinux policy. When dealing with the “dontaudit” denials, it gets really tricky. These are my recommended steps:

```auto
# Make sure system and OnDemand is relatively idle and not used
# Truncate audit log
> /var/log/audit/audit.log
# Disable dontaudit
semodule -DB
# Do things in OnDemand that are blocked with SELinux
# Then turn dontaudit back on
semodule -B
# Now generate custom policy
cat /var/log/audit/audit.log | audit2allow -M ood
semodule -i ood.pp

```

There will likely be more denials besides the getattr if OnDemand is trying to do anything besides getattr on the ~/.config location. So might have to repeat the steps and gradually build up a more complete custom policy. Once you get things working with your custom policy, can share the contents of `ood.te` from the `audit2allow` command and we can try and integrate those changes into the OnDemand SELinux policy.

Also be aware that when you diable the “dontaudit” you will likely get a lot of noise in the custom policy you might have to clean up. Anything that doesn’t pertain to `ood_pun_t` is likely not related to OnDemand and just system noise.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [April 25, 2023, 1:12pm UTC](https://discourse.openondemand.org/t/permission-denied-rb-file-s-lstat-with-selinux-and-local-home-directories/2338/4 "2023-04-25T13:12:37Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.