5

Unable to Configure Quotas in RHEL6 & CentOS6- quotecheck returns error message

I've created new partition(/dev/sda6) and mounted it(on /hulk).

Edited /etc/fstab file to give quotas on the partition with following line

/dev/sda6   /hulk   ext4   defaults,usrquota,grpquota    0 0

and gave the following commands

[root@localhost ~]# mount -o remount,rw /hulk

[root@localhost ~]# mount|grep hulk
/dev/sda6 on /hulk type ext4 (rw,usrquota,grpquota)

[root@localhost ~]# cd /hulk

[root@localhost hulk]# ls
lost+found

and as i use the quotacheck command, it gives me the following error message

[root@localhost hulk]# quotacheck -cug /hulk
quotacheck: Cannot create new quotafile /hulk/aquota.user.new: Permission denied
quotacheck: Cannot initialize IO on new quotafile: Permission denied
quotacheck: Cannot create new quotafile /hulk/aquota.group.new: Permission denied
quotacheck: Cannot initialize IO on new quotafile: Permission denied

closed as off-topic by Jeff Schaller, G-Man, Anthon, Archemar, Kusalananda Sep 27 '17 at 6:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Jeff Schaller, G-Man, Anthon, Archemar, Kusalananda
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What are the permissions on /hulk? – Jenny D Oct 20 '14 at 7:28
  • @Jenny D [root@localhost ~]# ls -ld /hulk drwxrwxrwx. 2 root root 4096 Oct 20 13:45 /hulk – zen pwning Oct 20 '14 at 8:28
  • @Jenny D [root@localhost ~]# ls -ldZ /hulk drwxr-xr-x. root root system_u:object_r:file_t:s0 /hulk – zen pwning Oct 20 '14 at 10:12
  • 1
    @Jenny D Finally i was able resolve the issue with help of the following link: unix.com/red-hat/… – zen pwning Oct 21 '14 at 3:00
  • Great that you found the solution! It would be very much appreciated if you could take a few moments to write it into an answer that you can accept and I can upvote too... (There might be a timelimit before you can do this since you're a new user, but it would be really helpful for others if you could hang around and do that!) – Jenny D Oct 21 '14 at 7:14
0

Run it once in permissive mode and then scan for possible violations or just repeat the procedure until you find all violations.

ausearch -c 'quotaon' --raw | audit2allow -M my-quotaon
semodule -i my-quotaon.pp

This will scan for all violations and create a fitting selinux module to allow them. You can repeat this step until it works.

This is what I came up with on Fedora 24. The quota is enabled on my /home mount.

module my-quotaon 1.0;

require {
    type fs_t;
    type quota_exec_t;
    type home_root_t;
    type init_t;
    type quota_db_t;
    class file { execute execute_no_trans open quotaon read };
    class filesystem { quotaget quotamod };
}

#============= init_t ==============

#!!!! This avc is allowed in the current policy
allow init_t fs_t:filesystem { quotaget quotamod };

#!!!! This avc is allowed in the current policy
allow init_t home_root_t:file read;
allow init_t quota_db_t:file quotaon;

#!!!! This avc is allowed in the current policy
allow init_t quota_db_t:file { open read };

#!!!! This avc is allowed in the current policy
allow init_t quota_exec_t:file { execute execute_no_trans open read };
-2
# chcon ---reference=/var /hulk 

or else changing the SElinux mode to either permissive or disabled.

  • @slm Can you suggest me a better answer? – zen pwning Nov 7 '14 at 6:21
  • Sorry I'm not sure, I don't use quotas. – slm Nov 7 '14 at 6:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.