I'm missing some important piece of how to properly mount NFS
filesystems under SELinux. I can get the filesystem to mount, but if I
try to access it, I get permission denied. Additionally, doing ls -dZ
on the mount point shows (none) as the label. The avc denial is:
Oct 19 10:34:48 dynamo audit(1129732488.176:905): avc: denied { read
} for pid=12648 comm="ls" name="/" dev=0:e ino=7214560
scontext=adustman:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t
tclass=dir
So I'm guessing it's labeled nfs_t as would be expected, but even
getting the label is not allowed for the context.
# grep nfs_t policy.conf
type var_lib_nfs_t, file_type, sysadmfile, usercanread;
# nfs_t is the default type for NFS file systems
type nfs_t, fs_type;
allow nfs_t self:filesystem associate;
allow file_type nfs_t:filesystem associate;
allow consoletype_t nfs_t:file write;
allow mount_t nfs_t:dir mounton;
allow mount_t nfs_t:dir search;
allow mount_t var_lib_nfs_t:dir mounton;
dontaudit { file_type noexattrfile nfs_t } self:pax *;
allow rpcd_t var_lib_nfs_t:dir { create read getattr lock setattr
ioctl link unlink rename search add_name remove_name reparent write
rmdir };
allow rpcd_t var_lib_nfs_t:file { create ioctl read getattr lock write
setattr append link unlink rename };
allow nfsd_t var_lib_nfs_t:dir { create read getattr lock setattr
ioctl link unlink rename search add_name remove_name reparent write
rmdir };
allow nfsd_t var_lib_nfs_t:file { create ioctl read getattr lock write
setattr append link unlink rename };
genfscon nfs / system_u:object_r:nfs_t
genfscon nfs4 / system_u:object_r:nfs_t
genfscon afs / system_u:object_r:nfs_t
[ Searching for package 'selinux' in all categories among: ]
* installed packages
[I--] [ ] sec-policy/selinux-base-policy-20050821 (0)
[I--] [ ] sec-policy/selinux-portmap-20050908 (0)
[I--] [ ] sec-policy/selinux-nfs-20040501 (0)
I'm aware of the need for NFS extensions on the client and server in
order to fully-implement file labelling. The server in this case is a
NetApp Filer, so I don't expect it to magically work. From what I am
able to tell, all the files should be labeled nfs_t, but I'm not
really sure about this, based on tunable.te, i.e. nfs_portdir and
nfs_home_dirs.
--
Computer interfaces should never be made of meat.
http://www.terrybisson.com/meat.html
--
[email protected] mailing list
