On Wed, 2005-10-19 at 10:54 -0400, Andy Dustman wrote: > I'm missing some important piece of how to properly mount NFS > filesystems under SELinux. I can get the filesystem to mount, but if I > try to access it, I get permission denied. Additionally, doing ls -dZ > on the mount point shows (none) as the label.
NFS does not support exporting of labels, since it does not support xattr. Any NFS filesystems you mount will have (none) as the labels, and all of the contents will have the label system_u:object_r:nfs_t, even if the server is a SELinux machine. So on your client, you have to give access to nfs_t. > So I'm guessing it's labeled nfs_t as would be expected, but even > getting the label is not allowed for the context. I'm not sure what you mean by "getting the label is not allowed for the context". > I'm aware of the need for NFS extensions on the client and server in > order to fully-implement file labelling. Right, except it will not likely be available anytime soon (if ever). You could try the NFSv3 experimental code on nsa.gov/selinux, but I have no idea if its up to date, and its not likely production quality. If NFS were to get real labeling support, it would be on NFSv4, not v3. In fact, I think CIFS is probably the closest network filesystem to having support for SELinux, as it has xattr support. It may just need to be enhanced to have security labels, but I'm not sure. > The server in this case is a NetApp Filer, so I don't expect it to > magically work. From what I am able to tell, all the files should be > labeled nfs_t, but I'm not really sure about this, based on > tunable.te, i.e. nfs_portdir and nfs_home_dirs. You turn on nfs_portdir if you have a portage tree or overlay on NFS. Nfs_home_dirs is if you have a NFS /home. -- Chris PeBenito <[EMAIL PROTECTED]> Developer, Hardened Gentoo Linux Embedded Gentoo Linux Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243 Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243
signature.asc
Description: This is a digitally signed message part
