SELinux: Add new labeling type native labels
in [Kernel]
|
From: James Morris on 7 Jul 2010 19:30 On Wed, 7 Jul 2010, David P. Quigley wrote: > There currently doesn't exist a labeling type that is adequate for use with > labeled NFS. Since NFS doesn't really support xattrs we can't use the use xattr > labeling behavior. For this we developed a new labeling type. The native > labeling type is used solely by NFS to ensure NFS inodes are labeled at runtime > by the NFS code instead of relying on the SELinux security server on the client > end. It would be useful to have the ability to specify labeling behavior on a per-mount basis, with the default remaining as genfs. Otherwise, this is a global policy decision which affects all NFSv4 mounts, right? -- James Morris <jmorris(a)namei.org> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: David P. Quigley on 8 Jul 2010 09:40 On Thu, 2010-07-08 at 09:23 +1000, James Morris wrote: > On Wed, 7 Jul 2010, David P. Quigley wrote: > > > There currently doesn't exist a labeling type that is adequate for use with > > labeled NFS. Since NFS doesn't really support xattrs we can't use the use xattr > > labeling behavior. For this we developed a new labeling type. The native > > labeling type is used solely by NFS to ensure NFS inodes are labeled at runtime > > by the NFS code instead of relying on the SELinux security server on the client > > end. > > It would be useful to have the ability to specify labeling behavior on a > per-mount basis, with the default remaining as genfs. > > Otherwise, this is a global policy decision which affects all NFSv4 > mounts, right? > > I don't believe we have that ability in any other file system. If you want to decide that you want to use genfs style labels on NFSv4 just use a context mount. That way you can have the default behavior be use security label support unless you don't want to and then you can have a context mount. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: James Morris on 8 Jul 2010 18:40 On Thu, 8 Jul 2010, David P. Quigley wrote: > > Otherwise, this is a global policy decision which affects all NFSv4 > > mounts, right? > > > > > > I don't believe we have that ability in any other file system. NFS is quite different to other filesystems. Your files are on other systems, for example, which may or may not support security labeling. > If you want to decide that you want to use genfs style labels on NFSv4 > just use a context mount. So, we enable this feature, and virtually all existing mounts break because the servers do not support labeling. > That way you can have the default behavior be > use security label support unless you don't want to and then you can > have a context mount. It needs to be the other way around. This is a new feature, so the default needs to be the existing behavior, with security labeling as an option to enable at mount time. - James -- James Morris <jmorris(a)namei.org> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: David P. Quigley on 9 Jul 2010 10:20 On Fri, 2010-07-09 at 08:33 +1000, James Morris wrote: > On Thu, 8 Jul 2010, David P. Quigley wrote: > > > > Otherwise, this is a global policy decision which affects all NFSv4 > > > mounts, right? > > > > > > > > > > I don't believe we have that ability in any other file system. > > NFS is quite different to other filesystems. Your files are on other > systems, for example, which may or may not support security labeling. And if that is the case then the capability flag does not get set in the NFSv4 server caps and we don't use security label support on that mount. > > > If you want to decide that you want to use genfs style labels on NFSv4 > > just use a context mount. > > So, we enable this feature, and virtually all existing mounts break > because the servers do not support labeling. No it should default back to being nfs_t which is what happens when I use my client on an export that doesn't have security_label set. > > > That way you can have the default behavior be > > use security label support unless you don't want to and then you can > > have a context mount. > > It needs to be the other way around. This is a new feature, so the > default needs to be the existing behavior, with security labeling as an > option to enable at mount time. We made sure it falls back properly. It was decided a long time ago with discussion by several people that having it default to use it if its there otherwise fall back to the old behavior makes much more sense to an administrator. > > > > - James -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|
Pages: 1 Prev: FYI: mmap_sem OOM patch Next: [PATCH -next] IR: jvc-decoder needs BITREVERSE |