On 11/13/2012 7:55 AM, Steve Dickson wrote:
On 12/11/12 20:39, Dave Quigley wrote:
If you're ok with non Fedora kernel images I can try to put up a tree either tonight or tomorrow with the patches that you just need to build and install. That plus the one patch for nfs-utils should make everything work.
I'm good with that....
steved.
Ok so if you go to http://www.selinuxproject.org/git you will see a repo
for lnfs and lnfs-patchset. The instructions at
http://www.selinuxproject.org/page/Labeled_NFS give you a better
indication on how to pull the trees. I've attached a patch for NFS utils
which gives support for security_label/nosecurity_label in your
/etc/exports file. I've also attached a script called setup which should
build a test directory called /export with a copy of /var/www under it
which should be labeled properly. It does all the proper SELinux
commands to make sure labeling is correct. Once you have that setup just
mount -t nfs localhost:/ /mnt/lnfs (or wherever you want) and you should
be good to go. Just ls -Z in /mnt/lnfs/var and check to make sure the
labels are the same as /export/var. It should have the labels showing up
in the network transfer. If you have any problems just let me know and I
can try to help figure them out.
Dave
>From da84919c6957090cd961bb4ce40753820312a845 Mon Sep 17 00:00:00 2001
From: Dave Quigley <dpquigl@xxxxxxxxxxxxxxxxxxxxxxxx>
Date: Fri, 18 Sep 2009 08:53:58 -0700
Subject: [PATCH] Add support to specify which exports will provide Labeled NFS support.
diff --git a/support/include/nfs/export.h b/support/include/nfs/export.h
index 1547a87..b8e2fb0 100644
--- a/support/include/nfs/export.h
+++ b/support/include/nfs/export.h
@@ -17,7 +17,8 @@
#define NFSEXP_ALLSQUASH 0x0008
#define NFSEXP_ASYNC 0x0010
#define NFSEXP_GATHERED_WRITES 0x0020
-/* 40, 80, 100 unused */
+#define NFSEXP_SECURITY_LABEL 0x0040 /* Support MAC attribute */
+/* 80, 100 unused */
#define NFSEXP_NOHIDE 0x0200
#define NFSEXP_NOSUBTREECHECK 0x0400
#define NFSEXP_NOAUTHNLM 0x0800
diff --git a/support/nfs/exports.c b/support/nfs/exports.c
index a93941c..8965c8d 100644
--- a/support/nfs/exports.c
+++ b/support/nfs/exports.c
@@ -239,6 +239,8 @@ putexportent(struct exportent *ep)
fprintf(fp, "%ssync,", (ep->e_flags & NFSEXP_ASYNC)? "a" : "");
fprintf(fp, "%swdelay,", (ep->e_flags & NFSEXP_GATHERED_WRITES)?
"" : "no_");
+ fprintf(fp, "%ssecurity_label,", (ep->e_flags & NFSEXP_SECURITY_LABEL)?
+ "" : "no");
fprintf(fp, "%shide,", (ep->e_flags & NFSEXP_NOHIDE)?
"no" : "");
fprintf(fp, "%scrossmnt,", (ep->e_flags & NFSEXP_CROSSMOUNT)?
@@ -531,6 +533,10 @@ parseopts(char *cp, struct exportent *ep, int warn, int *had_subtree_opt_ptr)
setflags(NFSEXP_GATHERED_WRITES, active, ep);
else if (!strcmp(opt, "no_wdelay"))
clearflags(NFSEXP_GATHERED_WRITES, active, ep);
+ else if (strcmp(opt, "security_label") == 0)
+ ep->e_flags |= NFSEXP_SECURITY_LABEL;
+ else if (strcmp(opt, "nosecurity_label") == 0)
+ ep->e_flags &= ~NFSEXP_SECURITY_LABEL;
else if (strcmp(opt, "root_squash") == 0)
setflags(NFSEXP_ROOTSQUASH, active, ep);
else if (!strcmp(opt, "no_root_squash"))
diff --git a/utils/exportfs/exportfs.c b/utils/exportfs/exportfs.c
index b78957f..6434825 100644
--- a/utils/exportfs/exportfs.c
+++ b/utils/exportfs/exportfs.c
@@ -531,6 +531,8 @@ dump(int verbose)
c = dumpopt(c, "async");
if (ep->e_flags & NFSEXP_GATHERED_WRITES)
c = dumpopt(c, "wdelay");
+ if (ep->e_flags & NFSEXP_SECURITY_LABEL)
+ c = dumpopt(c, "security_label");
if (ep->e_flags & NFSEXP_NOHIDE)
c = dumpopt(c, "nohide");
if (ep->e_flags & NFSEXP_CROSSMOUNT)
#!/bin/bash
mkdir /export
semanage fcontext -a -t mnt_t /export
mkdir /export/var
cp -R /var/www /export/var
semanage fcontext -ae /var /export/var
restorecon -R /export
echo "/export *(rw,fsid=0,sec=unix,security_label,insecure,no_subtree_check,sync, no_root_squash)" >> /etc/exports
systemctl restart nfs-server.service
