xfs
[Top] [All Lists]

Re: [PATCH] xfstests: mount xfs with a context when selinux is on

To: Eric Sandeen <sandeen@xxxxxxxxxxx>
Subject: Re: [PATCH] xfstests: mount xfs with a context when selinux is on
From: Dave Chinner <david@xxxxxxxxxxxxx>
Date: Fri, 19 Feb 2010 10:32:46 +1100
Cc: xfs mailing list <xfs@xxxxxxxxxxx>
In-reply-to: <4B7DC50D.7070507@xxxxxxxxxxx>
References: <4B7C3F98.50303@xxxxxxxxxxx> <20100217230358.GX28392@xxxxxxxxxxxxxxxx> <4B7DB95B.4060506@xxxxxxxxxxx> <4B7DC50D.7070507@xxxxxxxxxxx>
User-agent: Mutt/1.5.18 (2008-05-17)
On Thu, Feb 18, 2010 at 04:54:05PM -0600, Eric Sandeen wrote:
> Eric Sandeen wrote:
> > Dave Chinner wrote:
> >> On Wed, Feb 17, 2010 at 01:12:24PM -0600, Eric Sandeen wrote:
> >>> When selinux is on, we get tons of new xattrs, which messes
> >>> up all kinds of output.
> >>>
> >>> The simplest way out of this, for now, seems to be to just mount
> >>> with a global context instead and skip writing the extra xattrs.
> >>>
> >>> I've been using this internally on Fedora and RHEL for a while now.
> >>>
> >>> Signed-off-by: Eric Sandeen <sandeen@xxxxxxxxxxx>
> >> I know very little about selinux, so while the code changes look OK
> >> I have no idea if the context change is All Goodness.
> >>
> >>> --- a/common.rc
> >>> +++ b/common.rc
> >>> @@ -47,8 +47,16 @@ _ls_l()
> >>>  
> >>>  _mount_opts()
> >>>  {
> >>> +    # SELinux adds extra xattrs which can mess up our expected output.
> >>> +    # So, mount with a context, and they won't be created
> >>> +    # nfs_t is a "liberal" context so we can use it.
> >>> +    if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
> >>> + SELINUX_MOUNT_OPTIONS="-o context=system_u:object_r:nfs_t:s0"
> >>> +    fi
> >>> +
> >> i.e. is t_nfs a context specific to a RHEL/Fedora setup, or is it a
> >> generic context that other distro's also define?
> > 
> > I'll ask; I think this is what they told me to use last time, but I
> > didn't ask if it was policy-specific...
> 
> our selinux guys still recommend this context as suitably generic.

OK. Consider it:

Reviewed-by: Dave Chinner <david@xxxxxxxxxxxxx>

-- 
Dave Chinner
david@xxxxxxxxxxxxx

<Prev in Thread] Current Thread [Next in Thread>