Re: [gentoo-hardened] SELinux and NFS

[Loren Bandiera]

On Mon, 2008-02-25 at 09:54 +0100, xake@×××××××××.net wrote:
> Sorry if I was unclear, I was a little bit tired.
>
> For some reason mountd seems to wants to access a /dev/-node and I
> can't
> really understand why.
> I think it would help a little bit if we knew somewhat more about your
> share. What is your options in export? Do you have anything mounted
> beneath '/data' and is everything labeled correctly?

On the server, in /etc/exports I have:

$ cat /etc/exports 
# /etc/exports: NFS file systems being exported.  See exports(5).
/data/library 10.0.0.0/255.255.255.0(async,no_subtree_check,rw)
/data/software 10.0.0.0/255.255.255.0(async,no_subtree_check,rw)

On the clients in /etc/fstab:

10.0.0.2:/data/library  /data/library   nfs             rw
0 0
10.0.0.2:/data/software     /data/software      nfs             rw
0 0

I believe everything is labelled correctly, I see the following from ls
-lAZ /data:

drwxr-xr-x+  9 lorenb users system_u:object_r:default_t  4096 Feb 23
12:17 library

drwxr-xr-x+ 27 lorenb users system_u:object_r:default_t  4096 Sep  4
02:15 software


> When I said "where NFS are supposed to read them" I meant a place with
> the
> right security context. For me I have it as a subdir to /srv/ which is
> by
> default "system_u:object_r:public_content_t", something NFS are
> allowed to
> read according to its policy. So this was kind of my way to say
> "labeled
> correctly".
>

Ah I see. So should I chcon the two /data subdirectories to another
context from default_t to public_content_t?

-- 
Loren Bandiera <lorenb@××××××××××××××.com>
LB Technology Services, Inc.


-- 
gentoo-hardened@l.g.o mailing list