Re: [gentoo-hardened] Various questions about ssh, yp, and nfs

[Chris PeBenito]

On Sat, 2004-02-28 at 18:05, Michael Ihde wrote:
[NIS stuff cut]

I cant help since I'm not familiar with NIS.

> On to NFS, mount needed
>    allow { mount_t } resolv_conf_t:file { read getattr };
>    allow { mount_t } mount_t:tcp_socket { write read };

This should be ok.

> Right now all the nfs files and directories and labeled (null).  And a
> relabel does not change this.  Because of this they seem to all be in
> the context nfs_t:dir and nfs_t:file.  I don't want to give users full
> access to nfs_t.  How can I label these nfs file systems appropriatly
> (btw...I believe they are ext2).

Mounting a NFS export does not support labels, even if the server has
labels.  The label is given by genfs contexts, won't be shown by ls, and
can't changed.  There is work to have labeled NFS, so you can have
labels work between two SELinux machines, but its still going to be some
time before it's ready.  So, for now, all NFS filesystems will be nfs_t,
and you'll have to allow the access and make sure the regular DAC is set
correctly :\

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243