Re: SELinux with NFSv4

Re: SELinux with NFSv4

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hervé WERNER wrote:
> Hello,
> 
> 
> I'm a French student working on NFSv4 through SELinux. I would like to
> know where I could find information about this. Is there something I could
> try to make files labeling working with NFSv4? Is there a patch I could
> try?
> 
> I am especially looking for a simple method that makes me able to limit
> permissions for users through NFSv4, for exemple :
> - allowing only sysadm_t to read write and execute a file and not to
> normal users
> - allowing access to everybody
> 
> 
> 
> I would appreciate any advice.
> 
> 
> Hervé WERNER
> 
> 
NFS extended attribute discussion is happing on the SELinux NSA Mail
list <selinux@tycho.nsa.gov>

You can add a label to the NFS mount and make this not accessable by
normal users which would get you what you want.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkgM+AsACgkQrlYvE4MpobNpmgCeNDDclNrFAesCwY6kTM8se2e7
CdoAnRNlBZPB4mtpzhodKMSW3sp5aQMW
=hPK3
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux with NFSv4

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hervé WERNER wrote:
>> NFS extended attribute discussion is happing on the SELinux NSA Mail
>> list <selinux@tycho.nsa.gov>
>>
>> You can add a label to the NFS mount and make this not accessable by
>> normal users which would get you what you want.
> I meant putting different labels on files resulting from the same mount.
> Currently I can only put an only label on all files coming from the same
> mount. I would like to be able to label differently files from a same
> mount. It is a kind of public share with permissions that I would like to
> do...
> 
Sorry you can not do that currently.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkgN63AACgkQrlYvE4MpobNS0gCeKaCM90qYaqlfDedFCm62nt0U
4TMAoJUFle8W2/j+KnBHB/dPrSDrVx1z
=aVrU
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.