user guide draft: "Examples: Booleans for NFS"

user guide draft: "Examples: Booleans for NFS"

[Murray McAllister]

Hi,

The following is a draft for the "Booleans" section. Any comments or 
corrections are appreciated:

Examples: Booleans for NFS and CIFS

By default, NFS mounts on the client side are labeled with a default 
context defined by policy for NFS file systems. In common policies, this 
default context uses the nfs_t type. Also, by default, Samba shares 
mounted on the client side are labeled with a default context defined by 
policy. In common policies, this default context uses the cifs_t type.

Depending on policy configuration, services, such as Apache HTTP Server 
and Samba, may not be able to read files labeled with the nfs_t or 
cifs_t types. This may prevent file systems labeled with these types 
from being mounted and then read or exported by other services. Booleans 
can be turned on or off to control which services are allowed to access 
the nfs_t and cifs_t types.

The setsebool and semanage commands must be run as the Linux root user. 
The setsebool -P command makes persistent changes. Do not use the -P 
option if you do not want changes to persist across reboots:

Apache HTTP Server

To allow access to NFS file systems (files labeled with the nfs_t type):
/usr/sbin/setsebool -P httpd_use_nfs on

To allow access to Samba file systems (files labeled with the cifs_t type):
/usr/sbin/setsebool -P httpd_use_cifs on

Samba

To export NFS file systems:
/usr/sbin/setsebool -P samba_share_nfs on

FTP (vsftpd)

To allow access to NFS file systems:
/usr/sbin/setsebool -P allow_ftpd_use_nfs on

Other Services

For a list of NFS related Booleans for other services:
/usr/sbin/semanage boolean -l | grep nfs

For a list of Samba related Booleans for other services:
/usr/sbin/semanage boolean -l | grep cifs

Thanks.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: user guide draft: "Examples: Booleans for NFS"

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Murray McAllister wrote:
> Hi,
> 
> The following is a draft for the "Booleans" section. Any comments or
> corrections are appreciated:
> 
> Examples: Booleans for NFS and CIFS
> 
> By default, NFS mounts on the client side are labeled with a default
> context defined by policy for NFS file systems. In common policies, this
> default context uses the nfs_t type. Also, by default, Samba shares
> mounted on the client side are labeled with a default context defined by
> policy. In common policies, this default context uses the cifs_t type.
> 
> Depending on policy configuration, services, such as Apache HTTP Server
> and Samba, may not be able to read files labeled with the nfs_t or
> cifs_t types. This may prevent file systems labeled with these types
> from being mounted and then read or exported by other services. Booleans
> can be turned on or off to control which services are allowed to access
> the nfs_t and cifs_t types.
> 
> The setsebool and semanage commands must be run as the Linux root user.
> The setsebool -P command makes persistent changes. Do not use the -P
> option if you do not want changes to persist across reboots:
> 
> Apache HTTP Server
> 
> To allow access to NFS file systems (files labeled with the nfs_t type):
> /usr/sbin/setsebool -P httpd_use_nfs on
> 
> To allow access to Samba file systems (files labeled with the cifs_t type):
> /usr/sbin/setsebool -P httpd_use_cifs on
> 
> Samba
> 
> To export NFS file systems:
> /usr/sbin/setsebool -P samba_share_nfs on
> 
> FTP (vsftpd)
> 
> To allow access to NFS file systems:
> /usr/sbin/setsebool -P allow_ftpd_use_nfs on
> 
> Other Services
> 
> For a list of NFS related Booleans for other services:
> /usr/sbin/semanage boolean -l | grep nfs
> 
> For a list of Samba related Booleans for other services:
> /usr/sbin/semanage boolean -l | grep cifs
> 
> Thanks.
> 
> -- 
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
> with
> the words "unsubscribe selinux" without quotes as the message.
Looks good, only problem with describing booleans is that they might not
exist on all versions of policy.  The description above will require 5.3
policy on RHEL5.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkkIVyIACgkQrlYvE4MpobONxgCePfsQzcXhWMt2vn6hFsS4QWbZ
3QYAn17S7SzQ7AmbXEwQP9x+ymkthqgW
=m5MJ
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: user guide draft: "Examples: Booleans for NFS"

[Murray McAllister]

Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Murray McAllister wrote:
>> Hi,

>>
>> Apache HTTP Server
>>
>> To allow access to NFS file systems (files labeled with the nfs_t type):
>> /usr/sbin/setsebool -P httpd_use_nfs on
>>
>> To allow access to Samba file systems (files labeled with the cifs_t type):
>> /usr/sbin/setsebool -P httpd_use_cifs on
[snip]
> Looks good, only problem with describing booleans is that they might not
> exist on all versions of policy.  The description above will require 5.3
> policy on RHEL5.

I added a note:

These Booleans exist in SELinux policy as shipped with Fedora 10. They 
may not exist in policy shipped with other versions of Fedora or other 
operating systems.

I'll keep these things in mind when the guide is forked for Red Hat 
Enterprise Linux.

Cheers.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: user guide draft: "Examples: Booleans for NFS"

[Russell Coker]

On Thursday 30 October 2008 10:28, Murray McAllister <mmcallis@redhat.com> 
wrote:
> These Booleans exist in SELinux policy as shipped with Fedora 10. They
> may not exist in policy shipped with other versions of Fedora or other
> operating systems.
>
> I'll keep these things in mind when the guide is forked for Red Hat
> Enterprise Linux.

Given that M4 knowledge is required for anyone who does anything serious with 
SE Linux, maybe you should write your documentation in M4.

Some years ago I wrote my CV in M4 and had it produce about 10 different 
versions (I also had a Makefile).  Then it a recruiting agent wanted a 
version of my CV that emphasised my C coding experience I could just send the 
relevant file.

The same technique could be used for any other document.  It would be good if 
you could type "make" and produce documents for several versions of Fedora 
and a couple of versions of RHEL at the same time.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: user guide draft: "Examples: Booleans for NFS"

[Murray McAllister]

Russell Coker wrote:
> On Thursday 30 October 2008 10:28, Murray McAllister <mmcallis@redhat.com> 
> wrote:
>> These Booleans exist in SELinux policy as shipped with Fedora 10. They
>> may not exist in policy shipped with other versions of Fedora or other
>> operating systems.
>>
>> I'll keep these things in mind when the guide is forked for Red Hat
>> Enterprise Linux.
> 
> Given that M4 knowledge is required for anyone who does anything serious with 
> SE Linux, maybe you should write your documentation in M4.
At the moment the guide is for people who don't want to do anything too 
serious.
> 
> Some years ago I wrote my CV in M4 and had it produce about 10 different 
> versions (I also had a Makefile).  Then it a recruiting agent wanted a 
> version of my CV that emphasised my C coding experience I could just send the 
> relevant file.
> 
> The same technique could be used for any other document.  It would be good if 
> you could type "make" and produce documents for several versions of Fedora 
> and a couple of versions of RHEL at the same time.
> 
Our publishing tool, Publican[1], allows conditional tags, so all of the 
content could be one book, then make different versions using "make 
CONDITIONAL="fedora" and "make CONDITIONAL="rhel".

Thanks for the idea.

[1] <https://fedorahosted.org/publican>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.