Re: [PATCH] xfstests: mount xfs with a context when selinux is on

From: Eric Sandeen <sandeen@sandeen.net>
To: Dave Chinner <david@fromorbit.com>
Cc: xfs mailing list <xfs@oss.sgi.com>
Subject: Re: [PATCH] xfstests: mount xfs with a context when selinux is on
Date: Thu, 18 Feb 2010 16:54:05 -0600	[thread overview]
Message-ID: <4B7DC50D.7070507@sandeen.net> (raw)
In-Reply-To: <4B7DB95B.4060506@sandeen.net>

Eric Sandeen wrote:
> Dave Chinner wrote:
>> On Wed, Feb 17, 2010 at 01:12:24PM -0600, Eric Sandeen wrote:
>>> When selinux is on, we get tons of new xattrs, which messes
>>> up all kinds of output.
>>>
>>> The simplest way out of this, for now, seems to be to just mount
>>> with a global context instead and skip writing the extra xattrs.
>>>
>>> I've been using this internally on Fedora and RHEL for a while now.
>>>
>>> Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
>> I know very little about selinux, so while the code changes look OK
>> I have no idea if the context change is All Goodness.
>>
>>> --- a/common.rc
>>> +++ b/common.rc
>>> @@ -47,8 +47,16 @@ _ls_l()
>>>  
>>>  _mount_opts()
>>>  {
>>> +    # SELinux adds extra xattrs which can mess up our expected output.
>>> +    # So, mount with a context, and they won't be created
>>> +    # nfs_t is a "liberal" context so we can use it.
>>> +    if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
>>> +	SELINUX_MOUNT_OPTIONS="-o context=system_u:object_r:nfs_t:s0"
>>> +    fi
>>> +
>> i.e. is t_nfs a context specific to a RHEL/Fedora setup, or is it a
>> generic context that other distro's also define?
> 
> I'll ask; I think this is what they told me to use last time, but I
> didn't ask if it was policy-specific...

our selinux guys still recommend this context as suitably generic.

-Eric

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs