From: "Christopher J. PeBenito" <cpebenito@tresys.com>
To: Rob Shelley <Rob@cirris.com>
Cc: "selinux@tycho.nsa.gov" <selinux@tycho.nsa.gov>
Subject: Re: Filesystem module
Date: Tue, 26 Mar 2013 12:56:47 -0400 [thread overview]
Message-ID: <5151D34F.7090204@tresys.com> (raw)
In-Reply-To: <71EBD3EA436C4B47B4A5FEFEB7370793389F07D5@Mail.cirris.com>
On 03/25/13 17:14, Rob Shelley wrote:
> I am evaluating OCFS2 on a CentOS 6.3 cluster and have run into a little bit of a snag with SELinux. After the OCFS2 partition is mounted no writes can be performed to the shared device from either node because they are being blocked by SELinux. The core of the issue is that the CentOS default policy does not list OCFS2 as a filesystem that supports xattrs in filesystem.te. It's a one line fix:
>
> fs_use_xattr ocfs2 gen_context(system_u:object_r:fs_t,s0);
>
> However, it would seem that the only way to implement this change in filesystem.te is by rebuilding the base policy. (I have not found a way to just reload the filesytem module of the base policy.) And even if there were an easy way to reload just the filesystem module of the base policy I believe this would be overwritten if an update is released.
>
> So, I was wondering if there was a way to incorporate this line into a module, say ocfs2.te. My initial attempts have failed, but I am assuming that is because I do not have the correct dependencies listed in the require section.
>
> Any suggestions?
Unfortunately you can only add fs_use statements to the base module, so you'd have to rebuild the base module.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2013-03-26 16:57 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-25 21:14 Filesystem module Rob Shelley
2013-03-26 16:56 ` Christopher J. PeBenito [this message]
2013-03-26 18:56 ` Daniel J Walsh
2013-03-28 14:13 ` David Quigley
2013-04-01 17:38 ` Eric Paris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5151D34F.7090204@tresys.com \
--to=cpebenito@tresys.com \
--cc=Rob@cirris.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.