Diskless system running SELinux

Diskless system running SELinux

[Andrew Ruch]

Hello,

I'm researching deploying a diskless system that would use PXEBoot and
NFS for it's storage. I believe this capability has been proven and
have no issues here. The tricky part is this system must also have
Mandatory Access Control. I thought RHEL 7.2 was the answer due to
it's support of labeled NFS. However, Red Hat just told me that having
an SELinux-labeled, remote root partition is unsupported. What wasn't
clear was if the problem was in RHEL or something upstream.

Does the kernel support a labeled, remote root partition? If so, which
distributions support this?


Thanks,
Andrew Ruch

Re: Diskless system running SELinux

[Daniel J Walsh]

On 01/07/2016 04:48 PM, Andrew Ruch wrote:
> Hello,
>
> I'm researching deploying a diskless system that would use PXEBoot and
> NFS for it's storage. I believe this capability has been proven and
> have no issues here. The tricky part is this system must also have
> Mandatory Access Control. I thought RHEL 7.2 was the answer due to
> it's support of labeled NFS. However, Red Hat just told me that having
> an SELinux-labeled, remote root partition is unsupported. What wasn't
> clear was if the problem was in RHEL or something upstream.
>
> Does the kernel support a labeled, remote root partition? If so, which
> distributions support this?
>
>
> Thanks,
> Andrew Ruch
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>
>
I just think no one has ever tried this.  If the remote system is setup
with nfs labeling, theoretically this
should work.

Not only rhel7 supports labeled networking on the server and client, to
the best of my knowleged.

Not sure if NetApp or EMC support it yet.

Re: Diskless system running SELinux

[Andrew Ruch]

On Thu, Jan 7, 2016 at 3:21 PM, Daniel J Walsh <dwalsh@redhat.com> wrote:
>
>
> On 01/07/2016 04:48 PM, Andrew Ruch wrote:
>> Hello,
>>
>> I'm researching deploying a diskless system that would use PXEBoot and
>> NFS for it's storage. I believe this capability has been proven and
>> have no issues here. The tricky part is this system must also have
>> Mandatory Access Control. I thought RHEL 7.2 was the answer due to
>> it's support of labeled NFS. However, Red Hat just told me that having
>> an SELinux-labeled, remote root partition is unsupported. What wasn't
>> clear was if the problem was in RHEL or something upstream.
>>
>> Does the kernel support a labeled, remote root partition? If so, which
>> distributions support this?
>>
>>
>> Thanks,
>> Andrew Ruch
>> _______________________________________________
>> Selinux mailing list
>> Selinux@tycho.nsa.gov
>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
>> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>>
>>
> I just think no one has ever tried this.  If the remote system is setup
> with nfs labeling, theoretically this
> should work.
>
> Not only rhel7 supports labeled networking on the server and client, to
> the best of my knowleged.
>
> Not sure if NetApp or EMC support it yet.

Hmmm...  Red Hat Support referred me to an installation guide [1] at
the very bottom of section 2.2. It says that SELinux must be disabled
for diskless clients that use NFS as the root file system. I'm not
trying to use RHEL for Real Time so I'll do some experimenting to see
what I can figure out.

Thanks,
Andrew


[1] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux_for_Real_Time/7/html/Installation_Guide/Installing_Real_Time_Using_Diskless_Boot.html

Re: Diskless system running SELinux

[Daniel J Walsh]

On 01/07/2016 05:38 PM, Andrew Ruch wrote:
> On Thu, Jan 7, 2016 at 3:21 PM, Daniel J Walsh <dwalsh@redhat.com> wrote:
>>
>> On 01/07/2016 04:48 PM, Andrew Ruch wrote:
>>> Hello,
>>>
>>> I'm researching deploying a diskless system that would use PXEBoot and
>>> NFS for it's storage. I believe this capability has been proven and
>>> have no issues here. The tricky part is this system must also have
>>> Mandatory Access Control. I thought RHEL 7.2 was the answer due to
>>> it's support of labeled NFS. However, Red Hat just told me that having
>>> an SELinux-labeled, remote root partition is unsupported. What wasn't
>>> clear was if the problem was in RHEL or something upstream.
>>>
>>> Does the kernel support a labeled, remote root partition? If so, which
>>> distributions support this?
>>>
>>>
>>> Thanks,
>>> Andrew Ruch
>>> _______________________________________________
>>> Selinux mailing list
>>> Selinux@tycho.nsa.gov
>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
>>> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>>>
>>>
>> I just think no one has ever tried this.  If the remote system is setup
>> with nfs labeling, theoretically this
>> should work.
>>
>> Not only rhel7 supports labeled networking on the server and client, to
>> the best of my knowleged.
>>
>> Not sure if NetApp or EMC support it yet.
> Hmmm...  Red Hat Support referred me to an installation guide [1] at
> the very bottom of section 2.2. It says that SELinux must be disabled
> for diskless clients that use NFS as the root file system. I'm not
> trying to use RHEL for Real Time so I'll do some experimenting to see
> what I can figure out.
>
> Thanks,
> Andrew
>
>
> [1] https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux_for_Real_Time/7/html/Installation_Guide/Installing_Real_Time_Using_Diskless_Boot.html
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>
>
Right, because in most cases NFS will not support labels.  This probably
should be changed to say it is not supported unless you set up labeled
networking on client /server (And it actually works.)  If you prove that
it can work, I can work to get the Support changed.

Re: Diskless system running SELinux

[Russell Coker]

Sorry for the late reply, but have you considered iSCSI, NBD, and other similar things?

On 8 January 2016 8:48:21 am AEDT, Andrew Ruch <adruch2002@gmail.com> wrote:
>Hello,
>
>I'm researching deploying a diskless system that would use PXEBoot and
>NFS for it's storage. I believe this capability has been proven and
>have no issues here. The tricky part is this system must also have
>Mandatory Access Control. I thought RHEL 7.2 was the answer due to
>it's support of labeled NFS. However, Red Hat just told me that having
>an SELinux-labeled, remote root partition is unsupported. What wasn't
>clear was if the problem was in RHEL or something upstream.
>
>Does the kernel support a labeled, remote root partition? If so, which
>distributions support this?
>
>
>Thanks,
>Andrew Ruch
>_______________________________________________
>Selinux mailing list
>Selinux@tycho.nsa.gov
>To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
>To get help, send an email containing "help" to
>Selinux-request@tycho.nsa.gov.

-- 
Sent from my Nexus 6P with K-9 Mail.