Re: SELinux on btrfs

[Russell Coker <russell@coker.com.au>]

On Sat, 12 Apr 2014 10:15:25 Chris Murphy wrote:
> >  I'm already aware that SELinux's automatic labelling of files is not
> >  aware of subvolumes[*].> 
> > [*] https://wiki.debian.org/SELinux/Setup#btrfs
> 
> I'm not sure exactly what it means since there is always a subvolume (ID 5),
> and I don't understand why autorelabel behavior would differ from manually
> running fixfiles or restorecon.

When you initially setup SE Linux on Debian you run the command "selinux-
activate" which configures GRUB and creates a 0 byte file named /.autorelabel .

On boot if /.autorelabel is detected (as it will on a first install of SE Linux 
or any time you have a serious labelling problem you want to fix) then a script 
will run that labels all files and reboots the system (to make daemons run with 
the correct context).  The script in question is not aware of subvolumes, so 
if you have writable subvolumes they won't be labelled.  So you just run 
"restorecon -R /subvol" to fix it.

I'm not sure whether fixfiles stops at "mount points" which includes subvols, 
restorecon -R shouldn't.

Note that I gave the full explanation for the lurkers.

> > I already have quite a few read-only snapshots that I don't want to
> > forfeit, however, I'm not at all sure how SELinux would interact with
> > them.
> If the default policy mismatches with the file context, the relabel or
> restorecon will want to change the context to the default, but won't be
> able to because it's a read-only subvolume. I merely get a non-fatal:
> 
> restorecon set context /boot/.bootsnap/grub2->system_u:object_r:boot_t:s0
> failed:'Read-only file system'
> 
> And it proceeds to the next file.

Those read-only files should have the type file_t and be readable by the 
sysadmin.  If you want a read-only filesystem that is correctly labelled you 
can make a read-write snapshot, label it, and then make a read-only snapshot 
of the new snapshot.


As an aside, BTRFS and SE Linux work really well together for me.  Much better 
than ZFS and SE Linux.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/