From: David Michael <fedora.dm0@gmail.com>
To: linux-erofs@lists.ozlabs.org
Subject: SELinux labels not defined
Date: Sat, 02 Oct 2021 18:50:55 -0400 [thread overview]
Message-ID: <8735pjoxbk.fsf@gmail.com> (raw)
Hi,
I tried to make an SELinux-labeled EROFS image, and the image itself
seems to contain the labels from a hex dump, but the mounted files are
all unlabeled:
# ls -lZ xml
total 8
drwxr-xr-x. 2 root root unconfined_u:object_r:var_t:s0 4096 Sep 29 21:43 dbus-1
drwxr-xr-x. 2 root root unconfined_u:object_r:fonts_cache_t:s0 4096 Sep 29 22:19 fontconfig
# mkfs.erofs test.img xml
mkfs.erofs 1.3-g4e183568-dirty
c_version: [1.3-g4e183568-dirty]
c_dbg_lvl: [ 2]
c_dry_run: [ 0]
# mount -o X-mount.mkdir test.img test
# ls -lZ test
total 8
drwxr-xr-x. 2 root root system_u:object_r:unlabeled_t:s0 78 Oct 2 18:37 dbus-1
drwxr-xr-x. 2 root root system_u:object_r:unlabeled_t:s0 48 Oct 2 18:37 fontconfig
This is running on the current Fedora kernel 5.14.9-200.fc34.x86_64 with
the relevant config options:
CONFIG_EROFS_FS=m
# CONFIG_EROFS_FS_DEBUG is not set
CONFIG_EROFS_FS_XATTR=y
CONFIG_EROFS_FS_POSIX_ACL=y
CONFIG_EROFS_FS_SECURITY=y
CONFIG_EROFS_FS_ZIP=y
I tried the earliest kernel in Fedora 34 (5.11.12-300.fc34.x86_64), and
it also has the same issue. However, the earliest kernel in Fedora 33
(5.8.15-301.fc33.x86_64) has the correct labels when the image is
mounted. Is there a problem in the file system driver, or do I need to
do something different for newer kernels?
Thanks.
David
next reply other threads:[~2021-10-02 22:51 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-02 22:50 David Michael [this message]
2021-10-03 4:38 ` SELinux labels not defined Gao Xiang
2021-10-04 0:31 ` David Michael
2021-10-04 1:44 ` Gao Xiang
2021-10-04 4:10 ` Gao Xiang
2021-10-09 13:31 ` David Michael
2021-10-09 13:48 ` Gao Xiang
2021-10-04 3:59 ` [PATCH] Add erofs as a SELinux capable file system Gao Xiang
2021-10-05 18:50 ` Chris PeBenito via Linux-erofs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8735pjoxbk.fsf@gmail.com \
--to=fedora.dm0@gmail.com \
--cc=linux-erofs@lists.ozlabs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox