SELinux context not working

SELinux context not working

[Brian Chadwick]

Hi

I cant get file contexts to work with F2FS. I have tried a variety of 
kernels up to the latest 3.16rc1 with the Security Labels option 
selected in the config. I am using the latest git of f2fs-tools.

But when I try to set a security context I get the following:

chcon: failed to change context of ‘/mnt/f2fs/sig’ to 
‘system_u:--reference=/home/brian/sig:unlabeled_t:s0’: Operation not 
supported

cp -a also seems unable to set the correct context.

Is there a bug or am I missing something?

mount details are:

/dev/sda6 on /mnt/f2fs type f2fs 
(rw,relatime,background_gc=on,user_xattr,acl,active_logs=6)

Kind regards

Brian Chadwick

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems

Re: SELinux context not working

[Jaegeuk Kim]

Hi,

On Thu, Jun 19, 2014 at 08:32:43PM +1000, Brian Chadwick wrote:
> Hi
> 
> I cant get file contexts to work with F2FS. I have tried a variety of 
> kernels up to the latest 3.16rc1 with the Security Labels option 
> selected in the config. I am using the latest git of f2fs-tools.
> 
> But when I try to set a security context I get the following:
> 
> chcon: failed to change context of ‘/mnt/f2fs/sig’ to 
> ‘system_u:--reference=/home/brian/sig:unlabeled_t:s0’: Operation not 
> supported
> 
> cp -a also seems unable to set the correct context.
> 
> Is there a bug or am I missing something?
> 
> mount details are:
> 
> /dev/sda6 on /mnt/f2fs type f2fs 
> (rw,relatime,background_gc=on,user_xattr,acl,active_logs=6)

IMO, you missed -o seclabel.

Thanks,

> 
> Kind regards
> 
> Brian Chadwick
> 
> ------------------------------------------------------------------------------
> HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
> Find What Matters Most in Your Big Data with HPCC Systems
> Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
> Leverages Graph Analysis for Fast Processing & Easy Data Exploration
> http://p.sf.net/sfu/hpccsystems
> _______________________________________________
> Linux-f2fs-devel mailing list
> Linux-f2fs-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

-- 
Jaegeuk Kim

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: SELinux context not working

[Jaegeuk Kim]

Hi,

On Thu, Jun 19, 2014 at 10:14:22PM +1000, Brian Chadwick wrote:
> Hi again
> 
> I tried mounting with seclabel specifically stated, i.e.:
> 
> mount -t f2fs -o
> rw,relatime,background_gc=on,seclabel,user_xattr,acl,active_logs=6
> 
> The drive mounts successfully but seclabel is not listed as a mount
> option when I  use the mount command to list mounted devices and
> once again file contexts don't work.
> 
> I am using the latest util-linux .. ie 2.24.2
> 
> Any clues?

If so, I suspect your sepolicy.
Could you give me the following results?

# dmesg | grep SELinux

Thanks,

> 
> Thanks
> 
> Brian
> 
> On 19/06/14 21:27, Jaegeuk Kim wrote:
> >Hi,
> >
> >On Thu, Jun 19, 2014 at 08:32:43PM +1000, Brian Chadwick wrote:
> >>Hi
> >>
> >>I cant get file contexts to work with F2FS. I have tried a variety of
> >>kernels up to the latest 3.16rc1 with the Security Labels option
> >>selected in the config. I am using the latest git of f2fs-tools.
> >>
> >>But when I try to set a security context I get the following:
> >>
> >>chcon: failed to change context of ‘/mnt/f2fs/sig’ to
> >>‘system_u:--reference=/home/brian/sig:unlabeled_t:s0’: Operation not
> >>supported
> >>
> >>cp -a also seems unable to set the correct context.
> >>
> >>Is there a bug or am I missing something?
> >>
> >>mount details are:
> >>
> >>/dev/sda6 on /mnt/f2fs type f2fs
> >>(rw,relatime,background_gc=on,user_xattr,acl,active_logs=6)
> >IMO, you missed -o seclabel.
> >
> >Thanks,
> >
> >>Kind regards
> >>
> >>Brian Chadwick
> >>
> >>------------------------------------------------------------------------------
> >>HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
> >>Find What Matters Most in Your Big Data with HPCC Systems
> >>Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
> >>Leverages Graph Analysis for Fast Processing & Easy Data Exploration
> >>http://p.sf.net/sfu/hpccsystems
> >>_______________________________________________
> >>Linux-f2fs-devel mailing list
> >>Linux-f2fs-devel@lists.sourceforge.net
> >>https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

-- 
Jaegeuk Kim

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: SELinux context not working

[JP Abgrall]

On Thu, Jun 19, 2014 at 8:33 AM, Jaegeuk Kim <jaegeuk@kernel.org> wrote:
>> Any clues?
>
> If so, I suspect your sepolicy.
> Could you give me the following results?

I was stuck until:
  https://android-review.googlesource.com/#/c/96593/

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems

Re: SELinux context not working

[Jaegeuk Kim]

Hi,

On Fri, Jun 20, 2014 at 11:00:10AM +1000, Brian Chadwick wrote:
> On 20/06/14 01:33, Jaegeuk Kim wrote:
> >Hi,
> >
> >On Thu, Jun 19, 2014 at 10:14:22PM +1000, Brian Chadwick wrote:
> >>Hi again
> >>
> >>I tried mounting with seclabel specifically stated, i.e.:
> >>
> >>mount -t f2fs -o
> >>rw,relatime,background_gc=on,seclabel,user_xattr,acl,active_logs=6
> >>
> >>The drive mounts successfully but seclabel is not listed as a mount
> >>option when I  use the mount command to list mounted devices and
> >>once again file contexts don't work.
> >>
> >>I am using the latest util-linux .. ie 2.24.2
> >>
> >>Any clues?
> >If so, I suspect your sepolicy.
> >Could you give me the following results?
> >
> ># dmesg | grep SELinux
> >
> >Thanks,
> 
> the pertinent result is:
> 
> [12192.972271] SELinux: initialized (dev sda6, type f2fs), not
> configured for labeling
> 
> What do I need to add to SELinux?

Just for sure, you need to check the JP's reference.

Thanks,

> 
> 
> >>Thanks
> >>
> >>Brian
> >>
> >>On 19/06/14 21:27, Jaegeuk Kim wrote:
> >>>Hi,
> >>>
> >>>On Thu, Jun 19, 2014 at 08:32:43PM +1000, Brian Chadwick wrote:
> >>>>Hi
> >>>>
> >>>>I cant get file contexts to work with F2FS. I have tried a variety of
> >>>>kernels up to the latest 3.16rc1 with the Security Labels option
> >>>>selected in the config. I am using the latest git of f2fs-tools.
> >>>>
> >>>>But when I try to set a security context I get the following:
> >>>>
> >>>>chcon: failed to change context of ‘/mnt/f2fs/sig’ to
> >>>>‘system_u:--reference=/home/brian/sig:unlabeled_t:s0’: Operation not
> >>>>supported
> >>>>
> >>>>cp -a also seems unable to set the correct context.
> >>>>
> >>>>Is there a bug or am I missing something?
> >>>>
> >>>>mount details are:
> >>>>
> >>>>/dev/sda6 on /mnt/f2fs type f2fs
> >>>>(rw,relatime,background_gc=on,user_xattr,acl,active_logs=6)
> >>>IMO, you missed -o seclabel.
> >>>
> >>>Thanks,
> >>>
> >>>>Kind regards
> >>>>
> >>>>Brian Chadwick
> >>>>
> >>>>------------------------------------------------------------------------------
> >>>>HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
> >>>>Find What Matters Most in Your Big Data with HPCC Systems
> >>>>Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
> >>>>Leverages Graph Analysis for Fast Processing & Easy Data Exploration
> >>>>http://p.sf.net/sfu/hpccsystems
> >>>>_______________________________________________
> >>>>Linux-f2fs-devel mailing list
> >>>>Linux-f2fs-devel@lists.sourceforge.net
> >>>>https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

-- 
Jaegeuk Kim

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: SELinux context not working

[Jaegeuk Kim]

On Fri, Jun 20, 2014 at 03:15:49PM +1000, Brian Chadwick wrote:
> On 20/06/14 15:00, Jaegeuk Kim wrote:
> >Hi,
> >
> >On Fri, Jun 20, 2014 at 11:00:10AM +1000, Brian Chadwick wrote:
> >>On 20/06/14 01:33, Jaegeuk Kim wrote:
> >>>Hi,
> >>>
> >>>On Thu, Jun 19, 2014 at 10:14:22PM +1000, Brian Chadwick wrote:
> >>>>Hi again
> >>>>
> >>>>I tried mounting with seclabel specifically stated, i.e.:
> >>>>
> >>>>mount -t f2fs -o
> >>>>rw,relatime,background_gc=on,seclabel,user_xattr,acl,active_logs=6
> >>>>
> >>>>The drive mounts successfully but seclabel is not listed as a mount
> >>>>option when I  use the mount command to list mounted devices and
> >>>>once again file contexts don't work.
> >>>>
> >>>>I am using the latest util-linux .. ie 2.24.2
> >>>>
> >>>>Any clues?
> >>>If so, I suspect your sepolicy.
> >>>Could you give me the following results?
> >>>
> >>># dmesg | grep SELinux
> >>>
> >>>Thanks,
> >>the pertinent result is:
> >>
> >>[12192.972271] SELinux: initialized (dev sda6, type f2fs), not
> >>configured for labeling
> >>
> >>What do I need to add to SELinux?
> >Just for sure, you need to check the JP's reference.
> >
> >Thanks,
> 
> What is the JP's reference?

As JP replied to you, the link was

  https://android-review.googlesource.com/#/c/96593/

Thanks,

> 
> Thanks
> 
> >
> >>
> >>>>Thanks
> >>>>
> >>>>Brian
> >>>>
> >>>>On 19/06/14 21:27, Jaegeuk Kim wrote:
> >>>>>Hi,
> >>>>>
> >>>>>On Thu, Jun 19, 2014 at 08:32:43PM +1000, Brian Chadwick wrote:
> >>>>>>Hi
> >>>>>>
> >>>>>>I cant get file contexts to work with F2FS. I have tried a variety of
> >>>>>>kernels up to the latest 3.16rc1 with the Security Labels option
> >>>>>>selected in the config. I am using the latest git of f2fs-tools.
> >>>>>>
> >>>>>>But when I try to set a security context I get the following:
> >>>>>>
> >>>>>>chcon: failed to change context of ‘/mnt/f2fs/sig’ to
> >>>>>>‘system_u:--reference=/home/brian/sig:unlabeled_t:s0’: Operation not
> >>>>>>supported
> >>>>>>
> >>>>>>cp -a also seems unable to set the correct context.
> >>>>>>
> >>>>>>Is there a bug or am I missing something?
> >>>>>>
> >>>>>>mount details are:
> >>>>>>
> >>>>>>/dev/sda6 on /mnt/f2fs type f2fs
> >>>>>>(rw,relatime,background_gc=on,user_xattr,acl,active_logs=6)
> >>>>>IMO, you missed -o seclabel.
> >>>>>
> >>>>>Thanks,
> >>>>>
> >>>>>>Kind regards
> >>>>>>
> >>>>>>Brian Chadwick
> >>>>>>
> >>>>>>------------------------------------------------------------------------------
> >>>>>>HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
> >>>>>>Find What Matters Most in Your Big Data with HPCC Systems
> >>>>>>Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
> >>>>>>Leverages Graph Analysis for Fast Processing & Easy Data Exploration
> >>>>>>http://p.sf.net/sfu/hpccsystems
> >>>>>>_______________________________________________
> >>>>>>Linux-f2fs-devel mailing list
> >>>>>>Linux-f2fs-devel@lists.sourceforge.net
> >>>>>>https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

-- 
Jaegeuk Kim

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

Re: SELinux context not working

[Jaegeuk Kim]

Hi,

On Fri, Jun 20, 2014 at 10:50:27PM +1000, Brian Chadwick wrote:
> On 20/06/14 16:21, Jaegeuk Kim wrote:
> >On Fri, Jun 20, 2014 at 03:15:49PM +1000, Brian Chadwick wrote:
> >>On 20/06/14 15:00, Jaegeuk Kim wrote:
> >>>Hi,
> >>>
> >>>On Fri, Jun 20, 2014 at 11:00:10AM +1000, Brian Chadwick wrote:
> >>>>On 20/06/14 01:33, Jaegeuk Kim wrote:
> >>>>>Hi,
> >>>>>
> >>>>>On Thu, Jun 19, 2014 at 10:14:22PM +1000, Brian Chadwick wrote:
> >>>>>>Hi again
> >>>>>>
> >>>>>>I tried mounting with seclabel specifically stated, i.e.:
> >>>>>>
> >>>>>>mount -t f2fs -o
> >>>>>>rw,relatime,background_gc=on,seclabel,user_xattr,acl,active_logs=6
> >>>>>>
> >>>>>>The drive mounts successfully but seclabel is not listed as a mount
> >>>>>>option when I  use the mount command to list mounted devices and
> >>>>>>once again file contexts don't work.
> >>>>>>
> >>>>>>I am using the latest util-linux .. ie 2.24.2
> >>>>>>
> >>>>>>Any clues?
> >>>>>If so, I suspect your sepolicy.
> >>>>>Could you give me the following results?
> >>>>>
> >>>>># dmesg | grep SELinux
> >>>>>
> >>>>>Thanks,
> >>>>the pertinent result is:
> >>>>
> >>>>[12192.972271] SELinux: initialized (dev sda6, type f2fs), not
> >>>>configured for labeling
> >>>>
> >>>>What do I need to add to SELinux?
> >>>Just for sure, you need to check the JP's reference.
> >>>
> >>>Thanks,
> >>What is the JP's reference?
> >As JP replied to you, the link was
> >
> >   https://android-review.googlesource.com/#/c/96593/
> that link mentions "ocontext" ... i have no idea what that is .. i
> have googled to no avail

You need to use a mount option for selinx context.
e.g., -o context=system_u:object_r:var_log_t

This is because the default sepolicy doesn't include f2fs as their fscontext.

Ref: http://www.redhat.com/f/pdf/whitepapers/Filesystem_Labeling_SELinux.pdf

Thanks,

> 
> thanks
> 
> 
> >
> >Thanks,
> >
> >>Thanks
> >>
> >>>>>>Thanks
> >>>>>>
> >>>>>>Brian
> >>>>>>
> >>>>>>On 19/06/14 21:27, Jaegeuk Kim wrote:
> >>>>>>>Hi,
> >>>>>>>
> >>>>>>>On Thu, Jun 19, 2014 at 08:32:43PM +1000, Brian Chadwick wrote:
> >>>>>>>>Hi
> >>>>>>>>
> >>>>>>>>I cant get file contexts to work with F2FS. I have tried a variety of
> >>>>>>>>kernels up to the latest 3.16rc1 with the Security Labels option
> >>>>>>>>selected in the config. I am using the latest git of f2fs-tools.
> >>>>>>>>
> >>>>>>>>But when I try to set a security context I get the following:
> >>>>>>>>
> >>>>>>>>chcon: failed to change context of ‘/mnt/f2fs/sig’ to
> >>>>>>>>‘system_u:--reference=/home/brian/sig:unlabeled_t:s0’: Operation not
> >>>>>>>>supported
> >>>>>>>>
> >>>>>>>>cp -a also seems unable to set the correct context.
> >>>>>>>>
> >>>>>>>>Is there a bug or am I missing something?
> >>>>>>>>
> >>>>>>>>mount details are:
> >>>>>>>>
> >>>>>>>>/dev/sda6 on /mnt/f2fs type f2fs
> >>>>>>>>(rw,relatime,background_gc=on,user_xattr,acl,active_logs=6)
> >>>>>>>IMO, you missed -o seclabel.
> >>>>>>>
> >>>>>>>Thanks,
> >>>>>>>
> >>>>>>>>Kind regards
> >>>>>>>>
> >>>>>>>>Brian Chadwick
> >>>>>>>>
> >>>>>>>>------------------------------------------------------------------------------
> >>>>>>>>HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
> >>>>>>>>Find What Matters Most in Your Big Data with HPCC Systems
> >>>>>>>>Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
> >>>>>>>>Leverages Graph Analysis for Fast Processing & Easy Data Exploration
> >>>>>>>>http://p.sf.net/sfu/hpccsystems
> >>>>>>>>_______________________________________________
> >>>>>>>>Linux-f2fs-devel mailing list
> >>>>>>>>Linux-f2fs-devel@lists.sourceforge.net
> >>>>>>>>https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel

-- 
Jaegeuk Kim

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel