0

So, now that I've figured out that .ssh files need the ssh_home_t file context, now I need to figure out how to nest SELinux rules.

My first problem is that I can't find any list of SELinux file contexts that describe what they're intended use is. So, I may be off, here. I think I need to do three things, in this order:

  1. Set every directory matching /exports/home/$USER to nfs_t without also matching any subdirectories under $USER. This tells my NFS server that home directories may legally be exported.
  2. Set everything matching /exports/home/$USER/.* to... something? This is where a comprehensive list with descriptions would be handy. Does SELinux have a file context that generally designates files in a user's home directory?
  3. Set everything matching /exports/home/$USER/\.ssh(/.*) only to ssh_home_t, so SSHD can permit the use of authorized_keys.

I need to invoke all three rules from the NFS server. And, I need to invoke the second and third rules as an individual user on that individual user's files from any host mounting the home directory. Because, obviously I hope, I will be squashing root on any host that mounts one of these home directories. A user is most likely to be creating files, including ssh files, from a host that isn't the NFS server.


UPDATE

I think I've figured out the right file contexts. Now, I just need to figure out the right regular expressions.

# semanage fcontext -a nfs_t '<regexp 1>'

# semanage fcontext -a user_home_t '<regexp 2>'

# semanage fcontext -a ssh_home_t '<regexp 3>'

where

  • <regexp 1> catches /exports/home/$USER and doesn't go any further.
  • <regexp 2> catches /exports/home/$USER\.* except for exports/home/$USER/\.ssh(/.*)?.
  • <regexp 3> catches exports/home/$USER/\.ssh(/.*)?.

and $USER is string agnostic (ie. any user), and POSIX Extended Regular Expressions appear to be disallowed.

1 Answer 1

1

An easy, forehead-banging answer:

SELinux already has a default rule for `/export/home/*. Just drop the "s" and I was fixed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .