0

So, now that I've figured out that .ssh files need the ssh_home_t file context, now I need to figure out how to nest SELinux rules.

My first problem is that I can't find any list of SELinux file contexts that describe what they're intended use is. So, I may be off, here. I think I need to do three things, in this order:

  1. Set every directory matching /exports/home/$USER to nfs_t without also matching any subdirectories under $USER. This tells my NFS server that home directories may legally be exported.
  2. Set everything matching /exports/home/$USER/.* to... something? This is where a comprehensive list with descriptions would be handy. Does SELinux have a file context that generally designates files in a user's home directory?
  3. Set everything matching /exports/home/$USER/\.ssh(/.*) only to ssh_home_t, so SSHD can permit the use of authorized_keys.

I need to invoke all three rules from the NFS server. And, I need to invoke the second and third rules as an individual user on that individual user's files from any host mounting the home directory. Because, obviously I hope, I will be squashing root on any host that mounts one of these home directories. A user is most likely to be creating files, including ssh files, from a host that isn't the NFS server.


UPDATE

I think I've figured out the right file contexts. Now, I just need to figure out the right regular expressions.

# semanage fcontext -a nfs_t '<regexp 1>'

# semanage fcontext -a user_home_t '<regexp 2>'

# semanage fcontext -a ssh_home_t '<regexp 3>'

where

  • <regexp 1> catches /exports/home/$USER and doesn't go any further.
  • <regexp 2> catches /exports/home/$USER\.* except for exports/home/$USER/\.ssh(/.*)?.
  • <regexp 3> catches exports/home/$USER/\.ssh(/.*)?.

and $USER is string agnostic (ie. any user), and POSIX Extended Regular Expressions appear to be disallowed.

1

An easy, forehead-banging answer:

SELinux already has a default rule for `/export/home/*. Just drop the "s" and I was fixed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.