I am trying to mount ecryptfs on a system that uses SELinux (e.g. Cent-OS), and I want to preserve the security tag of all individual underlying files. Using
mount -o command I can set the security tag of all files, e.g.
mount -t ecryptfs /var/lib/mysql /var/lib/mysql -o context="system_u:object_r:mysqld_db_t:s0"
which is not what I want. As far as I know, ecryptfs supports extended attributes, and functions such as
ecryptfs_getxattr are defined in the file
inode.c of ecryptfs kernel module.
In addition, from
man mount the option
fscontext seems to do exactly what I want:
The fscontext= option works for all filesystems, regardless of their xattr support. The fscontext option sets the overarching filesystem label to a specific security context. This filesystem label is separate from the individual labels on the files. It represents the entire filesystem for certain kinds of permission checks, such as during mount or file creation. Individual file labels are still obtained from the xattrs on the files themselves. The context option actually sets the aggregate context that fscontext provides, in addition to supplying the same label for individual files.
Still the following command
mount -t ecryptfs /var/lib/mysql /var/lib/mysql -o fscontext="system_u:object_r:mysqld_db_t:s0"
changes the SELinux tag of all files to
system_u:object_r:mysqld_db_t:s0, even for the file
/var/lib/mysql/mysql.sock with the original tag
1) How can I mount ecryptfs on a directory and preserve the security tags (i.e. SELinux tags) of each file?
2) Why doesn't
mount -o fscontext work for ecryptfs as it suppose to?
Note: I am using mysql directory just as an example, I was able to add policy modules to SELinux and make mysqld work when ecryptfs is mounted on top. Here, I am asking for a general solution to make ecryptfs transparent to SELinux.