0

The Mandatory Access Controls or MAC labels are different for NFS which are different for httpd, and different yet again for SaMBa. What is the proper way nowadays to label a SINGLE shared filesystem hierarchy on the server such that it is properly re-labelled by restorecon, can be accessed successfully server-side by all three services, and survives system updates?

In other words, when the server side fs hierarchy is labelled for sharing over NFS, then that breaks access by httpd and smb daemons on the same server. If labelled for httpd, then NFS and SMB services stop sharing because the files are labelled httpd only, so are denied rw. And finally, SMB Labels break both NFS and httpd services.

Is their a modern devops approach to this such as an Ansible playlist? I had made custom labels before but having to remake them after system updates caused too much friction. Wondering if custom labels are still the way, but now with automation?

Improve this question
  • Please clarify what you are asking. Did you try this in Ansible without success? – 0xSheepdog Jan 2 '20 at 0:27
  • Many years ago, this problem only had manual solutions that i did not find easy, nevermind automated. Have not tried Ansible but wonder if it might help to make a custom label policy or module that is applied to the single share when yum provides updates. – rjt Jan 2 '20 at 5:25
0

If you have an NFS server that supports “security_label” in NFSv4.2, then you can create an export that supports the extended attributes used for SELinux labels. I’m not aware of any working smb implementations (perhaps the Posix extension in SMB3 will get it in the future?).

Otherwise, if you need a particular directory that is mounted via NFS to have a particular label, use the context=“mylabel_t” mount option. It will have that context for all files and directories offered by that share.

The SELinux policy also has Booleans for various services to allow them to read from nfs and smb shares.

Edit: If you are exporting a directory (call it /data) via nfs, smb and http, try using public_content_t:

# semanage fcontext -a -t public_content_t "/data(/.*)?" 

# restorecon -F -R -v /data
Improve this answer
  • i need to rewrite the question. On the server console, how would one label a single share to be accessible by NFS, httpd, and SMB? – rjt Jan 3 '20 at 22:06
  • When you say “server” do you mean the NFS server that is exporting the share to be mounted on the client? – jsbillings Jan 4 '20 at 0:04
  • There is only one server. It serves nfs, smb, and httpd from the exact same folder hierarchy on the server aide filesystem. Expound on the last paragraph in your answer having to do with selinux policy to read from nfs and smb shares by setting booleans. – rjt Jan 4 '20 at 20:42
  • The last sentence was about selinux booleans but I doubt it’ll make any difference, that’s more for serving http content off an nfs or smb share. If you’re exporting a single space as both NFS, SMB and HTTP, it might require a custom policy module that allows all three services. The process for doing that is pretty more complex than a comment can describe. – jsbillings Jan 5 '20 at 0:04
  • That is exactly the intent of my question. – rjt Jan 5 '20 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.