Kernel Korner - Filesystem Labeling in SELinux
Although it is possible to assign security context labels to NFS mounted filesystems, they operate only locally for access control decisions within the kernel. No labels are transmitted across the network with files. Work has been advancing in this area, with SELinux-specific modifications being made to the NFSv2/v3 protocols and code. Further down the track, NFSv4 integration is expected to involve labeling over the wire by way of named attributes, which are part of the more extensible NFSv4 specification. This would allow both the NFS client and server to implement SELinux security for networked files. Support for other networked filesystems also would be useful, as would interoperability with Trusted BSD's SELinux port.
Backup and Restoration
One of the many tasks that change for system administrators using SELinux is backup and restoration. When creating an archive, how will the security context labels be preserved within the archive? The answer is to use the highly flexible star(1) utility, which has extended attribute support.
To manipulate archives with security context labels, use the xattr option. When creating archives, you also need to specify the exustar format. For example:
$ star -xattr -H=exustar -c -f cups-log.star /var/log/cups
creates an archive of the /var/log/cups directory, retaining security context labels on the files.
To extract, simply use the xattr option:
$ star -xattr -x -f cups-log.star $ ls -Z var/log/cups/ -rw-r--r--+ root sys system_u:object_r:cupsd_log_t error_log -rw-r--r--+ root sys system_u:object_r:cupsd_log_t error_log.1
As you can see, the security context labels have been preserved.
Resources for this article: /article/7689.
James Morris (firstname.lastname@example.org) is a kernel hacker from Sydney, Australia, currently working for Red Hat in Boston. He is a kernel maintainer of SELinux, Networking and the Crypto API; an LSM developer and an Emeritus Netfilter Core Team member.
- Readers' Choice Awards 2013
- IBM Will Minimize Impact of Future Disasters
- December 2013 Issue of Linux Journal: Readers' Choice
- Sublime Text: One Editor to Rule Them All?
- RSS Feeds
- Raspberry Pi: the Perfect Home Server
- Tech Tip: Really Simple HTTP Server with Python
- Linux Systems Administrator
- New Products
- Senior Perl Developer
24 min 51 sec ago
- yes it's Jupiter Broadcasting
1 hour 44 min ago
- nice to see PClinuxOS finally
4 hours 17 min ago
- Personally, I am no longer a
5 hours 14 min ago
- Reply to comment | Linux Journal
18 hours 39 min ago
- It's Jupiter
19 hours 39 min ago
- GIMP is certainly a graphic
20 hours 41 min ago
- Thanks For Your Sharing
1 day 1 hour ago
- Studying linux, and looking
1 day 4 hours ago
- voting for Best Linux Distribution
1 day 13 hours ago