Kernel Korner - Filesystem Labeling in SELinux
Although it is possible to assign security context labels to NFS mounted filesystems, they operate only locally for access control decisions within the kernel. No labels are transmitted across the network with files. Work has been advancing in this area, with SELinux-specific modifications being made to the NFSv2/v3 protocols and code. Further down the track, NFSv4 integration is expected to involve labeling over the wire by way of named attributes, which are part of the more extensible NFSv4 specification. This would allow both the NFS client and server to implement SELinux security for networked files. Support for other networked filesystems also would be useful, as would interoperability with Trusted BSD's SELinux port.
Backup and Restoration
One of the many tasks that change for system administrators using SELinux is backup and restoration. When creating an archive, how will the security context labels be preserved within the archive? The answer is to use the highly flexible star(1) utility, which has extended attribute support.
To manipulate archives with security context labels, use the xattr option. When creating archives, you also need to specify the exustar format. For example:
$ star -xattr -H=exustar -c -f cups-log.star /var/log/cups
creates an archive of the /var/log/cups directory, retaining security context labels on the files.
To extract, simply use the xattr option:
$ star -xattr -x -f cups-log.star $ ls -Z var/log/cups/ -rw-r--r--+ root sys system_u:object_r:cupsd_log_t error_log -rw-r--r--+ root sys system_u:object_r:cupsd_log_t error_log.1
As you can see, the security context labels have been preserved.
Resources for this article: /article/7689.
James Morris (email@example.com) is a kernel hacker from Sydney, Australia, currently working for Red Hat in Boston. He is a kernel maintainer of SELinux, Networking and the Crypto API; an LSM developer and an Emeritus Netfilter Core Team member.
- Readers' Choice Awards 2013
- A Plexible Pi
- Linux Kernel News - November 2013
- Advanced Hard Drive Caching Techniques
- Sublime Text: One Editor to Rule Them All?
- Mars Needs Women
- Raspberry Pi: the Perfect Home Server
- Tech Tip: Really Simple HTTP Server with Python
- December 2013 Issue of Linux Journal: Readers' Choice
- RSS Feeds
- Reply to comment | Linux Journal
11 min 50 sec ago
- rilakkuma onesie
2 hours 47 min ago
- flying squirrel onesie
2 hours 49 min ago
- animal onesies for adults
2 hours 51 min ago
- animal onesies
2 hours 53 min ago
- stitch onesie
2 hours 53 min ago
- totoro onesie
2 hours 55 min ago
- dinosaur onesie
2 hours 59 min ago
- pikachu onesie
3 hours 3 min ago
- While copy.com is nice, it's
8 hours 5 min ago