Kernel Korner - Filesystem Labeling in SELinux
Although it is possible to assign security context labels to NFS mounted filesystems, they operate only locally for access control decisions within the kernel. No labels are transmitted across the network with files. Work has been advancing in this area, with SELinux-specific modifications being made to the NFSv2/v3 protocols and code. Further down the track, NFSv4 integration is expected to involve labeling over the wire by way of named attributes, which are part of the more extensible NFSv4 specification. This would allow both the NFS client and server to implement SELinux security for networked files. Support for other networked filesystems also would be useful, as would interoperability with Trusted BSD's SELinux port.
Backup and Restoration
One of the many tasks that change for system administrators using SELinux is backup and restoration. When creating an archive, how will the security context labels be preserved within the archive? The answer is to use the highly flexible star(1) utility, which has extended attribute support.
To manipulate archives with security context labels, use the xattr option. When creating archives, you also need to specify the exustar format. For example:
$ star -xattr -H=exustar -c -f cups-log.star /var/log/cups
creates an archive of the /var/log/cups directory, retaining security context labels on the files.
To extract, simply use the xattr option:
$ star -xattr -x -f cups-log.star $ ls -Z var/log/cups/ -rw-r--r--+ root sys system_u:object_r:cupsd_log_t error_log -rw-r--r--+ root sys system_u:object_r:cupsd_log_t error_log.1
As you can see, the security context labels have been preserved.
Resources for this article: /article/7689.
James Morris (email@example.com) is a kernel hacker from Sydney, Australia, currently working for Red Hat in Boston. He is a kernel maintainer of SELinux, Networking and the Crypto API; an LSM developer and an Emeritus Netfilter Core Team member.
|Android Candy: That App Is for the Birds!||Mar 22, 2017|
|Hodge Podge||Mar 21, 2017|
|William Rothwell and Nick Garner's Certified Ethical Hacker Complete Video Course (Pearson IT Certification)||Mar 20, 2017|
|Preseeding Full Disk Encryption||Mar 16, 2017|
|William Gurstelle's ReMaking History, Volume 3 (Maker Media, Inc.)||Mar 15, 2017|
|GRUB Boot from ISO||Mar 14, 2017|
- Hodge Podge
- Two Ways GDPR Will Change Your Data Storage Solution
- Android Candy: That App Is for the Birds!
- Flash ROMs with a Raspberry Pi
- Preseeding Full Disk Encryption
- Minifree Ltd.'s GNU+Linux Computers
- NETGEAR, Inc.'s GSS108EPP and GS408EPP Switches
- GRUB Boot from ISO
- William Gurstelle's ReMaking History, Volume 3 (Maker Media, Inc.)