[PATCH] (2/3) SELinux context mount support - NFS

[PATCH] (2/3) SELinux context mount support - NFS

[James Morris]

This patch modifies the kernel's NFS mount data structure to include 
SELinux context mount data.  It allows NFS fileystems to be labeled on a 
per-mountpoint basis, and should not affect existing versions of 
userspace mount.

(A patch to the userspace mount code is available at 
http://people.redhat.com/jmorris/selinux/context_mounts/)

 include/linux/nfs_mount.h |    4 +++-
 1 files changed, 3 insertions(+), 1 deletion(-)


diff -urN -X dontdiff linux-2.6.2.p/include/linux/nfs_mount.h linux-2.6.2.w/include/linux/nfs_mount.h
--- linux-2.6.2.p/include/linux/nfs_mount.h	2003-09-27 20:50:06.000000000 -0400
+++ linux-2.6.2.w/include/linux/nfs_mount.h	2004-02-04 09:08:10.306809336 -0500
@@ -20,7 +20,8 @@
  * mount-to-kernel version compatibility.  Some of these aren't used yet
  * but here they are anyway.
  */
-#define NFS_MOUNT_VERSION	5
+#define NFS_MOUNT_VERSION	6
+#define NFS_MAX_CONTEXT_LEN	256
 
 struct nfs_mount_data {
 	int		version;		/* 1 */
@@ -41,6 +42,7 @@
 	unsigned int	bsize;			/* 3 */
 	struct nfs3_fh	root;			/* 4 */
 	int		pseudoflavor;		/* 5 */
+	char		context[NFS_MAX_CONTEXT_LEN + 1];	/* 6 */
 };
 
 /* bits in the flags field */

Re: [PATCH] (2/3) SELinux context mount support - NFS

[Christoph Hellwig]

On Wed, Feb 04, 2004 at 10:31:51AM -0500, James Morris wrote:
> This patch modifies the kernel's NFS mount data structure to include 
> SELinux context mount data.  It allows NFS fileystems to be labeled on a 
> per-mountpoint basis, and should not affect existing versions of 
> userspace mount.

Wouldn't it better to integrate the NFS xattr code that SGI released under
the GPL  (it's IRIX, not linux code unfortunately)

Re: [PATCH] (2/3) SELinux context mount support - NFS

[Stephen Smalley]

On Wed, 2004-02-04 at 10:46, Christoph Hellwig wrote:
> On Wed, Feb 04, 2004 at 10:31:51AM -0500, James Morris wrote:
> > This patch modifies the kernel's NFS mount data structure to include 
> > SELinux context mount data.  It allows NFS fileystems to be labeled on a 
> > per-mountpoint basis, and should not affect existing versions of 
> > userspace mount.
> 
> Wouldn't it better to integrate the NFS xattr code that SGI released under
> the GPL  (it's IRIX, not linux code unfortunately)

That won't help with the case where the NFS server doesn't support the
protocol extensions for xattr or where the NFS client doesn't want to
trust contexts provided by the server.  There is work in progress to add
support for passing process and file contexts on NFS requests/replies,
but that won't eliminate the need for this functionality for unmodified
or untrusted NFS servers.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency