c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2026-05-22 10:37:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

Add full SELinux support

Browse Source 
Four new dataset properties have been added to support SELinux.  They
are 'context', 'fscontext', 'defcontext' and 'rootcontext' which map
directly to the context options described in mount(8).  When one of
these properties is set to something other than 'none'.  That string
will be passed verbatim as a mount option for the given context when
the filesystem is mounted.

For example, if you wanted the rootcontext for a filesystem to be set
to 'system_u:object_r:fs_t' you would set the property as follows:

  $ zfs set rootcontext="system_u:object_r:fs_t" storage-pool/media

This will ensure the filesystem is automatically mounted with that
rootcontext.  It is equivalent to manually specifying the rootcontext
with the -o option like this:

  $ zfs mount -o rootcontext=system_u:object_r:fs_t storage-pool/media

By default all four contexts are set to 'none'.  Further information
on SELinux contexts is detailed in mount(8) and selinux(8) man pages.

Signed-off-by: Matthew Thode <prometheanfire@gentoo.org>
Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Richard Yao <ryao@gentoo.org>
Closes #1504
This commit is contained in:
Matthew Thode
2013-12-19 00:24:14 -06:00
committed by Brian Behlendorf
parent d1d7e2689d
commit 11b9ec23b9
10 changed files with 134 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/user-selinux.m4
-36
View File
@@ -1,36 +0,0 @@
dnl #
dnl # Check to see if the selinux libraries are available. If they
dnl # are then they will be consulted during mount to determine if
dnl # selinux is enabled or disabled.
dnl #
AC_DEFUN([ZFS_AC_CONFIG_USER_LIBSELINUX], [
AC_ARG_WITH([selinux],
[AS_HELP_STRING([--with-selinux],
[support selinux @<:@default=check@:>@])],
[],
[with_selinux=check])
LIBSELINUX=
AS_IF([test "x$with_selinux" != xno], [
AC_CHECK_HEADER([selinux/selinux.h], [
AC_CHECK_LIB([selinux], [is_selinux_enabled], [
AC_SUBST([LIBSELINUX], ["-lselinux"])
AC_DEFINE([HAVE_LIBSELINUX], 1,
[Define if you have selinux])
], [
AS_IF([test "x$with_selinux" != xcheck],
[AC_MSG_FAILURE(
[--with-selinux given but unavailable])
])
])
], [
AS_IF([test "x$with_selinux" != xcheck],
[AC_MSG_FAILURE(
[--with-selinux given but unavailable])
])
])
], [
AC_MSG_CHECKING([for selinux support])
AC_MSG_RESULT([no])
])
])
config/user.m4
-1
View File
@@ -9,6 +9,5 @@ AC_DEFUN([ZFS_AC_CONFIG_USER], [
ZFS_AC_CONFIG_USER_ZLIB
ZFS_AC_CONFIG_USER_LIBUUID
ZFS_AC_CONFIG_USER_LIBBLKID
ZFS_AC_CONFIG_USER_LIBSELINUX
ZFS_AC_CONFIG_USER_FRAME_LARGER_THAN
])