I am not an expert in the NFS area but I used to have
the same problem. I was able to mount the NFS share but
I could not see the content of the share folder.
One thing I check was the R and W access to that particular
NFS folder.
Maybe you should chek that...
Alfredito
On 10:54 Wed 19 Oct , Andy Dustman wrote:
> I'm missing some important piece of how to properly mount NFS
> filesystems under SELinux. I can get the filesystem to mount, but if I
> try to access it, I get permission denied. Additionally, doing ls -dZ
> on the mount point shows (none) as the label. The avc denial is:
>
> Oct 19 10:34:48 dynamo audit(1129732488.176:905): avc: denied { read
> } for pid=12648 comm="ls" name="/" dev=0:e ino=7214560
> scontext=adustman:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t
> tclass=dir
>
> So I'm guessing it's labeled nfs_t as would be expected, but even
> getting the label is not allowed for the context.
>
> # grep nfs_t policy.conf
> type var_lib_nfs_t, file_type, sysadmfile, usercanread;
> # nfs_t is the default type for NFS file systems
> type nfs_t, fs_type;
> allow nfs_t self:filesystem associate;
> allow file_type nfs_t:filesystem associate;
> allow consoletype_t nfs_t:file write;
> allow mount_t nfs_t:dir mounton;
> allow mount_t nfs_t:dir search;
> allow mount_t var_lib_nfs_t:dir mounton;
> dontaudit { file_type noexattrfile nfs_t } self:pax *;
> allow rpcd_t var_lib_nfs_t:dir { create read getattr lock setattr
> ioctl link unlink rename search add_name remove_name reparent write
> rmdir };
> allow rpcd_t var_lib_nfs_t:file { create ioctl read getattr lock write
> setattr append link unlink rename };
> allow nfsd_t var_lib_nfs_t:dir { create read getattr lock setattr
> ioctl link unlink rename search add_name remove_name reparent write
> rmdir };
> allow nfsd_t var_lib_nfs_t:file { create ioctl read getattr lock write
> setattr append link unlink rename };
> genfscon nfs / system_u:object_r:nfs_t
> genfscon nfs4 / system_u:object_r:nfs_t
> genfscon afs / system_u:object_r:nfs_t
>
> [ Searching for package 'selinux' in all categories among: ]
> * installed packages
> [I--] [ ] sec-policy/selinux-base-policy-20050821 (0)
> [I--] [ ] sec-policy/selinux-portmap-20050908 (0)
> [I--] [ ] sec-policy/selinux-nfs-20040501 (0)
>
> I'm aware of the need for NFS extensions on the client and server in
> order to fully-implement file labelling. The server in this case is a
> NetApp Filer, so I don't expect it to magically work. From what I am
> able to tell, all the files should be labeled nfs_t, but I'm not
> really sure about this, based on tunable.te, i.e. nfs_portdir and
> nfs_home_dirs.
> --
> Computer interfaces should never be made of meat.
> http://www.terrybisson.com/meat.html
>
> --
> [email protected] mailing list
--
[email protected] mailing list
