On 10/19/05, Chris PeBenito <[EMAIL PROTECTED]> wrote: > On Wed, 2005-10-19 at 10:54 -0400, Andy Dustman wrote: > > I'm missing some important piece of how to properly mount NFS > > filesystems under SELinux. I can get the filesystem to mount, but if I > > try to access it, I get permission denied. Additionally, doing ls -dZ > > on the mount point shows (none) as the label. > > NFS does not support exporting of labels, since it does not support > xattr. Any NFS filesystems you mount will have (none) as the labels, > and all of the contents will have the label system_u:object_r:nfs_t, > even if the server is a SELinux machine. So on your client, you have to > give access to nfs_t.
> You turn on nfs_portdir if you have a portage tree or overlay on NFS. > Nfs_home_dirs is if you have a NFS /home. Actually, my first attempt at this was to try to get an NFS-mounted Portage overlay to work, and I had the same sort of problem, i.e. always getting permission denied trying to access nfs_t as sysadm_t. However, emerge (running as portage_t) can access the files fine. It looks like enabling nfs_home_dirs creates general access rules for sysadm_t, staff_t, and user_t (among others) to access NFS files, which makes my NFS-mounted filesystems generally accessible. -- Computer interfaces should never be made of meat. http://www.terrybisson.com/meat.html -- [email protected] mailing list
