Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-10-03 Thread Taras Kondratiuk via Selinux
Quoting Stephen Smalley (2018-10-02 12:41:54) > On 10/02/2018 02:48 PM, Taras Kondratiuk wrote: > > Quoting Stephen Smalley (2018-09-21 07:40:58) > >> If we set the inode sid to the superblock def_sid on an invalid > >> context, then we lose the association to the original context value. > >> The

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-10-02 Thread Stephen Smalley
On 10/02/2018 02:48 PM, Taras Kondratiuk wrote: Quoting Stephen Smalley (2018-09-21 07:40:58) If we set the inode sid to the superblock def_sid on an invalid context, then we lose the association to the original context value. The support for deferred mapping of contexts requires allocating a

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-10-02 Thread Taras Kondratiuk via Selinux
Quoting Stephen Smalley (2018-09-21 07:40:58) > If we set the inode sid to the superblock def_sid on an invalid > context, then we lose the association to the original context value. > The support for deferred mapping of contexts requires allocating a new > SID for the invalid context and storing

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-25 Thread Taras Kondratiuk via Selinux
Quoting Stephen Smalley (2018-09-25 09:39:55) > On 09/25/2018 12:03 PM, Paul Moore wrote: > > On Tue, Sep 25, 2018 at 9:58 AM Stephen Smalley wrote: > >> I'm inclined to just change the behavior for defcontext= unconditionally > >> and have it apply to both native and xattr labeling. If

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-25 Thread Stephen Smalley
On 09/25/2018 12:03 PM, Paul Moore wrote: On Tue, Sep 25, 2018 at 9:58 AM Stephen Smalley wrote: On 09/25/2018 01:45 AM, Taras Kondratiuk wrote: Quoting Paul Moore (2018-09-24 20:46:57) On Fri, Sep 21, 2018 at 10:39 AM Stephen Smalley wrote: On 09/20/2018 06:59 PM, Taras Kondratiuk wrote:

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-25 Thread Paul Moore
On Tue, Sep 25, 2018 at 9:58 AM Stephen Smalley wrote: > On 09/25/2018 01:45 AM, Taras Kondratiuk wrote: > > Quoting Paul Moore (2018-09-24 20:46:57) > >> On Fri, Sep 21, 2018 at 10:39 AM Stephen Smalley > >> wrote: > >>> On 09/20/2018 06:59 PM, Taras Kondratiuk wrote: > Quoting Stephen

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-25 Thread Paul Moore
On Tue, Sep 25, 2018 at 1:45 AM Taras Kondratiuk wrote: > Quoting Paul Moore (2018-09-24 20:46:57) > > On Fri, Sep 21, 2018 at 10:39 AM Stephen Smalley wrote: > > > On 09/20/2018 06:59 PM, Taras Kondratiuk wrote: > > > > Quoting Stephen Smalley (2018-09-20 07:49:12) > > > >> On 09/19/2018 10:41

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-25 Thread Stephen Smalley
On 09/25/2018 01:45 AM, Taras Kondratiuk wrote: Quoting Paul Moore (2018-09-24 20:46:57) On Fri, Sep 21, 2018 at 10:39 AM Stephen Smalley wrote: On 09/20/2018 06:59 PM, Taras Kondratiuk wrote: Quoting Stephen Smalley (2018-09-20 07:49:12) On 09/19/2018 10:41 PM, Taras Kondratiuk wrote:

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-25 Thread Taras Kondratiuk via Selinux
Quoting Stephen Smalley (2018-09-21 07:40:58) > On 09/20/2018 06:59 PM, Taras Kondratiuk wrote: > > Quoting Stephen Smalley (2018-09-20 07:49:12) > >> On 09/19/2018 10:41 PM, Taras Kondratiuk wrote: > >>> Quoting Stephen Smalley (2018-09-19 12:00:33) > On 09/19/2018 12:52 PM, Taras Kondratiuk

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-25 Thread Taras Kondratiuk via Selinux
Quoting Paul Moore (2018-09-24 20:46:57) > On Fri, Sep 21, 2018 at 10:39 AM Stephen Smalley wrote: > > On 09/20/2018 06:59 PM, Taras Kondratiuk wrote: > > > Quoting Stephen Smalley (2018-09-20 07:49:12) > > >> On 09/19/2018 10:41 PM, Taras Kondratiuk wrote: > > >>> Quoting Stephen Smalley

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-24 Thread Paul Moore
On Fri, Sep 21, 2018 at 10:39 AM Stephen Smalley wrote: > On 09/20/2018 06:59 PM, Taras Kondratiuk wrote: > > Quoting Stephen Smalley (2018-09-20 07:49:12) > >> On 09/19/2018 10:41 PM, Taras Kondratiuk wrote: > >>> Quoting Stephen Smalley (2018-09-19 12:00:33) > On 09/19/2018 12:52 PM, Taras

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-21 Thread Stephen Smalley
On 09/20/2018 06:59 PM, Taras Kondratiuk wrote: Quoting Stephen Smalley (2018-09-20 07:49:12) On 09/19/2018 10:41 PM, Taras Kondratiuk wrote: Quoting Stephen Smalley (2018-09-19 12:00:33) On 09/19/2018 12:52 PM, Taras Kondratiuk wrote: When files on NFSv4 server are not properly labeled

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-21 Thread Taras Kondratiuk via Selinux
Quoting Stephen Smalley (2018-09-20 07:49:12) > On 09/19/2018 10:41 PM, Taras Kondratiuk wrote: > > Quoting Stephen Smalley (2018-09-19 12:00:33) > >> On 09/19/2018 12:52 PM, Taras Kondratiuk wrote: > >>> When files on NFSv4 server are not properly labeled (label doesn't match > >>> a policy on a

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-20 Thread Stephen Smalley
On 09/19/2018 10:41 PM, Taras Kondratiuk wrote: Quoting Stephen Smalley (2018-09-19 12:00:33) On 09/19/2018 12:52 PM, Taras Kondratiuk wrote: When files on NFSv4 server are not properly labeled (label doesn't match a policy on a client) they will end up with unlabeled_t type which is too

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-20 Thread Taras Kondratiuk via Selinux
Quoting Stephen Smalley (2018-09-19 12:00:33) > On 09/19/2018 12:52 PM, Taras Kondratiuk wrote: > > When files on NFSv4 server are not properly labeled (label doesn't match > > a policy on a client) they will end up with unlabeled_t type which is > > too generic. We would like to be able to set a

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-19 Thread Stephen Smalley
On 09/19/2018 12:52 PM, Taras Kondratiuk wrote: When files on NFSv4 server are not properly labeled (label doesn't match a policy on a client) they will end up with unlabeled_t type which is too generic. We would like to be able to set a default context per mount. 'defcontext' mount option looks

Re: [RFC PATCH] selinux: add a fallback to defcontext for native labeling

2018-09-19 Thread Paul Moore
On Wed, Sep 19, 2018 at 12:52 PM Taras Kondratiuk wrote: > When files on NFSv4 server are not properly labeled (label doesn't match > a policy on a client) they will end up with unlabeled_t type which is > too generic. We would like to be able to set a default context per > mount. 'defcontext'