-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Sean E. Millichamp wrote:
I have been working on SELinux support for Puppet. One issue that
has
cropped up is the behavior on filesystems which don't support SELinux.
They all appear to get a default label, some seem to allow changing the
label (VFAT) in a non-persistent manner, some seem to throw "not
supported" errors (NFS).
How can I detect if a file is on a filesystem which supports SELinux
without trying to update the label?
The best idea so far as been to parse /proc/mounts and use that to
determine what type of filesystem a file lives on, then check it against
a whitelist (which would include ext3, xfs, ?) but it seems like there
has to be a cleaner/simpler way.
What I would like would be a "getfilecon" call that returns the real
label, ignoring any mount-time defaults.
Any ideas?
Thanks,
Sean
--
fedora-selinux-list mailing list
fedora-selinux-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list I have been waiting for
some one else to respond to this. I think this
would be better sent to the nsa selinux list for better discussion.
The problem with your parsing of the /proc/mounts is that it would not
give you an accurate idea of what supports and what does not support
SELinux labeling. Also this can change over time.
If I mount an ext3 file system with a context mount, then it will no
longer allow you to set the file context. I think the best idea is just
attempt to assign the context and if it fails, ignore the error. I
guess you can report it, if in verbose mode as a warning.
Others may have different ideas.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org
iEYEARECAAYFAkkhg4EACgkQrlYvE4MpobMPMgCgm+G/Pyrll2CKHUynWftA7Shq
phMAnAwTXQQ+mQH33EjP20o9iM7gaVvE
=eDjj
-----END PGP SIGNATURE-----