Stephen Smalley wrote:
On Wed, 2006-03-29 at 06:27 -0600, Ian Pilcher wrote:
> Stephen Smalley wrote:
>> Sorry, reiserfs xattrs are known to be broken with SELinux at present,
>> because reiserfs doesn't yet implement the inode_init_security method
>> for labeling new inodes atomically at creation time. As a workaround,
>> mount it with a context= mount to override the use of xattrs.
> I tried context=system_u:object_r:file_t:s0 and got the same error. Is
> there something else I should be using?
By the "same error", you mean another avc denial for search access to
unlabeled_t:dir by mount_t? Did you get a SELinux: initialized (dev
xxx, type reiserfs), uses mountpoint labeling message
in /var/log/messages?
Sorry about the delay...jury duty.
Just tried again to be sure:
mkfs.reiserfs /dev/md9
/etc/fstab contains:
/dev/md9 /mnt/tmp reiserfs context=system_u:object_r:file_t:s0 0 2
Rebooted and the mount failed. dmesg | grep md9 shows:
audit(1143660461.416:15): avc: denied { search } for pid=1714
comm="mount" name="/" dev=md9 ino=2
scontext=system_u:system_r:mount_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir
ReiserFS: md9: warning: xattrs/ACLs enabled and couldn't find/create
.reiserfs_priv. Failing mount.
It doesn't look like the context option had any affect at all.
--
========================================================================
Ian Pilcher i.pilcher(a)comcast.net
========================================================================