KConfig: Add KConfig entries for Labeled NFS
in [Kernel]
|
From: J. Bruce Fields on 7 Jul 2010 13:00 On Wed, Jul 07, 2010 at 10:31:21AM -0400, David P. Quigley wrote: > This patch adds two entries into the fs/KConfig file. The first entry > NFS_V4_SECURITY_LABEL enables security label support for the NFSv4 client while > the second entry NFSD_V4_SECURITY_LABEL enables security labeling support on > the server side. Will there also be some way to turn these on and off at run-time (maybe for particular exports or filesystems?) And if so, will there be any reason not to have this on all the time? I don't think we'll want a config option for every future possible NFSv4.x feature. --b. > > Signed-off-by: Matthew N. Dodd <Matthew.Dodd(a)sparta.com> > Signed-off-by: David P. Quigley <dpquigl(a)tycho.nsa.gov> > --- > fs/nfs/Kconfig | 16 ++++++++++++++++ > fs/nfsd/Kconfig | 13 +++++++++++++ > 2 files changed, 29 insertions(+), 0 deletions(-) > > diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig > index a43d07e..67b158c 100644 > --- a/fs/nfs/Kconfig > +++ b/fs/nfs/Kconfig > @@ -83,6 +83,22 @@ config NFS_V4_1 > > Unless you're an NFS developer, say N. > > +config NFS_V4_SECURITY_LABEL > + bool "Provide Security Label support for NFSv4 client" > + depends on NFS_V4 && SECURITY > + help > + > + Say Y here if you want enable fine-grained security label attribute > + support for NFS version 4. Security labels allow security modules like > + SELinux and Smack to label files to facilitate enforcement of their policies. > + Without this an NFSv4 mount will have the same label on each file. > + > + If you do not wish to enable fine-grained security labels SELinux or > + Smack policies on NFSv4 files, say N. > + > + > + If unsure, say N. > + > config ROOT_NFS > bool "Root file system on NFS" > depends on NFS_FS=y && IP_PNP > diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig > index 503b9da..3a282f8 100644 > --- a/fs/nfsd/Kconfig > +++ b/fs/nfsd/Kconfig > @@ -79,3 +79,16 @@ config NFSD_V4 > available from http://linux-nfs.org/. > > If unsure, say N. > + > +config NFSD_V4_SECURITY_LABEL > + bool "Provide Security Label support for NFSv4 server" > + depends on NFSD_V4 && SECURITY > + help > + > + Say Y here if you want enable fine-grained security label attribute > + support for NFS version 4. Security labels allow security modules like > + SELinux and Smack to label files to facilitate enforcement of their policies. > + Without this an NFSv4 mount will have the same label on each file. > + > + If you do not wish to enable fine-grained security labels SELinux or > + Smack policies on NFSv4 files, say N. > -- > 1.6.2.5 > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: David P. Quigley on 7 Jul 2010 13:20 On Wed, 2010-07-07 at 12:56 -0400, J. Bruce Fields wrote: > On Wed, Jul 07, 2010 at 10:31:21AM -0400, David P. Quigley wrote: > > This patch adds two entries into the fs/KConfig file. The first entry > > NFS_V4_SECURITY_LABEL enables security label support for the NFSv4 client while > > the second entry NFSD_V4_SECURITY_LABEL enables security labeling support on > > the server side. > > Will there also be some way to turn these on and off at run-time (maybe > for particular exports or filesystems?) > > And if so, will there be any reason not to have this on all the time? I > don't think we'll want a config option for every future possible NFSv4.x > feature. The way the code currently works is if you want security labeling on an export you need to put the sec_label option on your export line (we have a modified nfs-utils to accept that option). This will set the particular capability flag for security labeling support on the server. After that it works like any other capability. I don't think there is a need to turn it on/off without reexporting the file system especially since I'm not sure if there is a way to regrab the server capabilities after the initial mount. I don't see why we couldn't not have this on at all times from a kconfig perspective. I can make sure that the code is prepared to always be there and handle when there is no need for it to be used. A little bit of a background on how SELinux will handle this (other LSMs are welcome to do what they like). If you want to turn security labeling on/off on a per export basis we have the sec_label export option for that. If you have a file system that is exported with sec_label and you don't want to use security labels from the server SELinux provides a capability called context mounts. It allows us to set the label for every file on that mount point regardless of whether the file system provides other labeling capabilities. So if we have a server exporting /www with security labels and we don't want to trust it I would use a mount command like the one below to set the security label for the entire mount mount -t nfs4 -o context="system_u:object_r:httpd_sys_content_t:s0" localhost:/www /mnt/www Dave -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Chuck Lever on 7 Jul 2010 14:00 On 07/ 7/10 12:56 PM, J. Bruce Fields wrote: > On Wed, Jul 07, 2010 at 10:31:21AM -0400, David P. Quigley wrote: >> This patch adds two entries into the fs/KConfig file. The first entry >> NFS_V4_SECURITY_LABEL enables security label support for the NFSv4 client while >> the second entry NFSD_V4_SECURITY_LABEL enables security labeling support on >> the server side. > > Will there also be some way to turn these on and off at run-time (maybe > for particular exports or filesystems?) > > And if so, will there be any reason not to have this on all the time? I > don't think we'll want a config option for every future possible NFSv4.x > feature. I would guess that the ability to build without this feature would be desirable if it added significant bulk to the object code. If it doesn't, then I agree with you that having it adds unneeded clutter to the code, and additional complexity to kernel configuration that most people will ignore and/or get wrong. >> >> Signed-off-by: Matthew N. Dodd<Matthew.Dodd(a)sparta.com> >> Signed-off-by: David P. Quigley<dpquigl(a)tycho.nsa.gov> >> --- >> fs/nfs/Kconfig | 16 ++++++++++++++++ >> fs/nfsd/Kconfig | 13 +++++++++++++ >> 2 files changed, 29 insertions(+), 0 deletions(-) >> >> diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig >> index a43d07e..67b158c 100644 >> --- a/fs/nfs/Kconfig >> +++ b/fs/nfs/Kconfig >> @@ -83,6 +83,22 @@ config NFS_V4_1 >> >> Unless you're an NFS developer, say N. >> >> +config NFS_V4_SECURITY_LABEL >> + bool "Provide Security Label support for NFSv4 client" >> + depends on NFS_V4&& SECURITY >> + help >> + >> + Say Y here if you want enable fine-grained security label attribute >> + support for NFS version 4. Security labels allow security modules like >> + SELinux and Smack to label files to facilitate enforcement of their policies. >> + Without this an NFSv4 mount will have the same label on each file. >> + >> + If you do not wish to enable fine-grained security labels SELinux or >> + Smack policies on NFSv4 files, say N. >> + >> + >> + If unsure, say N. >> + >> config ROOT_NFS >> bool "Root file system on NFS" >> depends on NFS_FS=y&& IP_PNP >> diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig >> index 503b9da..3a282f8 100644 >> --- a/fs/nfsd/Kconfig >> +++ b/fs/nfsd/Kconfig >> @@ -79,3 +79,16 @@ config NFSD_V4 >> available from http://linux-nfs.org/. >> >> If unsure, say N. >> + >> +config NFSD_V4_SECURITY_LABEL >> + bool "Provide Security Label support for NFSv4 server" >> + depends on NFSD_V4&& SECURITY >> + help >> + >> + Say Y here if you want enable fine-grained security label attribute >> + support for NFS version 4. Security labels allow security modules like >> + SELinux and Smack to label files to facilitate enforcement of their policies. >> + Without this an NFSv4 mount will have the same label on each file. >> + >> + If you do not wish to enable fine-grained security labels SELinux or >> + Smack policies on NFSv4 files, say N. >> -- >> 1.6.2.5 >> > -- > To unsubscribe from this list: send the line "unsubscribe linux-nfs" in > the body of a message to majordomo(a)vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|
Pages: 1 Prev: block: BKL removal, version 4 Next: [PATCH] ipc/sem.c: shrink size of struct sem_undo |