Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 480870 - SELinux on F2FS does not have proper attributes
Summary: SELinux on F2FS does not have proper attributes
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Sven Vermeulen (RETIRED)
URL:
Whiteboard: sec-policy r3
Keywords:
Depends on:
Blocks:
 
Reported: 2013-08-13 12:03 UTC by zacharyw09264
Modified: 2014-01-12 20:55 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description zacharyw09264 2013-08-13 12:03:57 UTC
The base policy Gentoo uses does not have the proper attributes for the F2FS filesystem.  Even with F2FS_FS_XATTR and F2FS_FS_POSIX_ACL, a chcon reports 'Operation not supported'.  The solution is to add the line fs_use_xattr f2fs gen_context(system_u:object_r:fs_t,s0); to policy/modules/kernel/filesystem.te.  Solution courtesy of freenode's #selinux.
Comment 1 Sven Vermeulen (RETIRED) gentoo-dev 2013-08-13 18:18:06 UTC
Okay, it's part of our repository (so if you use the live selinux-* ebuilds you'll fetch it in with the next build of selinux-base-9999) and it will be part of the 3rd revision of our policy packages.

I'm assuming the file system in /etc/mtab is shown as "f2fs"? I'll update the rlpkg package as well to enable relabeling it through "rlpkg -a -r".
Comment 2 zacharyw09264 2013-08-15 02:47:23 UTC
Yes, the filesystem shows up as f2fs in mtab and /proc/mounts.
Comment 3 zacharyw09264 2013-08-15 03:00:09 UTC
Also I noticed that /usr/sbin/mkfs.f2fs has type system_u:object_r:bin_t while the other mkfs.* have type system_u:object_r:fsadm_exec_t.  This should also probably be fixed.
Comment 4 Sven Vermeulen (RETIRED) gentoo-dev 2013-08-15 05:47:29 UTC
Yup; added to the fstools.fs file context.

I made the addition for both /sbin/mkfs.f2fs and /usr/sbin/mkfs.f2fs.

The /sbin one perhaps isn't exactly needed (as there already is a /sbin/mkfs.*) but wont hurt either (more explicit).
Comment 5 Sven Vermeulen (RETIRED) gentoo-dev 2013-08-27 13:46:32 UTC
With the suggested changes, does everything now work as expected?

There are some concerns that F2FS does not support the security.* namespace for extended attributes, so enabling SELinux support for it would be null anyway.
Comment 6 zacharyw09264 2013-09-26 08:08:33 UTC
Kernels older than 3.11 do not support security labels, so enabling it would do nothing, but for kernels 3.11 and after it supports security labels.  I just got done testing another install and it appears to be working.
Comment 7 Sven Vermeulen (RETIRED) gentoo-dev 2013-09-26 17:33:25 UTC
r3 is now in the tree, ~arch'ed
Comment 8 Sven Vermeulen (RETIRED) gentoo-dev 2014-01-12 20:55:30 UTC
r4 is now stable in the tree