From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.6 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE010C31E47 for ; Sat, 15 Jun 2019 11:42:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7CB3720679 for ; Sat, 15 Jun 2019 11:42:45 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MPg60ChH" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726626AbfFOLmp (ORCPT ); Sat, 15 Jun 2019 07:42:45 -0400 Received: from mail-ed1-f53.google.com ([209.85.208.53]:36585 "EHLO mail-ed1-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726366AbfFOLmo (ORCPT ); Sat, 15 Jun 2019 07:42:44 -0400 Received: by mail-ed1-f53.google.com with SMTP id k21so7698694edq.3 for ; Sat, 15 Jun 2019 04:42:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to:user-agent; bh=ubftxwSJXylX5D3loDgdko6vadlBS0/8uLAZfuIUpCM=; b=MPg60ChH83FxA22yRFcJ783kVaTMyyUs/OQoc1AwSUDCINe0W2bzIOtcV4FwrxJFnm VQSPyindiuRR8TPUwcRp4rmffwnIoMOWxi3YqXkzNVWc/aMDVRxQVmWFtQWe6zuu8yXS 12WvfmgqOqTv7ymj4Sk4Nh6Q/98xfYzKoegAGnNTT7otSlAg6PYF2DwAaHXvujrLRmD9 QCdsR4dl4QHG147OgjdsfmWEnmlXc7ziZQLFlmhpT2X5d10nwxcWEXccmp5CLFY1Dtvj DpsXGbij8FJ+Wekez906/T0aBTSPKQqCh6nOXvvURq6F5DQgI6bL+Xgt1qWxpiKQ4Knh d5qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to:user-agent; bh=ubftxwSJXylX5D3loDgdko6vadlBS0/8uLAZfuIUpCM=; b=D/ZvCHEmRK2wPGfnpNrxyQwEXGxq+I9tNjxlS8lsdz8D0l21UAGT+VVeBghanpzQ3X lBleuNRkIDqjThkBv387QlS+vm/8x8NY33zHUAbQZ0uakxEOe5ynli3I/Iin5ziTpXqx Xdpj+umrzMhBdoIBudyi+xilEWW0Ege2A0vDD7nQBWMhYk8PJ8MI6NfqZsYV5qpHJ3bc Z/GpSsixS4tHt70lz7gw2CytETtNuXSJKbTg4SCOmlXb9PvngZ63jTuReirwzUSo13gm Qdjdf6vZPfBNCAvWySgD+kVtwO7Iw2shFgpVgbkyvlkV2AcqPVXbJYUy7qw3/qyZlCRe dPng== X-Gm-Message-State: APjAAAVN8BiTjZpstrE66PV8jkfy96JdHspW277OePGWMXX2MktI6EIi Q/rNMx8NgCS01otE+Y+9jrxorT9m X-Google-Smtp-Source: APXvYqximL7vAb/voik5WzesXPc2StYFEXoX5V34yKPyex81iSn0JtU13tundCBXPxdVKDVkBq0ZAQ== X-Received: by 2002:a17:906:9256:: with SMTP id c22mr44962980ejx.172.1560598963100; Sat, 15 Jun 2019 04:42:43 -0700 (PDT) Received: from brutus.lan (brutus.defensec.nl. [2001:985:d55d::438]) by smtp.gmail.com with ESMTPSA id u9sm304027edm.71.2019.06.15.04.42.41 (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Sat, 15 Jun 2019 04:42:42 -0700 (PDT) Date: Sat, 15 Jun 2019 13:42:40 +0200 From: Dominick Grift To: Dan Noland Cc: "selinux-refpolicy@vger.kernel.org" Subject: Re: fs_use_xattr question Message-ID: <20190615114240.GA2929@brutus.lan> Mail-Followup-To: Dan Noland , "selinux-refpolicy@vger.kernel.org" References: <20190614220149.GE18841@starlab.io> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="82I3+IH0IqGh5yIs" Content-Disposition: inline In-Reply-To: <20190614220149.GE18841@starlab.io> User-Agent: Every email client sucks, this one just sucks less. X-PGP-Key: https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org --82I3+IH0IqGh5yIs Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Jun 14, 2019 at 10:01:52PM +0000, Dan Noland wrote: > - Hello - >=20 > I have a custom stacked filesystem and I was having difficulty with > security xattrs. I traced it back to missing: =20 >=20 > fs_use_xattr myfs gen_context(system_u:object_r:fs_t,s0); >=20 > Which works nicely when I rebuild/reinstall the base policy. However > some experimentation and checking of old mailing posts seems to > indicate that it is not possible to achieve this in a policy module.=20 >=20 > Because my FS is stacked I would be perfectly happy just to > inherit whatever the fs_use_xattr state of my lower filesystem is. >=20 > Is there a best practice for achieving this or do I need to always > rebuild the base policy? If you are able to use CIL then you might be able to do this: echo '(fsuse xattr "myfs" (system_u object_r fs_t ((s0)(s0))))' > mytest.ci= l && sudo semodule -i mytest.cil >=20 > Thank you for your time. >=20 > --=20 > TY, > Dan Noland --=20 Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02 Dominick Grift --82I3+IH0IqGh5yIs Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl0E2asACgkQJXSOVTf5 R2mYzgv9HLqWfihcIVAIt6Hmb7CTnH9gEIZjHlbSO9xlCGVauCILtlbAx95TbbOC 5yzT1SP6x/h+WA8oigAxoDckwSq89cZiC1rMXFqXGg1lpu8gmFk3bszh37RSXUfM kR1d6GUce8W+C+HZ9nukNa0Neyk9SI23THGcr3E9vgJW+JXvGypn7RlX5eV1iQ8p KVQGOj6uUQv0FHsGrdcXthUAAnkIiIJSXXXSWkks/g0KFcMvCLRTaqHY6MEPv1Zk sRnfHItBIlTpzZ7cVA0XAtNrFCMkiB/o2x428oc1wV1Fwtf99Ma3YKaP2WnezBmP NkyeOsNbny6/S5j2lVHbYmc4FBigGnBpQfHxi3bM+k556qlMDyFgP2ZSTZFvx5N+ vUgkxSbTcxL+ClRMNLsm7wXylkXaYaaPlaKSlzZQWg4nJCwLSeXNPL4yS8gMgbVc GGW4ZFwtoyUG1D4KhpYtQfiibAHNKFI29Z1JXslk7zFhpo5TqKCwKhPZvUuS7Exn bmpaSBq7 =H5C0 -----END PGP SIGNATURE----- --82I3+IH0IqGh5yIs--