Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Dan Noland <dan@starlab.io>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: fs_use_xattr question
Thread-Topic: fs_use_xattr question
Thread-Index: AQHVIvzFKIzbdp2sxUe72LFFtiYoEg==
Date:   Fri, 14 Jun 2019 22:01:52 +0000
Message-ID: <20190614220149.GE18841@starlab.io>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [73.212.228.68]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: dea73b13-303b-4dcf-f8dc-08d6f113e82f
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020);SRVR:CH2PR09MB4171;
x-ms-traffictypediagnostic: CH2PR09MB4171:
x-microsoft-antispam-prvs: <CH2PR09MB4171D294A7961FE4167DAD2FC2EE0@CH2PR09MB4171.namprd09.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:8273;
x-forefront-prvs: 0068C7E410
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(376002)(396003)(39830400003)(136003)(346002)(366004)(51744003)(189003)(199004)(508600001)(14444005)(6486002)(99286004)(6436002)(256004)(14454004)(74482002)(6916009)(53936002)(5640700003)(26005)(6512007)(66066001)(186003)(7736002)(68736007)(305945005)(5660300002)(71190400001)(71200400001)(102836004)(6506007)(386003)(52116002)(3846002)(8676002)(25786009)(33656002)(36756003)(1076003)(4744005)(6116002)(2501003)(2906002)(73956011)(66446008)(86362001)(64756008)(66476007)(66556008)(476003)(2351001)(2616005)(66946007)(8936002)(7116003)(316002)(81166006)(81156014)(486006);DIR:OUT;SFP:1102;SCL:1;SRVR:CH2PR09MB4171;H:CH2PR09MB3878.namprd09.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: starlab.io does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: AxNOFm3MGoQ8E1JXskv72rNdh4jYM4pSriSTLdExShDYw0jfsUU4crHbQqSZDPIQmZuypNx9yjz73PUnLmYXVsV5f4qE03v8D/B1kfOssY7sdpY9dDcx1AyT5hGIpeCecSlF/btQcsAc+MI4cZ/hvrvRKI1xUHrqfiEMURT+/ZSpSi5LhZtGOKAjcwPkFq7buh3pHqJafagfCXBbIoEygDGNoDd19xNMQLe12nyIV18Gu+fVzZRueGI4e54NIsPB6eTr8XgUjSA4isDMI5mSLgkRNAcqFoTCMlPFeN86fGkbMntz39VxhUWAarxaYA6bhzPrre+TfH9DOSnJN1Im6sS7QEyyfTTcB93mkBctULW72Pzdi5sVIhnEOBF7qRG7C87p1yKmPp5ff4afz+dg4ku4RYMB294yorWtuUJH5t4=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <27EFD95420A3CF43ABBA5A0BCCF9D72F@namprd09.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: starlab.io
X-MS-Exchange-CrossTenant-Network-Message-Id: dea73b13-303b-4dcf-f8dc-08d6f113e82f
X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jun 2019 22:01:52.3233
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5e611933-986f-4838-a403-4acb432ce224
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: dan@starlab.io
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR09MB4171
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

- Hello -

I have a custom stacked filesystem and I was having difficulty with
security xattrs. I traced it back to missing: =20

fs_use_xattr myfs gen_context(system_u:object_r:fs_t,s0);

Which works nicely when I rebuild/reinstall the base policy. However
some experimentation and checking of old mailing posts seems to
indicate that it is not possible to achieve this in a policy module.=20

Because my FS is stacked I would be perfectly happy just to
inherit whatever the fs_use_xattr state of my lower filesystem is.

Is there a best practice for achieving this or do I need to always
rebuild the base policy?

Thank you for your time.

--=20
TY,
Dan Noland