Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 15 Jun 2019 13:42:40 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     Dan Noland <dan@starlab.io>
Cc:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: fs_use_xattr question
Message-ID: <20190615114240.GA2929@brutus.lan>
Mail-Followup-To: Dan Noland <dan@starlab.io>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20190614220149.GE18841@starlab.io>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="82I3+IH0IqGh5yIs"
Content-Disposition: inline
In-Reply-To: <20190614220149.GE18841@starlab.io>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--82I3+IH0IqGh5yIs
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Jun 14, 2019 at 10:01:52PM +0000, Dan Noland wrote:
> - Hello -
>=20
> I have a custom stacked filesystem and I was having difficulty with
> security xattrs. I traced it back to missing: =20
>=20
> fs_use_xattr myfs gen_context(system_u:object_r:fs_t,s0);
>=20
> Which works nicely when I rebuild/reinstall the base policy. However
> some experimentation and checking of old mailing posts seems to
> indicate that it is not possible to achieve this in a policy module.=20
>=20
> Because my FS is stacked I would be perfectly happy just to
> inherit whatever the fs_use_xattr state of my lower filesystem is.
>=20
> Is there a best practice for achieving this or do I need to always
> rebuild the base policy?

If you are able to use CIL then you might be able to do this:

echo '(fsuse xattr "myfs" (system_u object_r fs_t ((s0)(s0))))' > mytest.ci=
l && sudo semodule -i mytest.cil

>=20
> Thank you for your time.
>=20
> --=20
> TY,
> Dan Noland

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--82I3+IH0IqGh5yIs
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl0E2asACgkQJXSOVTf5
R2mYzgv9HLqWfihcIVAIt6Hmb7CTnH9gEIZjHlbSO9xlCGVauCILtlbAx95TbbOC
5yzT1SP6x/h+WA8oigAxoDckwSq89cZiC1rMXFqXGg1lpu8gmFk3bszh37RSXUfM
kR1d6GUce8W+C+HZ9nukNa0Neyk9SI23THGcr3E9vgJW+JXvGypn7RlX5eV1iQ8p
KVQGOj6uUQv0FHsGrdcXthUAAnkIiIJSXXXSWkks/g0KFcMvCLRTaqHY6MEPv1Zk
sRnfHItBIlTpzZ7cVA0XAtNrFCMkiB/o2x428oc1wV1Fwtf99Ma3YKaP2WnezBmP
NkyeOsNbny6/S5j2lVHbYmc4FBigGnBpQfHxi3bM+k556qlMDyFgP2ZSTZFvx5N+
vUgkxSbTcxL+ClRMNLsm7wXylkXaYaaPlaKSlzZQWg4nJCwLSeXNPL4yS8gMgbVc
GGW4ZFwtoyUG1D4KhpYtQfiibAHNKFI29Z1JXslk7zFhpo5TqKCwKhPZvUuS7Exn
bmpaSBq7
=H5C0
-----END PGP SIGNATURE-----

--82I3+IH0IqGh5yIs--