Received-SPF: pass (google.com: domain of linux-nfs+bounces-2085-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Precedence: bulk
MIME-Version: 1.0
References: <CANH4o6P-jze6MB8yh3sWxhyHJWdj+JHK3vw58cYwQ0a7eVe_Vg@mail.gmail.com>
 <c397fb11a172be26111e1ad5cb17a92bceb065d3.camel@kernel.org>
 <CANH4o6O-Gcjc3eqiTd-KysZx-bpbzoh=CMTNixJ26cZQuRd=UQ@mail.gmail.com>
 <2e4760a87e1fc6906562442c27933e830635a929.camel@kernel.org>
 <CAENext6Zuv0pLgzp_vcBqdKmrH6Bg5GDV_hnUNOeFK2juoiJnw@mail.gmail.com> <7e499dd1deafcf043229973968920947453d4eba.camel@kernel.org>
In-Reply-To: <7e499dd1deafcf043229973968920947453d4eba.camel@kernel.org>
From: Martin Wege <martin.l.wege@gmail.com>
Date: Mon, 26 Feb 2024 08:30:00 +0100
Message-ID: <CANH4o6OmdiGDUjQd25Mza_bZX6zq5Vw85cD9X4RexWSQqxY4NQ@mail.gmail.com>
Subject: Re: SELinux-Support in Linux NFSv4.1 impl?
To: linux-nfs <linux-nfs@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sun, Feb 18, 2024 at 3:35=E2=80=AFPM Jeff Layton <jlayton@kernel.org> wr=
ote:
>
> On Sun, 2024-02-18 at 16:16 +0200, Guy Keren wrote:
> > On Sun, Feb 18, 2024 at 3:55=E2=80=AFPM Jeff Layton <jlayton@kernel.org=
> wrote:
> > >
> > > On Sat, 2024-02-17 at 14:37 +0100, Martin Wege wrote:
> > > > On Wed, Feb 14, 2024 at 12:28=E2=80=AFPM Jeff Layton <jlayton@kerne=
l.org> wrote:
> > > > >
> > > > > On Wed, 2024-02-14 at 10:46 +0100, Martin Wege wrote:
> > > > > > Hello,
> > > > > >
> > > > > > Does the Linux implementation server&client for NFSv4.1 support=
 SELinux?
> > > > > >
> > > > > >
> > > > >
> > > > > Labeled NFS is a NFSv4.2 feature. The Linux client and server do =
support
> > > >
> > > > Is there documentation on how to set this up? Will this work if the
> > > > root fs ('/') is NFSv4.2?
> > > >
> > >
> > > There isn't much to set up. If you mount using NFSv4.2, the client an=
d
> > > server should negotiate using SELinux (assuming both are SELinux
> > > enabled) and the SELinux contexts should (mostly) be projected across
> > > the wire.
> >
> > Jeff - as far as i know, while it is possible for the client to
> > get/set the secure labels of files on the server - there is no way for
> > the client to tell the server which user is performing the specific
> > access operation - so the 'FULL MODE' of nfs4.2 security labels cannot
> > work - only the 'Limited Server Mode' mode (i.e. only the client
> > verifies the security labels - the server does not). please correct me
> > if i'm wrong.
> >
> >
>
> (re-cc'ing the mailing list...)
>
> That is correct. I'm not aware of anyone having implented "Full mode" as
> of yet anywhere.
>
> The Linux server is a "dumb" labeled NFS server that just projects the
> contexts to the clients and doesn't try to do any enforcement.

Is this documented somehere? "NFSv4.2 SELinux HOWTO" maybe?

Thanks,
Martin