Received-SPF: pass (google.com: domain of linux-nfs+bounces-2349-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
IronPort-PHdr: A9a23:44yz3xfWicsNd6OG88uZTeGUlGM/eYqcDmcuAtIPkblCdOGk55v9e
 RCZ7vR2h1iPVoLeuLpIiOvT5rjpQndIoY2Av3YLbIFWWlcbhN8XkQ0tDI/NCUDyIPPwKS1vN
 M9DT1RiuXq8NBsdA97wMmXbuWb69jsOAlP6PAtxKP7yH9vehsK22uSt8rXYYh5Dg3y2ZrYhZ
 BmzpB/a49EfmpAqar5k0BbLr3BUM+hX3jZuIlSe3l7ws8yx55VktS9Xvpoc
IronPort-Data: A9a23:4ZaMb6guPATeHFs3GoWGk66WX161ehAKZh0ujC45NGQN5FlHY01je
 htvCGuFbPmLZjOmLY8jb9uy9h9Q6pDUx4M2SFc6rCxmQitjpJueD7x1DKtf0wB+jyHnZBg6h
 ynLQoCYdKjYdleF+1H1dOCn9CEgvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg
 vus5ZWAULOZ82QsaD5MsPve8EgHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL
 woU5Ojklo9x105F5uKNyt4XQGVTKlLhFVTmZk5tZkSXqkMqShrefUoMHKF0hU9/011llj3qo
 TlHncTYpQwBZsUglAmBOvVVO3kWAEFIxFPICVytveXI8BbpSXbL7apsNBAoAaICxPkiVAmi9
 dRAQNwMRgqIi+Tzy7WhR6w134IoLdLgO8UUvXQIITPxVKl9B8ucBfSRo4YEg1/chegWdRraT
 8YQbztiaAvJSxZOIVwQTpk5mY9Eg1GlK2cA+QjE9fdfD2778ggtzqrrDsPpW/uwWO8WgGuKv
 mzd4DGsav0dHIfCkWXeqC3EavX0tSf6Xp8CUbu27dZ0j1CJgG8eEhsbUR28u/bRolWzX9NZN
 lw85CUjt+4x+VatQ927WAe3yENopTYGUNZWVuY98gzIk/OS6AeCDW9CRTlEADA7iCMobRg42
 nbSoIjGPzFInuKXcSODypiOkyznbED5MlQ+TSMDSAIE5fzqr4cykg/DQ75f/Eid0ISd9dbYn
 WrikcQuu4j/m/LnwElSwLwqqyinqp6MRQkv60COBySu7xhyY8iuYInABbnnARRoctjxorqp5
 SRsdy2iAAYmVszleMulG7tlIV1Rz6zZWAAweHY2d3Xbyxyj+mS4Yadb6yxkKUFiP64sIGCwO
 BKJ5l8OusYMZRNGiJObharsW6zGKoC9RLzYugz8M7Kin7AoLVDXonsyDaJu9zC3wCDAbp3Ty
 b/ALJ7zVixFYUiW5DG3XOwamaQ63TwzwHibRJbwiXyaPUm2OhaopUM+GALWNIgRtfrcyC2Mq
 oo3H5XRkX13DrahChQ7BKZOdzjm21BhW8CvwyGWH8beSjdb9JYJV6WNnepwItI490mX/8+Rl
 kyAtoZj4AOXrVXMKB6BbTZob7aHYHq1hShT0fAEVbpw50UeXA==
IronPort-HdrOrdr: A9a23:H+JGW69FUR18Uh0lWbduk+Gkdr1zdoMgy1knxilNoENuA6+lfp
 GV/MjziyWUtN9IYgBfpTnhAsW9qXO1z+8S3WGIVY3SEjUOy1HYXb2KirGSggEIeheOudK1up
 0QCZSWZOeAaWSSyPyKnzVQcOxQgOVvkprY+Ns2pk0FJWoFGsMQijuRSDzrbnGeLzM2fKbRYa
 Dsnfav0ADQAUj/AP7LYUXtdtKz1OHjpdbNWzJDLRgh7wWFkDOv75DHMzXw5H0jegIK640PtU
 zenSLExojLiZyGIxnnuFP73tBzop/M29FDDMuDhow+MTP3kDulY4xnRvmroC01iPvH0idprP
 D85zMbe+hj4XLYeW+45TH33RP77Too43j+jXeFnHrYp9DjTj5SMbsFuWsZSGqc16MThqA77E
 t55RPBi3ORN2KZoM3J3amOa/itrDvunZNtq59Is5UVa/pvVFYYl/1swKoSKuZCIMo/g7pXTN
 WHy6rnlatrWELfYHbDsmZ1xtuwGnw1AxedW0AH/teYyj5MgRlCvgElLeEk7z89HagGOtJ5zv
 WBNr4tmKBFT8cQY644DOAdQdGvAmiIRR7XKmqdLVnuCalCYhv22tLKyaRw4PvvdI0DzZM0lp
 iEWFREtXQqc0arDcGVxpVE/h3EXW34VzXwzcNV4YR/p9THNffWGDzGTEprn9qrov0ZDMGeU/
 GvOIhOC/umNmfqEZYh5Xy2Z3CTEwhpbCQ4gKdNZ7vVmLO/FmTDjJ2uTMru
From: "Daniel Walker (danielwa)" <danielwa@cisco.com>
To: Jeff Layton <jlayton@kernel.org>
CC: "selinux@vger.kernel.org" <selinux@vger.kernel.org>,
        "xe-linux-external(mailer list)" <xe-linux-external@cisco.com>,
        "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Subject: Re: nfs client uses different MAC policy or model
Thread-Topic: nfs client uses different MAC policy or model
Thread-Index: AQHadmpPdLuamV23IU6d6aCv68CZjQ==
Date: Fri, 15 Mar 2024 23:09:25 +0000
Message-ID: <ZfTVJZtXghoii8DG@goliath>
References: <ZfONIThp2RIfmu1O@goliath>
 <d4861b0541bac2670e39dc340f110bf72558b703.camel@kernel.org>
In-Reply-To: <d4861b0541bac2670e39dc340f110bf72558b703.camel@kernel.org>
Accept-Language: en-GB, en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?us-ascii?Q?VFntfaJboY1hLM3e2ZlQolj7Ise8SEPrUR5rMqhJZstgG3RxB5ayas5c573G?=
 =?us-ascii?Q?jUoZbliYvz5E7gBghhxqguQWjx4tp4TbO3gZqN3Ie3BAyORE71XnmR6tLbrf?=
 =?us-ascii?Q?BuxJo4juwkp4bL/r06I9XkKVaWs6Pf5TojJZ9+MsEQHeV0u5gsA4A+064nz1?=
 =?us-ascii?Q?kyJztv4C7ZiU4pZSoNF5NdSE7tNWu6e0oS3v0hLebaE+CiYBiEb42GcEMnQZ?=
 =?us-ascii?Q?EbxBPDxkCdY+yiQ3LrYWwpVx3DcFyF8phSlOaRywdUbY/HMXa+olu7PlBIr/?=
 =?us-ascii?Q?b2LYlwqaAXlLrqTFWGQdms/D6ezAZef9lV2B8RkES9F638zBahkMouCPKTu8?=
 =?us-ascii?Q?TxzdGoRUxJgEWZUDAP2yopwT98NeJEgKY4dhS/YRvQ1JPfxVRoDHoUL39SD5?=
 =?us-ascii?Q?KQ/ZSzKs6pAdI1eV9QKTAP+XE7likVl9rxccRn98l2vaPiF7r7Jb+6r8KmSG?=
 =?us-ascii?Q?g7dOnHx/nzYHmJer7qQ1bFv6ZyJ8+FXVlVjVCRcCVNhtkMkI3MoPaV5/dBbu?=
 =?us-ascii?Q?qo94RMwHdoIZmFAmisDn3VsAYkxnWcBdZF00a027O7fT+s5cqDCim5fvS4Mr?=
 =?us-ascii?Q?3wfUOoIvuscU3hs24JETb1KR9uN28FZNdGaAtdtuCUl3of2d4Dcz/E+aQNFN?=
 =?us-ascii?Q?JxP2CPxJm2ueYEJJ7jeT01/B4G/y2qTL1yx+mdL0+8iX7MO8iDyrPVT/4Ev3?=
 =?us-ascii?Q?oKOzT08bVesk1p7HasI0ZAQA+rxW4v7T3V/MjfbdPzWiDmVg4CX6EsCYO+R2?=
 =?us-ascii?Q?NOEst2yTmUTdNCfAF7OdI6mFElbV3Ri9/66PoM/GfM/lw1rYsZHXJNP6Qmve?=
 =?us-ascii?Q?fao7uP9JcY6knu2n6SlHftY8/uBDSwTyQzCmKSJ7hY/WkNVZ6JJKDx5gzjzo?=
 =?us-ascii?Q?389Itk0iKrTVCxeSf72cr+l/cYdj7AeZTg7CNkWaZGHugnjeP4lqLPhaVSs2?=
 =?us-ascii?Q?c4zfbZfoX0uL8LgnFxO0ellRGlrNx21QIYtO7obDYv7yKIhLT8QIRmcsXkFB?=
 =?us-ascii?Q?CeytHDI73EAwHZ9Dbn26lCFpTBeY6l5GPelymq9WcipPOexknvabDeOOMyiY?=
 =?us-ascii?Q?ROVS7JOwsd5UHcwunVjCZ2tp1X1ERYwo6ygUiHJ/GaglH+kKIt2K2FWKlPu9?=
 =?us-ascii?Q?6mu463PP+iC0ZGq7tQ5OK8ijZmIVitMIJEunjjHOE1mhcTXCmsQ3Hls/qBvx?=
 =?us-ascii?Q?lCcsvJeghjiIXTVWPu/f0//ezzw+upi3eAr/6O/623g8vbVS1GcqbApkJ5xm?=
 =?us-ascii?Q?gOaMUIGQFt+Yv/QtpTAtC7SNAUNHeWMv0gRq+z41rgAf02VLW1GcvNU6xGvY?=
 =?us-ascii?Q?RDT1JKHbrtZ5Dov9KVAazJOYwLW4z/Q0QoSGSxi7IiXj9/TXtICY8pcDYxv3?=
 =?us-ascii?Q?MP9UgtK1L/YsxMRIxUELliS6PATX4NtbxhC1bFKQdbcko8SKwzEjLGb54/Rk?=
 =?us-ascii?Q?QqG01QHRIVwMLQilgjjf5/snTwOHTT8ztyzjz1jbezNgsdNW7Tgw91sEWfW+?=
 =?us-ascii?Q?mcudsrOHo3w+QePzKoPv7jOYtNcCeJk/A6pk7VZA9glDfHW8VXyo1hHtVoIL?=
 =?us-ascii?Q?P4kFzqKyi5qMybXVjQW4DpNXGMlaV67KBHi0tdoT?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <301942C07F635047B837E61F87356199@namprd11.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-nfs@vger.kernel.org
List-Id: <linux-nfs.vger.kernel.org>
List-Subscribe: <mailto:linux-nfs+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-nfs+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-OriginatorOrg: cisco.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR11MB5790.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 93fd8c30-768f-4e2c-ad67-08dc4544f550
X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2024 23:09:25.4995
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: t50h+kHqog3tQl+13TXSCtF8ywR2mFP/TCft/j06S02P5+e3gaJi0nd0AdqtP1U6fwiiwFQooJzCef4ekVpNTg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5PR11MB6212
X-Outbound-SMTP-Client: 72.163.7.165, rcdn-opgw-4.cisco.com
X-Outbound-Node: rcdn-core-11.cisco.com

On Fri, Mar 15, 2024 at 11:47:27AM -0400, Jeff Layton wrote:
> On Thu, 2024-03-14 at 23:49 +0000, Daniel Walker (danielwa) wrote:
> > Hi,
> >=20
> > It seems there is/was a problem using NFS security labels where the ser=
ver and client use
> > different MAC policy or model.=20
> >=20
> > I was reading this page,
> >=20
> > http://www.selinuxproject.org/page/Labeled_NFS/TODO#Label_Translation_F=
ramework
> >
> > It seems like this problem was known in 2009 when this page was written=
. Is
> > there a way to accomplish having extended attributes shared over NFS to=
 a client
> > with different selinux policies ?
> >=20
>=20
> Currently Linux NFS client and server only support limited server mode,
> where the server presents the contexts as they are and the client
> enforces its own policy locally. There's no requirement that the server
> enforce the same policy (or even enforce a security policy at all), all
> it's doing is storing and presenting the security label.
>=20
> So what you're saying should "work" today.
>=20

My situation is more constrained than this. The server would also have an s=
elinux
policy which is active and in use. Server selinux usage is out the users
control.

This could plausibly come up where you have an nfsroot or nfs pivot root
environment with selinux is active and the server also has a different or
conflicting selinux policy active.

I was looking for a way to translate between the two selinux policies which=
 is
how I found the link I provided.

Daniel=