aboutsummaryrefslogtreecommitdiffstats
path: root/man/man8
diff options
context:
space:
mode:
authorMatthew Thode <[email protected]>2013-12-19 00:24:14 -0600
committerBrian Behlendorf <[email protected]>2013-12-19 10:37:31 -0800
commit11b9ec23b98eefe1e7bde0033dc8285f94cb0b90 (patch)
tree6be0568aea0dcbb0a76443768a70a26ae692b2bc /man/man8
parentd1d7e2689db9e03f11c069ebc9f1ba12829e5dac (diff)
Add full SELinux support
Four new dataset properties have been added to support SELinux. They are 'context', 'fscontext', 'defcontext' and 'rootcontext' which map directly to the context options described in mount(8). When one of these properties is set to something other than 'none'. That string will be passed verbatim as a mount option for the given context when the filesystem is mounted. For example, if you wanted the rootcontext for a filesystem to be set to 'system_u:object_r:fs_t' you would set the property as follows: $ zfs set rootcontext="system_u:object_r:fs_t" storage-pool/media This will ensure the filesystem is automatically mounted with that rootcontext. It is equivalent to manually specifying the rootcontext with the -o option like this: $ zfs mount -o rootcontext=system_u:object_r:fs_t storage-pool/media By default all four contexts are set to 'none'. Further information on SELinux contexts is detailed in mount(8) and selinux(8) man pages. Signed-off-by: Matthew Thode <[email protected]> Signed-off-by: Brian Behlendorf <[email protected]> Signed-off-by: Richard Yao <[email protected]> Closes #1504
Diffstat (limited to 'man/man8')
-rw-r--r--man/man8/mount.zfs.813
-rw-r--r--man/man8/zfs.846
2 files changed, 59 insertions, 0 deletions
diff --git a/man/man8/mount.zfs.8 b/man/man8/mount.zfs.8
index 60c36fe4e..b4e2406a2 100644
--- a/man/man8/mount.zfs.8
+++ b/man/man8/mount.zfs.8
@@ -75,6 +75,19 @@ Increase verbosity.
.BI "\-h"
Print the usage message.
.TP
+.BI "\-o context"
+This flag sets the SELinux context for all files in the filesytem
+under that mountpoint.
+.TP
+.BI "\-o fscontext"
+This flag sets the SELinux context for the filesytem being mounted.
+.TP
+.BI "\-o defcontext"
+This flag sets the SELinux context for unlabled files.
+.TP
+.BI "\-o rootcontext"
+This flag sets the SELinux context for the root inode of the filesystem.
+.TP
.BI "\-o legacy"
This private flag indicates that the
.I dataset
diff --git a/man/man8/zfs.8 b/man/man8/zfs.8
index 321a297f2..2c540f059 100644
--- a/man/man8/zfs.8
+++ b/man/man8/zfs.8
@@ -1298,6 +1298,52 @@ Indicates whether the file system should reject file names that include characte
.sp
.LP
The \fBcasesensitivity\fR, \fBnormalization\fR, and \fButf8only\fR properties are also new permissions that can be assigned to non-privileged users by using the \fBZFS\fR delegated administration feature.
+.RE
+
+.sp
+.ne 2
+.mk
+.na
+\fB\fBcontext\fR=\fBSELinux_User:SElinux_Role:Selinux_Type:Sensitivity_Level\fR\fR
+.ad
+.sp .6
+.RS 4n
+This flag sets the SELinux context for all files in the filesytem under the mountpoint for that filesystem. See \fBselinux\fR(8) for more information.
+.RE
+
+.sp
+.ne 2
+.mk
+.na
+\fB\fBfscontext\fR=\fBSELinux_User:SElinux_Role:Selinux_Type:Sensitivity_Level\fR\fR
+.ad
+.sp .6
+.RS 4n
+This flag sets the SELinux context for the filesytem being mounted. See \fBselinux\fR(8) for more information.
+.RE
+
+.sp
+.ne 2
+.mk
+.na
+\fB\fBdefntext\fR=\fBSELinux_User:SElinux_Role:Selinux_Type:Sensitivity_Level\fR\fR
+.ad
+.sp .6
+.RS 4n
+This flag sets the SELinux context for unlabeled files. See \fBselinux\fR(8) for more information.
+.RE
+
+.sp
+.ne 2
+.mk
+.na
+\fB\fBrootcontext\fR=\fBSELinux_User:SElinux_Role:Selinux_Type:Sensitivity_Level\fR\fR
+.ad
+.sp .6
+.RS 4n
+This flag sets the SELinux context for the root inode of the filesystem. See \fBselinux\fR(8) for more information.
+.RE
+
.SS "Temporary Mount Point Properties"
.LP
When a file system is mounted, either through \fBmount\fR(8) for legacy mounts or the \fBzfs mount\fR command for normal file systems, its mount options are set according to its properties. The correlation between properties and mount options is as follows: