diff options
| author | Matthew Thode <[email protected]> | 2013-12-19 00:24:14 -0600 |
|---|---|---|
| committer | Brian Behlendorf <[email protected]> | 2013-12-19 10:37:31 -0800 |
| commit | 11b9ec23b98eefe1e7bde0033dc8285f94cb0b90 (patch) | |
| tree | 6be0568aea0dcbb0a76443768a70a26ae692b2bc /module/zcommon | |
| parent | d1d7e2689db9e03f11c069ebc9f1ba12829e5dac (diff) | |
Add full SELinux support
Four new dataset properties have been added to support SELinux. They
are 'context', 'fscontext', 'defcontext' and 'rootcontext' which map
directly to the context options described in mount(8). When one of
these properties is set to something other than 'none'. That string
will be passed verbatim as a mount option for the given context when
the filesystem is mounted.
For example, if you wanted the rootcontext for a filesystem to be set
to 'system_u:object_r:fs_t' you would set the property as follows:
$ zfs set rootcontext="system_u:object_r:fs_t" storage-pool/media
This will ensure the filesystem is automatically mounted with that
rootcontext. It is equivalent to manually specifying the rootcontext
with the -o option like this:
$ zfs mount -o rootcontext=system_u:object_r:fs_t storage-pool/media
By default all four contexts are set to 'none'. Further information
on SELinux contexts is detailed in mount(8) and selinux(8) man pages.
Signed-off-by: Matthew Thode <[email protected]>
Signed-off-by: Brian Behlendorf <[email protected]>
Signed-off-by: Richard Yao <[email protected]>
Closes #1504
Diffstat (limited to 'module/zcommon')
| -rw-r--r-- | module/zcommon/zfs_prop.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/module/zcommon/zfs_prop.c b/module/zcommon/zfs_prop.c index 98d5bea96..121b1eb57 100644 --- a/module/zcommon/zfs_prop.c +++ b/module/zcommon/zfs_prop.c @@ -332,6 +332,18 @@ zfs_prop_init(void) zprop_register_string(ZFS_PROP_MLSLABEL, "mlslabel", ZFS_MLSLABEL_DEFAULT, PROP_INHERIT, ZFS_TYPE_DATASET, "<sensitivity label>", "MLSLABEL"); + zprop_register_string(ZFS_PROP_SELINUX_CONTEXT, "context", + "none", PROP_DEFAULT, ZFS_TYPE_DATASET, "<selinux context>", + "CONTEXT"); + zprop_register_string(ZFS_PROP_SELINUX_FSCONTEXT, "fscontext", + "none", PROP_DEFAULT, ZFS_TYPE_DATASET, "<selinux fscontext>", + "FSCONTEXT"); + zprop_register_string(ZFS_PROP_SELINUX_DEFCONTEXT, "defcontext", + "none", PROP_DEFAULT, ZFS_TYPE_DATASET, "<selinux defcontext>", + "DEFCONTEXT"); + zprop_register_string(ZFS_PROP_SELINUX_ROOTCONTEXT, "rootcontext", + "none", PROP_DEFAULT, ZFS_TYPE_DATASET, "<selinux rootcontext>", + "ROOTCONTEXT"); /* readonly number properties */ zprop_register_number(ZFS_PROP_USED, "used", 0, PROP_READONLY, |