From Fedora Project Wiki
No edit summary
Line 1: Line 1:
= SELinux Labeled NFS Support <!-- The name of your feature --> =
{{admon/important | Comments and Explanations | The page source contains comments providing guidance to fill out each section. They are invisible when viewing this page. To read it, choose the "edit" link.<br/> '''Copy the source to a ''new page'' before making changes!  DO NOT EDIT THIS TEMPLATE FOR YOUR CHANGE PROPOSAL.'''}}
 
<!-- Self Contained or System Wide Change Proposal?
Use this guide to determine to which category your proposed change belongs to.
 
Self Contained Changes are:
* changes to isolated/leaf package without the impact on other packages/rest of the distribution
* limited scope changes without the impact on other packages/rest of the distribution
* coordinated effort within SIG with limited impact outside SIG functional area, accepted by the SIG
 
System Wide Changes are:
* changes that does not fit Self Contained Changes category touching
* changes that require coordination within the distribution (for example mass rebuilds, release engineering or other teams effort etc.)
* changing system defaults
 
For Self Contained Changes, sections marked as "REQUIRED FOR SYSTEM WIDE CHANGES" are OPTIONAL but FESCo/Wrangler can request more details (especially in case the change proposal category is
improper or updated to System Wide category). For System Wide Changes all fields on this form are required for FESCo acceptance (when applies). 
 
We request that you maintain the same order of sections so that all of the change proposal pages are uniform.
-->
 
= Enable SELinux Labeled NFS Support <!-- The name of your feature --> =


== Summary ==  
== Summary ==  
Line 6: Line 27:


== Owner ==
== Owner ==
<!--This should link to your home wiki page so we know who you are-->
<!--  
For change proposals to quality as self-contained, owners of all affected packages need to be included here. Alternatively, a SIG can be listed as an owner if it owns all affected packages.
This should link to your home wiki page so we know who you are.
-->
* Name: [[User:dwalsh| Daniel Walsh]]
* Name: [[User:dwalsh| Daniel Walsh]]
* Name: [[User:steved| Steve Dickson]]
* Name: [[User:steved| Steve Dickson]]


<!-- Include you email address that you can be reached should people want to contact you about helping with your feature, status is requested, or technical issues need to be resolved-->
<!-- Include you email address that you can be reached should people want to contact you about helping with your change, status is requested, or technical issues need to be resolved. If the change proposal is owned by a SIG, please also add a primary contact person. -->
* Email: <dwalsh@redhat.com>
* Email: <dwalsh@redhat.com>
* Email: <steved@redhat.com>


== Current status ==
== Current status ==
* Targeted release: [Fedora 20]  
* Targeted release: [Fedora 20]  
* Last updated: Jul 15 2013
* Last updated: Jul 24 2013
<!-- After the change proposal is accepted by FESCo, tracking bug is created in Bugzilla and linked to this page
Bugzilla states meaning as usual:
NEW -> change proposal is submitted and announced
ASSIGNED -> accepted by FESCo with on going development
MODIFIED -> change is substantially done and testable
ON_QA -> change is code completed and could be tested in the Beta release (optionally by QA)
CLOSED as NEXTRELEASE -> change is completed and verified and will be delivered in next release under development
-->
* Tracker bug: <will be assigned by the Wrangler>
* Percentage of completion: 90%
* Percentage of completion: 90%
** selinux-policy fixes are in Fedora 20.  
** selinux-policy fixes are in Fedora 20.  
Line 38: Line 72:


== Scope ==
== Scope ==
<!-- What work do the developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
<!-- What work do the developers have to accomplish to complete the change in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
Turn on Labeled NFS in the Fedora Kernel,  Fix any policy issues that arise because of this.  I believe this is mainly a testing issue, and that the functionality is comeplet.
 
* Proposal owners:
<!-- What work do the feature owners have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
 
* Other developers: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- What work do other developers have to accomplish to complete the feature in time for release?  Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?-->
 
* Release engineering: N/A (not a System Wide Change)  <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- Does this feature require coordination with release engineering (e.g. changes to installer image generation or update package delivery)?  Is a mass rebuid required?  If a rel-eng ticket exists, add a link here.  -->
 
* Policies and guidelines: N/A (not a System Wide Change) <!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
<!-- Do the packaging guidelines or other documents need to be updated for this feature?  If so, does it need to happen before or after the implementation is done?  If a FPC ticket exists, add a link here. -->
 
Turn on Labeled NFS in the Fedora Kernel,  Fix any policy issues that arise because of this.  I believe this is mainly a testing issue, and that the functionality is comeplete.
 
== Upgrade/compatibility impact ==
<!-- What happens to systems that have had a previous versions of Fedora installed and are updated to the version containing this change? Will anything require manual configuration or data migration? Will any existing functionality be no longer supported? -->


<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
N/A (not a System Wide Change)
== How To Test ==
== How To Test ==
== How To Test ==
<!-- This does not need to be a full-fledged document. Describe the dimensions of tests that this feature is expected to pass when it is done.  If it needs to be tested with different hardware or software configurations, indicate them.  The more specific you can be, the better the community testing can be. -->
<!-- This does not need to be a full-fledged document. Describe the dimensions of tests that this change implementation is expected to pass when it is done.  If it needs to be tested with different hardware or software configurations, indicate them.  The more specific you can be, the better the community testing can be.  
 
Remember that you are writing this how to for interested testers to use to check out your change implementation - documenting what you do for testing is OK, but it's much better to document what *I* can do to test your change.
 
A good "how to test" should answer these four questions:
 
0. What special hardware / data / etc. is needed (if any)?
1. How do I prepare my system to test this change? What packages
need to be installed, config files edited, etc.?
2. What specific actions do I perform to check that the change is
working like it's supposed to?
3. What are the expected results of those actions?
-->
 
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
Do to a bug in nfs-utils:
Do to a bug in nfs-utils:


Line 77: Line 145:


Also need testing on three way.  IE You need two clients that support SELinux CLient NFS and change the label on one client, and make sure the other client sees the change.
Also need testing on three way.  IE You need two clients that support SELinux CLient NFS and change the label on one client, and make sure the other client sees the change.
== User Experience ==
<!-- If this change proposal is noticeable by its target audience, how will their experiences change as a result?  Describe what they will see or notice. -->
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
N/A (not a System Wide Change)
== Dependencies ==
<!-- What other packages (RPMs) depend on this package?  Are there changes outside the developers' control on which completion of this change depends?  In other words, completion of another change owned by someone else and might cause you to not be able to finish on time or that you would need to coordinate?  Other upstream projects like the kernel (if this is not a kernel change)? -->
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
N/A (not a System Wide Change)


== Contingency Plan ==
== Contingency Plan ==
Line 94: Line 173:
* See [[Talk:Features/LabeledNFS]]  <!-- This adds a link to the "discussion" tab associated with your page.  This provides the ability to have ongoing comments or conversation without bogging down the main feature page -->
* See [[Talk:Features/LabeledNFS]]  <!-- This adds a link to the "discussion" tab associated with your page.  This provides the ability to have ongoing comments or conversation without bogging down the main feature page -->


[[Category:FeatureReadyForWrangler]]
[[Category:ChangeReadyForWrangler]]
<!-- When your feature page is completed and ready for review -->
<!-- When your change proposal page is completed and ready for review and announcement -->
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler -->
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler -->
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete-->
<!-- The Wrangler announces the Change to the devel-announce list and changes the category to Category:ChangeAnnounced (no action required) -->  
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process -->
<!-- After review, the Wrangler will move your page to Category:ChangeReadyForFesco... if it still needs more work it will move back to Category:ChangePageIncomplete-->
 
<!-- Select proper category, default is Self Contained Change -->
[[Category:SystemWideChange]]
<!-- [[Category:SystemWideChange]] -->

Revision as of 14:05, 24 July 2013

Comments and Explanations
The page source contains comments providing guidance to fill out each section. They are invisible when viewing this page. To read it, choose the "edit" link.
Copy the source to a new page before making changes! DO NOT EDIT THIS TEMPLATE FOR YOUR CHANGE PROPOSAL.


Enable SELinux Labeled NFS Support

Summary

The Linux Kernel has grown support for passing SELinux labels between a client and server using NFS.

Owner

  • Email: <dwalsh@redhat.com>
  • Email: <steved@redhat.com>

Current status

  • Targeted release: [Fedora 20]
  • Last updated: Jul 24 2013
  • Tracker bug: <will be assigned by the Wrangler>
  • Percentage of completion: 90%


Detailed Description

We have always needed to treat NFS mounts with a single label usually something like nfs_t. Or at best allow an administrator to override the default with a label using the mount --context option. With this change we have lots of different Labels supported on an NFS share.

Benefit to Fedora

There are two huge benefits for Fedora, in that currently we can not differentiate different labels on a single NFS mount point. Applications like Secure Virtualization as launched by libvirt, can not set the label of an image file on an NFS share, so sVirt separation is severely weakened. Similarly if you setup home directories on an NFS share, then any confined application that needs to write a file in a home directory now can write any file on an NFS Share.

With labeled NFS this vulnerability goes away.

Scope

  • Proposal owners:
  • Other developers: N/A (not a System Wide Change)
  • Release engineering: N/A (not a System Wide Change)
  • Policies and guidelines: N/A (not a System Wide Change)

Turn on Labeled NFS in the Fedora Kernel, Fix any policy issues that arise because of this. I believe this is mainly a testing issue, and that the functionality is comeplete.

Upgrade/compatibility impact

N/A (not a System Wide Change)

How To Test

How To Test

Do to a bug in nfs-utils:

  • Server Side

Start/Stop nfs server. 

   systemctl start nfs
   systemctl stop nfs

Set the version 

   echo "+4.2" > /proc/fs/nfsd/versions

Start Server Again 

   systemctl start nfs
  • Client Side
   mount  -o v4.2 server:mntpoint localmountpoint

There are many different scenarios that have to be tested with this new functionality.

Basically with Labeled NFS we need to test with client and servers supporting LNFS and SELinux

SELinux Testing

  • SELinux Client LNFS - SELinux Server LNFS
  • SELinux Client LNFS - SELinux Server No LNFS
  • SELinux CLient LNFS - Server LNFS
  • SELinux CLient LNFS - Server No LNFS
  • Client LNFS - SELinux Server LNFS
  • Client LNFS - SELInux Server No LNFS
  • Client LNFS - Server LNFS
  • Client LNFS - Server no LNFS
  • Client no LNFS - SELinux Server LNFS
  • Client no LNFS - SELInux Server No LNFS
  • Client no LNFS - Server LNFS
  • Client no LNFS - Server no LNFS

Also need testing on three way. IE You need two clients that support SELinux CLient NFS and change the label on one client, and make sure the other client sees the change.

User Experience

N/A (not a System Wide Change)

Dependencies

N/A (not a System Wide Change)

Contingency Plan

We can continue using what we always did, all clients labeled the same

Documentation

Release Notes

Comments and Discussion

Retrieved from "https://fedoraproject.org/w/index.php?title=Features/LabeledNFS&oldid=346381"