How To Have More Than On SELinux Context On A Directory

Home » CentOS » How To Have More Than On SELinux Context On A Directory
CentOS 11 Comments

Hello,

I need to have the TFTPdir_rw_t and samba_share_t SELinux context on the same directory.

How can we do this? Is it feasible to have more than one SELinux context?

Thanks, Bernard

11 thoughts on - How To Have More Than On SELinux Context On A Directory

  • Not as far as I know. You probably want to generate a local policy, using “audit2allow,” to allow whatever workflow you’re implementing.

  • I don’t think it’s possible/feasible. You’d probably need to add a new type and necessary rules to your local policy. Or add missing allow rules to an existing type (tftpdir_rw_t or samba_share_t). Or use audit2allow to add necessary allow rules to an existing type. Any of the above could be a major PITA.

  • No.

    The default targeted policy is mostly about Type Enforcement. Quote from the manual:

    “All files and processes are labeled with a type: types define a SELinux domain for processes and a SELinux type for files. SELinux policy rules define how types access each other, whether it be a domain accessing a type, or a domain accessing another domain. Access is only allowed if a specific SELinux policy rule exists that allows it.”

    You could have added a new type (eg TFTPdir_rw_and_samba_share_t) to label the files in your shared directory and defined necessary rules to allow access to these files by processes running in certain confined domains. These new rules would most likely include a subset of rules already defined in the default policy for samba_share_t and TFTPdir_rw_t types.

    I’ve never added a new type myself and cannot really elaborate any further on the subject.

    An easier approach would be to add missing access rules for already existing file type (either samba_share_t or TFTPdir_rw_t).

    BTW have you really tried to access files labelled with TFTPdir_rw_t via samba or vise versa? There’s already a number of rules in the default policy which allow ftp access to samba shares and smb/nmb access to files labelled with TFTPdir_rw_t. Eg

    # sesearch –allow -t samba_share_t | grep samba_share_t | grep ftp
    allow ftpd_t samba_share_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
    allow ftpd_t samba_share_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ;
    allow ftpd_t samba_share_t : lnk_file { ioctl read write create getattr setattr lock append unlink link rename } ;
    allow ftpd_t samba_share_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open } ;
    allow ftpd_t samba_share_t : fifo_file { ioctl read write create getattr setattr lock append unlink link rename open } ;

    May be the needed functionality is already there and all this discussion is the equivalent of shooting a gun on sparrows.

  • I can access /depot/tftp from a TFTP client but unable to do it from a Windows client as long as SELinux is enforced. If SELinux is permissive I
    can access it then I know Samba is properly configured.

    # getenforce Enforcing
    # ls -dZ /depot/tftp/
    drwxrwxrwx. root root system_u:object_r:tftpdir_rw_t:s0 /depot/tftp/

    And if I do it the other way around, give the directory a type samba_share_t then the TFTP clients are unable to push files.

    # getenforce Enforcing
    [root@CTSFILESRV01 depot]# ls -ldZ TFTP/
    drwxrwxrwx. root root system_u:object_r:samba_share_t:s0 TFTP/

    I would then to either create my own type or missing access rules as you suggest. Unfortunately, this will be when I will have time which I don’t have at the moment.

    Thanks for you help

    CentOS mailing list CentOS@CentOS.org https://lists.CentOS.org/mailman/listinfo/CentOS

  • –gIlA6ogHl3RaHBiGevDl1fXNI947oabrp Content-Type: text/plain; charset=utf-8
    Content-Transfer-Encoding: quoted-printable

    Don’t forget that it’s about process type and context. If you need multiple processes/domain types accessing the same context files, you’d probably just need a common context/label.


    man -k _selinux => will show you man pages for everything regarding selinux and domain/process/context

    => man TFTPd_selinux
    => search for samba and :

    If you want to share files with multiple domains (Apache, FTP, rsync, Samba), you can set a file context of public_content_t and public_content_rw_t. These context allow any of the above domains to read the content. If you want a particular domain to write to the public_content_rw_t domain, you must set the appropriate boolean.

    But read the whole TFTPd_selinux and samba_selinux man pages (and they share almost the same content for “Sharing files” stanzas :-)

  • You are looking for a man page, which usually belongs in a man section and is compressed. You can do:

    $ yum provides /usr/share/man/man8/tftpd_selinux.8.gz

    or, more generally:

    $ yum provides */tftpd_selinux*

    given the asterisk don’t resolve to something already existing in your local dir… You can escape them or quote in this case

    Marcelo


    Marcelo

    “¿No será acaso que esta vida moderna está teniendo más de moderna que de vida?” (Mafalda)