Skip to contentSkip to conversation

Support NFS over TCP

PATCH New Sven Vermeulen 2 participants 4 messages Jul 20, 2011 – Jul 22, 2011

lore
Share & tools
lore

Sven Vermeulen

author
#0 lore raw

cover Support NFS over TCP

The current policies only support NFS over UDP. When mounting NFS locations with TCP, we notice that the kernel_t domain has no access to the NFS tcp_sockets.

These simple patches add an rpc_tcp_rw_nfs_socket() interface and then call it from the kernel_t definition.

Wkr,
Sven Vermeulen

author
#1 lore raw

PATCH 1/2 Create interface for NFS/RPC TCP access

Create the rpc_tcp_rw_nfs_sockets() interface, allowing for the calling domain to access the tcp_sockets managed by nfsd_t.

Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/services/rpc.if |   18 ++++++++++++++++++
 1 files changed, 18 insertions(+), 0 deletions(-)
policy/modules/services/rpc.if +18 -0
index cda37bb..dddabcf 100644
@@ -329,6 +329,24 @@ interface(`rpc_manage_nfs_ro_content',`
 
 ########################################
 ## <summary>
+##	Allow domain to read and write to an NFS TCP socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`rpc_tcp_rw_nfs_sockets',`
+	gen_require(`
+		type nfsd_t;
+	')
+
+	allow $1 nfsd_t:tcp_socket rw_socket_perms;
+')
+
+########################################
+## <summary>
 ##	Allow domain to read and write to an NFS UDP socket.
 ## </summary>
 ## <param name="domain">
Signature · 1 line
1.7.3.4
author
#2 lore raw

PATCH 2/2 Allow kernel to access NFS/RPC TCP

In reply to Sven Vermeulen

Allow kernel_t to access the nfsd_t' tcp_sockets.

Signed-off-by Sven Vermeulen <[email protected]>
---
 policy/modules/kernel/kernel.te |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/kernel/kernel.te +1 -0
index 41357ac..fecbfcc 100644
@@ -326,6 +326,7 @@ optional_policy(`
 
 	rpc_manage_nfs_ro_content(kernel_t)
 	rpc_manage_nfs_rw_content(kernel_t)
+	rpc_tcp_rw_nfs_sockets(kernel_t)
 	rpc_udp_rw_nfs_sockets(kernel_t)
 
 	tunable_policy(`nfs_export_all_ro',`
Signature · 1 line
1.7.3.4
#3 lore raw

cover Support NFS over TCP

In reply to Sven Vermeulen
Quoted 6 lines · Sven Vermeulen

The current policies only support NFS over UDP. When mounting NFS locations with TCP, we notice that the kernel_t domain has no access to the NFS tcp_sockets.

These simple patches add an rpc_tcp_rw_nfs_socket() interface and then call it from the kernel_t definition.

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com