Skip to contentSkip to conversation

added autofs support

PATCH New Matthew Thode 3 participants 5 messages Oct 2, 2012 – Oct 9, 2012

lore
Share & tools
lore

Matthew Thode

author
#0 lore raw

PATCH 1/1 added autofs support

adds autofs support to portage, needed for using portage on nfs on autofs.

---
 portage.te |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
portage.te +3 -0
index 630f16f..128e7d6 100644
@@ -298,6 +298,9 @@ files_read_usr_files(portage_fetch_t)
 files_search_var_lib(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
+fs_search_auto_mountpoints(portage_fetch_t)
+dev_rw_autofs(portage_fetch_t)
+
 logging_list_logs(portage_fetch_t)
 logging_dontaudit_search_logs(portage_fetch_t)
Signature · 1 line
1.7.8.6
#1 lore raw

PATCH 1/1 added autofs support

Quoted 11 lines · Matthew Thode

adds autofs support to portage, needed for using portage on nfs on autofs.

---
 portage.te |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
portage.te +0 -0
index 630f16f..128e7d6 100644

portage.te files_read_usr_files(portage_fetch_t) · line 306

Quoted 9 lines
portage.te +3 -0
@@ -298,6 +298,9 @@ files_read_usr_files(portage_fetch_t)
 files_search_var_lib(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
+fs_search_auto_mountpoints(portage_fetch_t)
+dev_rw_autofs(portage_fetch_t)
+
 logging_list_logs(portage_fetch_t)
 logging_dontaudit_search_logs(portage_fetch_t)

This is wrong but this reply is mainly just a note to self.

So far i established that we need the following instead:

+tunable_policy(portage_use_nfs',
+ fs_getattr_nfs(portage_t)
+')

+fs_search_auto_mountpoints(portage_fetch_t)

+auth_use_nsswitch(portage_fetch_t)

author
#2 lore raw

PATCH 1/1 removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch

subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D

---
 portage.te |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
portage.te +3 -1
index 128e7d6..321b1ac 100644
@@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
 selinux_get_fs_mount(portage_t)
 
 auth_manage_shadow(portage_t)
+auth_use_nsswitch(portage_fetch_t)
+auth_use_nsswitch(portage_sandbox_t)
 
 # merging baselayout will need this:
 init_exec(portage_t)

@@ -299,7 +301,6 @@ files_search_var_lib(portage_fetch_t)
 files_dontaudit_search_pids(portage_fetch_t)
 
 fs_search_auto_mountpoints(portage_fetch_t)
-dev_rw_autofs(portage_fetch_t)
 
 logging_list_logs(portage_fetch_t)
 logging_dontaudit_search_logs(portage_fetch_t)

@@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
 ')
 
 tunable_policy(`portage_use_nfs',`
+	fs_getattr_nfs(portage_t)
 	fs_getattr_nfs(portage_fetch_t)
 	fs_manage_nfs_dirs(portage_fetch_t)
 	fs_manage_nfs_files(portage_fetch_t)
Signature · 1 line
1.7.8.6
#3 lore raw

PATCH 1/1 removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch

Quoted 19 lines · Matthew Thode

subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D

---
 portage.te |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
portage.te +2 -0
index 128e7d6..321b1ac 100644
@@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
 selinux_get_fs_mount(portage_t)
 
 auth_manage_shadow(portage_t)
+auth_use_nsswitch(portage_fetch_t)
+auth_use_nsswitch(portage_sandbox_t)
 
 # merging baselayout will need this:
 init_exec(portage_t)

[cut]

portage.te ifdef(`hide_broken_symptoms',` · line 328

Quoted 8 lines
portage.te +1 -0
@@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
 ')
 
 tunable_policy(`portage_use_nfs',`
+	fs_getattr_nfs(portage_t)
 	fs_getattr_nfs(portage_fetch_t)
 	fs_manage_nfs_dirs(portage_fetch_t)
 	fs_manage_nfs_files(portage_fetch_t)

The lines should go with the sections, i.e. the portage_fetch_t addition should go in the portage_fetch_t section, and the portage_sandbox_t addition should go in the portage_sandbox_t section.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#4 lore raw

PATCH 1/1 removed the rw autofs stuff added nfs search for portage_t and allowed use of nsswitch

Quoted 24 lines · Christopher J. PeBenito
Quoted 19 lines · Matthew Thode

subject more or less speaks for itself, lessened the permissions needed from autofs and fixed a couple of AVC denials with grifts help in irc, thanks :D

---
 portage.te |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
portage.te +2 -0
index 128e7d6..321b1ac 100644
@@ -193,6 +193,8 @@ files_manage_all_files(portage_t)
 selinux_get_fs_mount(portage_t)
 
 auth_manage_shadow(portage_t)
+auth_use_nsswitch(portage_fetch_t)
+auth_use_nsswitch(portage_sandbox_t)
 
 # merging baselayout will need this:
 init_exec(portage_t)

[cut]

Quoted 3 lines
portage.te +0 -0
@@ -321,6 +322,7 @@ ifdef(`hide_broken_symptoms',`
 ')
Quoted 8 lines

portage.te ifdef(`hide_broken_symptoms',` · line 328

Quoted 5 lines
portage.te +1 -0
 tunable_policy(`portage_use_nfs',`
+	fs_getattr_nfs(portage_t)
 	fs_getattr_nfs(portage_fetch_t)
 	fs_manage_nfs_dirs(portage_fetch_t)
 	fs_manage_nfs_files(portage_fetch_t)

The lines should go with the sections, i.e. the portage_fetch_t addition should go in the portage_fetch_t section, and the portage_sandbox_t addition should go in the portage_sandbox_t section.

This has already been taken care of