oddjob selinux policy for subfolder /n/home vs /home

Devyn · 09-22-2015, 11:22 PM

Hey All,

I need to have oddjob create the home folders under an alternate directory, /n/home that I plan to share out. I can successfully change the directoy from /home to /nfshome after changing the selinux context and oddjob makes the new home folder under /nfshome:

PHP Code:



[root@host /]# semanage fcontext -a -t home_root_t /nfshome 
[root@host /]# semanage fcontext -a -e /home /nfshome 
[root@host /]# restorecon -vR /nfshome

(courtesy http://serverfault.com/questions/521...elinux-context )

However when I try to configure the system to use /n/home instead of /nfshome, the folder is never created AND there is nothing in the log files to even indicate that oddjob attempted to create a folder under /n/home.

PHP Code:



# ls -ldZ /home 
drwxr-xr-x. root root system_u:object_r:home_root_t:s0 /home 
# ls -ldZ /nfshome 
drwxr-xr-x. root root system_u:object_r:home_root_t:s0 /nfshome 
# ls -ldZ /n/home 
drwxr-xr-x. root root unconfined_u:object_r:home_root_t:s0 /n/home 
# ls -ldZ /n 
drwxr-xr-x. root root system_u:object_r:file_t:s0      /n 
#

Is there a parent relationship on folders I need to take care of with selinux first on the parent folder /n before oddjob can create home folders in /n/home/?

Also how and where to turn on SELinux debugging messages? (I'm new to selinux)

Thanks,
Devyn

Devyn · 09-22-2015, 11:26 PM

Setting SELinux labels on /n worked but what if I wish to keep /n with different labels then /n/home?

I may wish to store things on /n where home_root_t might effect performance of applications using that storage.

Cheers,
Devyn

Devyn · 09-23-2015, 01:40 PM

Hey All,

An additional question. From each client, if I'm to mount the NFSv4 share from my server on each client like this:

[ clientsrv: ] # mount -o soft,rw,timeo=5 nfsrv:/n/ /n

What permissions would I need on the client to allow home directories to be created for new users from any machine they log in too?

Cheers,
Devyn

Devyn · 09-24-2015, 10:24 AM

Hey All,

From the client, on login, the system isn't able to create the user's home directory but from the server it can of course. However in selinux if you mount the folder it is nfs_t by default. How to get around this?

PHP Code:



# ls -ldZ /n 
drwxr-xr-x. root root system_u:object_r:nfs_t:s0       /n 
# ls -ldZ /n/home 
drwxr-xr-x. root root system_u:object_r:nfs_t:s0       /n/home 
# cd /n/home 
# mkdir devyn 
mkdir: cannot create directory `devyn': Permission denied 
#

Thanks,
Devyn

Devyn · 09-24-2015, 11:00 AM

If i already have the user folder created on the NFS server, that's fine and writes to it from users logging into the clients works fine. However as root creates the folder and root i ssquashed, what is my alternative on the client? Can I setup the mount to signal the NFS server to create the home folder somehow?

Thanks,
Devyn