Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

selinux-policy: adjust kernel permissions for NFS #205

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

selinux-policy: adjust kernel permissions for NFS #205

wants to merge 1 commit into from

Commits on Oct 21, 2024

  1. selinux-policy: adjust kernel permissions for NFS 

    When serving files over NFS, the kernel's permissions to access the
inode are checked when determining whether the file can be executed
by clients. If the kernel lacks permission, then the client will see
a permission error and won't be able to execute the program.

Work around this by allowing the kernel access to execute mutable
files, while denying it permission to execute a new program without
transitioning to a new SELinux context.

To close off other potential paths to execution, define a transition
to a "forbidden" type that is explicitly denied, and deny the use of
any object as an entry point to that domain.

Signed-off-by: Ben Cressey <[email protected]>
    @bcressey
    bcressey committed Oct 21, 2024
    Configuration menu
    Copy the full SHA
    758d4b7 View commit details
    Browse the repository at this point in the history