Date: Wed, 06 Feb 2013 17:48:30 +0100 From: Andreas Jonsson <andreas@romab.com> To: freebsd-security@freebsd.org Subject: FreeBSD 9.1 MAC Multilabel on nullfs Message-ID: <5112895E.5050506@romab.com>
next in thread | raw e-mail | index | archive | help
Hi List! Don't see much discussion about MAC here, time to change that! :-) Currently trying to set up a service jail, according to instructions in the handbook[1]. The problem I'm facing is that nullfs does not seem to support multilabeled filesystems, or am i missing something? ls -lZ /usr/js/testjail/var/run/test -rw-r--r-- 1 root wheel biba/equal 0 Feb 6 17:15 /usr/js/testjail/var/run/test Nullfs-mounting it inside the jail: ls -lZ /usr/j/testjail/s/var/run/test -rw-r--r-- 1 root wheel biba/high 0 Feb 6 17:15 /usr/j/testjail/s/var/run/test Currently, it looks like this: /usr/j/mroot on /usr/j/testjail (nullfs, local, nosuid, read-only) /usr/js/testjail on /usr/j/testjail/s (nullfs, local, nosuid) devfs on /usr/j/testjail/dev (devfs, local, multilabel) >From inside the jail, (where this directory is mounted), the following maclabel appears to be the following instead: # ls -lZ /var/run/test -rw-r--r-- 1 root wheel biba/high 0 Feb 6 16:15 /var/run/test Does the list have any suggestions for workarounds? One alternative would be to create a jail without shared root filesystems and skip nullfs, but perhaps there are other tricks i am not aware of? BR Andreas [1]. http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/jails-application.html
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5112895E.5050506>