fedora-selinux August 2010 archive
Main Archive Page > Month Archives  > fedora-selinux archives
fedora-selinux: Re: .autorelabel on mounted filesystems

Re: .autorelabel on mounted filesystems

From: Paul Howarth <paul_at_nospam>
Date: Fri Aug 27 2010 - 08:14:46 GMT
To: selinux@lists.fedoraproject.org

On 27/08/10 07:12, Daniel B. Thurman wrote:
>
> I have several versions of root distro partitions of which I do
> mount via fstab, but of course only one / and /boot partition
> is to be defined for the version to be booted.
>
> What I would like to know is, if I do an /.autorelabel,
> for one boot/root partition, does this mean that every
> mounted filesystem that appears in /etc/fstab also gets
> relabeled? If so, this is not what I want especially if
> other root distro partitions are being mounted for example,
> say: /md/{distro1, distro2, ...}
>
> So, How do I get around this? I could comment out
> all entries in /etc/fstab except / and /boot (plus the
> required entries), touch /.autorelabel, reboot, and once
> relabeling is completed, then add back in the commented
> out fstab entries, then issue a mount -a. Could I add an option
> entry say: NO_RELABEL to certain fstab entries?
>
> Since I was introduced to the /media since F9, I never could
> figure out how to add mounted "media" filesystems, which
> is why I added them instead to fstab.
>
> How do I solve this issue?

I create a local policy module for this sort of thing, with a file
contexts entry like this:

# Don't touch stuff here
/srv/homes(/.*)? <<none>>

So you could have:
::::::::::::::
otherdistros.fc
::::::::::::::
/md/distro1(/.*)? <<none>>
/md/distro2(/.*)? <<none>>

::::::::::::::
otherdistros.te
::::::::::::::
policy_module(otherdistros, 0.0.1)

Building and installing that module should do the trick.

Paul.
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux