Date: Mon, 9 Feb 2009 11:25:09 +0100 From: Borja Marcos <BORJAMAR@SARENET.ES> To: Robert Watson <rwatson@FreeBSD.org> Cc: freebsd-security@freebsd.org Subject: Re: MAC subsystem and ZFS? Message-ID: <5CFEFF94-39B2-4CB6-9797-1F6B9EF73D41@SARENET.ES> In-Reply-To: <alpine.BSF.2.00.0902072220480.89719@fledge.watson.org> References: <5F581D71-E6BF-487D-91F0-67EA6A21BA6E@SARENET.ES> <alpine.BSF.2.00.0902072220480.89719@fledge.watson.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Feb 7, 2009, at 11:21 PM, Robert Watson wrote: >> I'm trying to upgrade the configuration of some web services, >> already using the MAC subsystem, to use ZFS instead of UFS, but I >> see that ZFS doesn't support MAC labels, even for a whole >> filesystem, which would be fine for me, I don't need multilabel >> support. >> >> Any ideas? Have I missed anything? > > Hmmm. Sounds like a bug -- all file systems should be able to > operate in single-label mode, even if they don't support EAs and > multilabel mode. Could you describe the symptoms you're > experiencing in a bit more detail? Indeed I can :) Sorry for the delay, a human nose-irritating virus, for which no known AV software exists, apart from patience, has kept me a bit parked this weekend :) I can read the MAC label from a ZFS dataset, but cannot change it. Example follows: # zfs create pool/test (indeed I can read the default label applied when creating it) # getfmac pool/test pool/test: biba/high,mls/low (but I cannot change it) # setfmac biba/equal,mls/equal /pool/test setfmac: labeling not supported in /pool/test (just in case it's a confusion because of being under "/pool", I try changing the mountpoint, still no success) # mkdir /testing # zfs set mountpoint=/testing pool/test # setfmac biba/equal,mls/equal /testing setfmac: labeling not supported in /testing This is a 7.1.RELEASE-p2 system. Thank you very much, Borja.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5CFEFF94-39B2-4CB6-9797-1F6B9EF73D41>