Bug 484641

Summary:	nfs_export_all_ro and nfs_export_all_rw on are on by default
Product:	[Fedora] Fedora	Reporter:	Murray McAllister <mmcallis>
Component:	selinux-policy	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	10	CC:	dwalsh, jkubin, mgrepl, vdanen
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-04-13 14:54:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Murray McAllister 2009-02-09 06:30:08 UTC

Description of problem:

The nfs_selinux(8) manual page states "So by default SElinux policy does not allow nfs to share files", but the nfs_export_all_ro and nfs_export_all_rw Booleans are on by default, allowing NFS to share files.

Version-Release number of selected component (if applicable):

selinux-policy-3.5.13-41.fc10.noarch
selinux-policy-targeted-3.5.13-41.fc10.noarch


Actual results:

$ getsebool nfs_export_all_ro nfs_export_all_rw
nfs_export_all_ro --> on
nfs_export_all_rw --> on


Expected results:

nfs_export_all_ro and nfs_export_all_rw off by default, or man page updated.


Additional info:

I checked on two Fedora 10 machines - both had these booleans on by default.

On another Fedora 10 machine:

* yum remove selinux-policy selinux-policy-targeted
* rm /etc/selinux/ -rf
* rebooted
* yum installed selinux-policy selinux-policy-targeted
* reboot and relabel

Booleans were both on.

I could not find local changes in "/etc/selinux/targeted/modules/active/" that would turn these on.

Comment 1 Daniel Walsh 2009-02-09 13:50:18 UTC

I think the man page should change to no mention the default.  Since this can differ depending on the policy type.

mls -- Off
Targeted -- on

Comment 2 Daniel Walsh 2009-04-13 14:54:47 UTC

Fixed wording in  selinux-policy-3.6.12-4.fc11.noarch