Red Hat Bugzilla – Bug 484641
nfs_export_all_ro and nfs_export_all_rw on are on by default
Last modified: 2015-01-04 17:35:52 EST
Description of problem:
The nfs_selinux(8) manual page states "So by default SElinux policy does not allow nfs to share files", but the nfs_export_all_ro and nfs_export_all_rw Booleans are on by default, allowing NFS to share files.
Version-Release number of selected component (if applicable):
$ getsebool nfs_export_all_ro nfs_export_all_rw
nfs_export_all_ro --> on
nfs_export_all_rw --> on
nfs_export_all_ro and nfs_export_all_rw off by default, or man page updated.
I checked on two Fedora 10 machines - both had these booleans on by default.
On another Fedora 10 machine:
* yum remove selinux-policy selinux-policy-targeted
* rm /etc/selinux/ -rf
* yum installed selinux-policy selinux-policy-targeted
* reboot and relabel
Booleans were both on.
I could not find local changes in "/etc/selinux/targeted/modules/active/" that would turn these on.
I think the man page should change to no mention the default. Since this can differ depending on the policy type.
mls -- Off
Targeted -- on
Fixed wording in selinux-policy-3.6.12-4.fc11.noarch