Bug 484641 - nfs_export_all_ro and nfs_export_all_rw on are on by default
nfs_export_all_ro and nfs_export_all_rw on are on by default
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
All Linux
low Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2009-02-09 01:30 EST by Murray McAllister
Modified: 2015-01-04 17:35 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-04-13 10:54:47 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Murray McAllister 2009-02-09 01:30:08 EST
Description of problem:

The nfs_selinux(8) manual page states "So by default SElinux policy does not allow nfs to share files", but the nfs_export_all_ro and nfs_export_all_rw Booleans are on by default, allowing NFS to share files.

Version-Release number of selected component (if applicable):


Actual results:

$ getsebool nfs_export_all_ro nfs_export_all_rw
nfs_export_all_ro --> on
nfs_export_all_rw --> on

Expected results:

nfs_export_all_ro and nfs_export_all_rw off by default, or man page updated.

Additional info:

I checked on two Fedora 10 machines - both had these booleans on by default.

On another Fedora 10 machine:

* yum remove selinux-policy selinux-policy-targeted
* rm /etc/selinux/ -rf
* rebooted
* yum installed selinux-policy selinux-policy-targeted
* reboot and relabel

Booleans were both on.

I could not find local changes in "/etc/selinux/targeted/modules/active/" that would turn these on.
Comment 1 Daniel Walsh 2009-02-09 08:50:18 EST
I think the man page should change to no mention the default.  Since this can differ depending on the policy type.

mls -- Off
Targeted -- on
Comment 2 Daniel Walsh 2009-04-13 10:54:47 EDT
Fixed wording in  selinux-policy-3.6.12-4.fc11.noarch

Note You need to log in before you can comment on or make changes to this bug.