[LU-5560] SELinux support on the client side

• Type: Improvement
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.8.0, Lustre 2.9.0
• Labels: patch
• Assignee: Oleg Drokin
• Reporter: Sebastien Buisson (Inactive)

Description

The aim is to be able to enforce SELinux security policies on Lustre from SELinux-enabled clients.

It requires to properly initiate file security context on client side, and store it on server side via extended attribute.

Issue Links

• is blocked by: LU-6784 Defects in SELinux support
• is related to: LUDOC-335 Documentation for SELinux Feature
• is related to: LU-8654 obd_connect_data handling must account for clients that send obd_connect_data_v1
• is related to: LU-9193 Multiple hangs observed with many open/getattr
• is related to: LU-6950 Lustre mount throws away SELinux context options
• is related to: LU-7417 Permission Denied on enforcing SElinux on Client

Comments

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/19971/
Subject: LU-5560 security: send file security context for creates
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 4ea24bdabb2b318721605bd185c32bbc1e9bc924

[Peter Jones]

Reclosing as the test script landed. Sebastien, you should open a new ticket to track the atomic context transfer during create patch also still in flight - http://review.whamcloud.com/#/c/19971/

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/15818/
Subject: LU-5560 tests: add sanity-selinux.sh
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: bfca8338e5f2ae1b7c16cc1d0c2376523d68685e

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch http://review.whamcloud.com/19970/
Subject: LU-5560 obd: reserve connection flag OBD_CONNECT2_FILE_SECCTX
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: a06b32d1c49eb6c31aeba556795841730de37006

[James Nunez (Inactive)]

Reopening ticket because the patch containing the SELinux test suite never landed; http://review.whamcloud.com/#/c/15818.

[Joseph Gmitter (Inactive)]

This work has landed for the 2.8.0 release in patch http://review.whamcloud.com/#/c/11648/

[Sarah Liu]

Hello,

For the upgrade/downgrade testing of this feature, how would you like the test be implemented? Is there any specific requirement?

Thanks,
Sarah

[Sebastien Buisson (Inactive)]

Hi,

Here is an updated Test Plan for SELinux support on the client side, including remarks from Andrew Perepechko.

Sebastien.

[Sebastien Buisson (Inactive)]

Hi,

Here is an updated Test Plan for SELinux support on the client side, including functional tests.

Sebastien.

[Gerrit Updater]

Sebastien Buisson ([e-mail]) uploaded a new patch: http://review.whamcloud.com/15818
Subject: LU-5560 tests: add sanity-selinux.sh
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 38ed4c38796c1903f4cfd553d886f7fbaebba972