| Message ID | 20210621165854.285237-1-dominick.grift@defensec.nl (mailing list archive) |
|---|---|
| State | Rejected |
| Headers | show |
| Series | [SELinux-notebook] computing_security_contexts.md: clarify mount options with comma | expand |
Dominick Grift <dominick.grift@defensec.nl> writes: > If you have a comma in your context then mount will reject it without > escaped quotes. This can be confusing and it is not well documented. Ignore this patch. It is actually thoroughly documented in mount(8). > > Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> > --- > src/computing_security_contexts.md | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/src/computing_security_contexts.md b/src/computing_security_contexts.md > index bb946b5..11d54b8 100644 > --- a/src/computing_security_contexts.md > +++ b/src/computing_security_contexts.md > @@ -175,7 +175,10 @@ Notes: > keyword present. > 2. There are mount options for allocating various context types: > *context=*, *fscontext=*, *defcontext=* and *rootcontext=*. They are > - fully described in the ***mount**(8)* man page. > + fully described in the ***mount**(8)* man page except for the fact that if > + your context contains a comma separator then you should wrap the context > + with escaped quotes. For example: > + *context=\"system_u:object_r:container_file_t:s0:c1,c2\"*. > > ### Network File System (nfsv4.2)
diff --git a/src/computing_security_contexts.md b/src/computing_security_contexts.md index bb946b5..11d54b8 100644 --- a/src/computing_security_contexts.md +++ b/src/computing_security_contexts.md @@ -175,7 +175,10 @@ Notes: keyword present. 2. There are mount options for allocating various context types: *context=*, *fscontext=*, *defcontext=* and *rootcontext=*. They are - fully described in the ***mount**(8)* man page. + fully described in the ***mount**(8)* man page except for the fact that if + your context contains a comma separator then you should wrap the context + with escaped quotes. For example: + *context=\"system_u:object_r:container_file_t:s0:c1,c2\"*. ### Network File System (nfsv4.2)
If you have a comma in your context then mount will reject it without escaped quotes. This can be confusing and it is not well documented. Signed-off-by: Dominick Grift <dominick.grift@defensec.nl> --- src/computing_security_contexts.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)