nfsd trust

[gwelch-contegix]

How would I mark exe=nfsd as trusted? Or if there is a better way. How do I export a filesystem containing a language file?
e.g. %languages=application/x-bytecode.ocaml,application/x-bytecode.python,application/java-archive,text/x-java,application/x-java-applet,application/javascript,text/javascript,text/x-awk,text/x-gawk,text/x-lisp,application/x-elc,text/x-lua,text/x-m4,text/x-nftables,text/x-perl,text/x-php,text/x-python,text/x-R,text/x-ruby,text/x-script.guile,text/x-tcl,text/x-luatex,text/x-systemtap

[stevegrubb]

To make a file trusted, it has to be added to the trust database. For example.

fapolicyd-cli --file add /usr/bin/nfsd

[gwelch-contegix]

@stevegrubb That's the problem NFS is implemented in kernel space, there is no nfsd file.

[radosroka]

Could you elaborate little bit more? What are you trying to accomplish? Are there any denials?

[gwelch-contegix]

Yes, specifically this default rule deny_audit perm=any all : ftype=%languages causes a denial. The default rule directly above it being allow perm=open all : ftype=%languages trust=1 so I assume that nfsd is not trusted. But as nfsd is just a string set by the kernel for the particular process and there is no file I have no way to trust it. It also causes denials for clients attempting to to use any files that get categorized as such on the nfs share.

An odd symptom I have noticed: if I disable fapolicyd allow a client to access the file and then turn fapolicyd back on it no longer get's denied, my guess is through some sort of caching, either client side or server side.

[stevegrubb]

Haven't forgot about this. I need to setup an nfs mount and see what is going on. Remote filesystems in general would be hard to support because of the lack of a source of trust information.

[stevegrubb]

If nfsd is a kernel module, I think it can be allowed using the ppid option.
ps -eo exe,comm,pid,ppid | grep nfs <- assuming this returns 2 for ppid and nfsd for comm
allow perm=open auid=-1 ppid=2 comm=nfsd : all
This would go just above the rule that is blocking access.