MAC subsystem and ZFS?

[Borja Marcos]

On Feb 7, 2009, at 11:21 PM, Robert Watson wrote:

>> I'm trying to upgrade the configuration of some web services,  
>> already using the MAC subsystem, to use ZFS instead of UFS, but I  
>> see that ZFS doesn't support MAC labels, even for a whole  
>> filesystem, which would be fine for me, I don't need multilabel  
>> support.
>>
>> Any ideas? Have I missed anything?
>
> Hmmm.  Sounds like a bug -- all file systems should be able to  
> operate in single-label mode, even if they don't support EAs and  
> multilabel mode.  Could you describe the symptoms you're  
> experiencing in a bit more detail?

Indeed I can :) Sorry for the delay, a human nose-irritating virus,  
for which no known AV software exists, apart from patience, has kept  
me a bit parked this weekend :)

I can read the MAC label from a ZFS dataset, but cannot change it.  
Example follows:

# zfs create pool/test

(indeed I can read the default label applied when creating it)
# getfmac pool/test
pool/test: biba/high,mls/low

(but I cannot change it)
# setfmac biba/equal,mls/equal /pool/test
setfmac: labeling not supported in /pool/test

(just in case it's a confusion because of being under "/pool", I try  
changing the mountpoint, still no success)

# mkdir /testing
# zfs set mountpoint=/testing pool/test
# setfmac biba/equal,mls/equal /testing
setfmac: labeling not supported in /testing

This is a 7.1.RELEASE-p2 system.

Thank you very much,







Borja.