| diff -up nfs-utils-1.3.0/support/include/nfs/export.h.orig nfs-utils-1.3.0/support/include/nfs/export.h |
| --- nfs-utils-1.3.0/support/include/nfs/export.h.orig 2017-03-27 10:07:41.440397336 -0400 |
| +++ nfs-utils-1.3.0/support/include/nfs/export.h 2017-03-27 10:08:57.195772235 -0400 |
| @@ -18,7 +18,8 @@ |
| #define NFSEXP_ASYNC 0x0010 |
| #define NFSEXP_GATHERED_WRITES 0x0020 |
| #define NFSEXP_NOREADDIRPLUS 0x0040 |
| -/* 80, 100 unused */ |
| +#define NFSEXP_SECURITY_LABEL 0x0080 |
| +/* 0x100 unused */ |
| #define NFSEXP_NOHIDE 0x0200 |
| #define NFSEXP_NOSUBTREECHECK 0x0400 |
| #define NFSEXP_NOAUTHNLM 0x0800 |
| diff -up nfs-utils-1.3.0/support/nfs/exports.c.orig nfs-utils-1.3.0/support/nfs/exports.c |
| --- nfs-utils-1.3.0/support/nfs/exports.c.orig 2017-03-27 10:07:41.549399315 -0400 |
| +++ nfs-utils-1.3.0/support/nfs/exports.c 2017-03-27 10:08:58.441794848 -0400 |
| @@ -274,6 +274,8 @@ putexportent(struct exportent *ep) |
| "no_" : ""); |
| if (ep->e_flags & NFSEXP_NOREADDIRPLUS) |
| fprintf(fp, "nordirplus,"); |
| + if (ep->e_flags & NFSEXP_SECURITY_LABEL) |
| + fprintf(fp, "security_label,"); |
| fprintf(fp, "%spnfs,", (ep->e_flags & NFSEXP_PNFS)? "" : "no_"); |
| if (ep->e_flags & NFSEXP_FSID) { |
| fprintf(fp, "fsid=%d,", ep->e_fsid); |
| @@ -543,6 +545,8 @@ parseopts(char *cp, struct exportent *ep |
| setflags(NFSEXP_ASYNC, active, ep); |
| else if (!strcmp(opt, "nordirplus")) |
| setflags(NFSEXP_NOREADDIRPLUS, active, ep); |
| + else if (!strcmp(opt, "security_label")) |
| + setflags(NFSEXP_SECURITY_LABEL, active, ep); |
| else if (!strcmp(opt, "nohide")) |
| setflags(NFSEXP_NOHIDE, active, ep); |
| else if (!strcmp(opt, "hide")) |
| diff -up nfs-utils-1.3.0/utils/exportfs/exportfs.c.orig nfs-utils-1.3.0/utils/exportfs/exportfs.c |
| --- nfs-utils-1.3.0/utils/exportfs/exportfs.c.orig 2017-03-27 10:08:58.441794848 -0400 |
| +++ nfs-utils-1.3.0/utils/exportfs/exportfs.c 2017-03-27 10:11:00.939046616 -0400 |
| @@ -835,6 +835,8 @@ dump(int verbose, int export_format) |
| c = dumpopt(c, "no_subtree_check"); |
| if (ep->e_flags & NFSEXP_NOAUTHNLM) |
| c = dumpopt(c, "insecure_locks"); |
| + if (ep->e_flags & NFSEXP_SECURITY_LABEL) |
| + c = dumpopt(c, "security_label"); |
| if (ep->e_flags & NFSEXP_NOACL) |
| c = dumpopt(c, "no_acl"); |
| if (ep->e_flags & NFSEXP_PNFS) |
| diff -up nfs-utils-1.3.0/utils/exportfs/exports.man.orig nfs-utils-1.3.0/utils/exportfs/exports.man |
| --- nfs-utils-1.3.0/utils/exportfs/exports.man.orig 2017-03-27 10:07:41.515398698 -0400 |
| +++ nfs-utils-1.3.0/utils/exportfs/exports.man 2017-03-27 10:08:58.441794848 -0400 |
| @@ -417,6 +417,14 @@ devices. The default can be explicitly r |
| .I no_pnfs |
| option. |
| |
| +.TP |
| +.IR security_label |
| +With this option set, clients using NFSv4.2 or higher will be able to |
| +set and retrieve security labels (such as those used by SELinux). This |
| +will only work if all clients use a consistent security policy. Note |
| +that early kernels did not support this export option, and instead |
| +enabled security labels by default. |
| + |
| .SS User ID Mapping |
| .PP |
| .B nfsd |