NFSD: Server implementation of MAC Labeling

Implement labeled NFS on the server: encoding and decoding, and writing
and reading, of file labels.

Enabled with CONFIG_NFSD_V4_SECURITY_LABEL.

Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com>
Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg>
Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg>
Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

1 files changed, 16 insertions, 0 deletions

diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig
index 430b6872806f..dc8f1ef665ce 100644
--- a/fs/nfsd/Kconfig
+++ b/fs/nfsd/Kconfig
@@ -81,6 +81,22 @@ config NFSD_V4
 
           If unsure, say N.
 
+config NFSD_V4_SECURITY_LABEL
+        bool "Provide Security Label support for NFSv4 server"
+        depends on NFSD_V4 && SECURITY
+        help
+
+        Say Y here if you want enable fine-grained security label attribute
+        support for NFS version 4.  Security labels allow security modules like
+        SELinux and Smack to label files to facilitate enforcement of their policies.
+        Without this an NFSv4 mount will have the same label on each file.
+
+        If you do not wish to enable fine-grained security labels SELinux or
+        Smack policies on NFSv4 files, say N.
+
+        WARNING: there is still a chance of backwards-incompatible protocol changes.
+        For now we recommend "Y" only for developers and testers."
+
 config NFSD_FAULT_INJECTION
         bool "NFS server manual fault injection"
         depends on NFSD_V4 && DEBUG_KERNEL