|
|
|
Using GPFS with SElinux in enforcing mode
|
|
|
|
|
GPFS initscript
|
When running GPFS on SElinux you cannot allow the normal init scripts to start GPFS because that will cause the GPFS daemons to run in the SElinux domain "initrc_t" which is too restricted for GPFS. To get GPFS to run fully unconfined, use the runcon command to set the security context. Run the following in /etc/rc.d/rc.local:
Then disable automatic startup of GPFS by running:
|
|
File system labels
|
Secondly GPFS doesn't support the SElinux file labels, so you need to set a label on the file system at mount time. Any files in the GPFS file system will then have the same label. For example, to mount a GPFS file system with xen-images, disable normal GPFS automount of the file system by running:
Then "manually" mount the file system with the correct fscontext by adding the following to /var/mmfs/etc/mmfsup.scr:
|
|
|
|
|