IBM®
Skip to main content
    Country/region [select]      Terms of use
 
 
    
     Home      Products      Services & solutions      Support & downloads      My account     
 
developerworks > My developerWorks >  Dashboard > HPC Central Wiki > ... > General Parallel File System (GPFS) > Using GPFS with SElinux in enforcing mode
developerWorks
Log In   View a printable version of the current page.
Overview Connect Spaces Forums Wikis
Using GPFS with SElinux in enforcing mode
Added by janfrode, last edited by ScottGPFS on Nov 20, 2008  (view change)
Labels: 
(None)

GPFS initscript

When running GPFS on SElinux you cannot allow the normal init scripts to start GPFS because that will cause the GPFS daemons to run in the SElinux domain "initrc_t" which is too restricted for GPFS. To get GPFS to run fully unconfined, use the runcon command to set the security context. Run the following in /etc/rc.d/rc.local:

runcon -t unconfined_t /usr/lpp/mmfs/bin/mmstartup

Then disable automatic startup of GPFS by running:

chkconfig gpfs off

File system labels

Secondly GPFS doesn't support the SElinux file labels, so you need to set a label on the file system at mount time. Any files in the GPFS file system will then have the same label. For example, to mount a GPFS file system with xen-images, disable normal GPFS automount of the file system by running:

mmchfs gpfsxen -A no

Then "manually" mount the file system with the correct fscontext by adding the following to /var/mmfs/etc/mmfsup.scr:

mount /dev/gpfsxen -t gpfs -o "fscontext=system_u:object_r:xen_image_t",rw,mtime,atime,dev=gpfsxen /var/lib/xen/images


 
    About IBM Privacy Contact