nfs_selinux(8)

📦 version 2.20260929, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ nfs_selinux — the NFS SELinux policy page, bestie edition ✨

okay so this is nfs_selinux(8), from the NFS SELinux Policy documentation, and it's literally the glow-up guide for how SELinux keeps your NFS server in line 💅

🎀 NAME 🎀

nfs_selinux — Security Enhanced Linux Policy for NFS

🌸 DESCRIPTION 🌸

Security Enhanced Linux secures the NFS server via flexible mandatory access control. that's the whole vibe: SELinux doesn't ask nicely, it just enforces, and your NFS server stays cute and contained 👑

🦋 BOOLEANS 🦋

SELinux policy is customizable based on the least level of access required. like, minimum effort, maximum security, we love a boundaries queen 🫶

SELinux can be configured to not allow NFS to share files. totally valid, sometimes the answer is "no sharing, we're closed" 🚫

If you want to share NFS partitions, and only allow read-only access to those NFS partitions, turn the nfs_export_all_ro boolean on:

setsebool -P nfs_export_all_ro 1

look at them, only allowed to look, not touch. respectful. 🌸

If you want to share files read/write you must set the nfs_export_all_rw boolean.

setsebool -P nfs_export_all_rw 1

full send, both directions, no cap 🔥

These booleans are not required when files to be shared are labeled with the public_content_t or public_content_rw_t types. NFS can share files labeled with the public_content_t or public_content_rw_t types even if the nfs_export_all_ro and nfs_export_all_rw booleans are off.

so basically if your files already have the right label on them, they're already main character energy and don't need the booleans to vouch for them 💖

If you want to use a remote NFS server for the home directories on this machine, you must set the use_nfs_home_dirs boolean:

setsebool -P use_nfs_home_dirs 1

home dirs living on a remote NFS server?? iconic, honestly, and yes you need this boolean for that 🏠✨

system-config-selinux is a GUI tool available to customize SELinux policy settings. for the girlies who prefer clicking over typing, we see you, we support you 🖱️💅

💜 AUTHOR 💜

This manual page was written by Dan Walsh <dwalsh@redhat.com>. king behavior, thank you for your service 👑

🌈 SEE ALSO 🌈

and that's the whole page, bestie!! 🎀 this one came from dwalsh@redhat.com, dated 9 Feb 2009, and it's the nfs_selinux(8) page — go forth and share your files responsibly, ily 🦋💖

📦 where this page comes from