By default, NFS mounts on the client side are labeled with a default context defined by policy for NFS volumes. In common policies, this default context uses the
nfs_t type. Depending on policy configuration, services, such as Apache HTTP Server and MySQL, may not be able to read files labeled with the
nfs_t type. This may prevent file systems labeled with this type from being mounted and then read or exported by other services.
If you would like to mount an NFS volume and read or export that file system with another service, use the
context option when mounting to override the
nfs_t type. Use the following context option to mount NFS volumes so that they can be shared via the Apache HTTP Server:
mount server:/export /local/mount/point -o context="system_u:object_r:httpd_sys_content_t:s0"
Since these changes are not written to disk, the context specified with this option does not persist between mounts. Therefore, this option must be used with the same context specified during every mount to retain the desired context. For information about making context mount persistent, refer to the Section 5.8.5, “Making Context Mounts Persistent”
As an alternative to mounting file systems with
options, Booleans can be enabled to allow services access to file systems labeled with the
type. Refer to Managing Confined Services
for instructions on configuring Booleans to allow services access to the