selinux March 2005

selinux@lists.fedoraproject.org

64 participants
70 discussions

mv hard drives with lvm/selinux ?
by Justin Conover 12 Apr '05

12 Apr '05

Just wondering if i'm going to move 2x160GB sata drives in raid 1 that are on there own volume with SELinux turned on. Can I simply move these to another box and be able to read them or does this become really tricky? Worst comes to worst I can mv the 80GB of data to another box, mv the harddrives and then mv the data back just wondering if it could be as easy to do it the other way.

3 5

Policies for bastille?
by R. Jensen 08 Apr '05

08 Apr '05

I recently downloaded Bastille and was unable to get the PSAD portion to install. [Bastille is trying to install /usr/sbin/psad (among others)]. [root@lankhmar log]# ls -ldZ /usr/sbin drwxr-xr-x root root system_u:object_r:sbin_t So I would *expect* an SELinux error if the psad isn't of sbin_t. [But I don't see any avc messages in the log.] Here's a portion of Bastille's error log: {Fri Mar 4 11:15:28 2005} Failed to place /psad as /usr/sbin/psad {Fri Mar 4 11:15:28 2005} #ERROR: chmod: File /usr/sbin/psad doesn't exist! {Fri Mar 4 11:15:28 2005} Failed to place /psadwatchd as /usr/sbin/psadwatchd {Fri Mar 4 11:15:28 2005} #ERROR: chmod: File /usr/sbin/psadwatchd doesn't exist! {Fri Mar 4 11:15:28 2005} Failed to place /kmsgsd as /usr/sbin/kmsgsd {Fri Mar 4 11:15:28 2005} #ERROR: chmod: File /usr/sbin/kmsgsd doesn't exist! Does this look like an SELinux issue or just Bastille? Richard.

5 7

New policy for razor
by David Hampton 05 Apr '05

05 Apr '05

This is a new strict policy for the razor spam filter. It is based on the selinux-policy-strict-sources-1.23.2-1 fedora RPM. This policy requires the definition of a razor reserved port that was in the net_contexts diff I sent last Wednesday. Please let me know if there are any problems with or changes needed to this policy. David

2 1

Additions to net_contexts
by David Hampton 05 Apr '05

05 Apr '05

Here are some additions to net_contexts to define additional privileged ports. I'll be submitting policies that reference these ports over the next week or so as I get them cleaned up. This is based on the file from the selinux-policy-strict-sources-1.22.1-2 rpm on my FC3 system. David

2 1

nscd with selinux with ssl
by Farkas Levente 04 Apr '05

04 Apr '05

hi, i try to use nscd with ldap and tls. in this case you should define a cacert, cert and key file for nss. but afaik there is no default palce to put these file and there is no default policy to allow nscd to read any kind of pem file(s). it'd be useful to define a standard place for these cert files and allow nscd to read these files. yours. -- Levente "Si vis pacem para bellum!"

2 10

Problems with firmware loader and selinux
by Dmitry Torokhov 01 Apr '05

01 Apr '05

Ahem, with the proper subject this time around... Hi, Apologies if this is not the proper mailing list... I have a FC3 with day-before-yesterday pull from Linus and selinux-policy-targeted installed from rawhide. Everything seems to be working fine ecxept for my wireless card (prism54), which can't get it's firmware loaded. It looks like selinux policy prevents firmware loader to create "firmware" class device. I get avc denied search message for process /sbin/ip (which is ifconfig_t) and tcontext is sysfs_t. It looks like the rights are inherited from "ip" markings whereas I would say that firmware loader is should operate in completely different context. Anyone have any pointers? Thank you in advance, Dmitry P.S. I would appreciate if you CC me as I am not subscribed to the list.

2 4

Re: upgrade from redhat9
by Steve G 31 Mar '05

31 Mar '05

>Is there any simple way of upgrading to Fedora from redhat 9. >I already have redhat9 installed on my m/c I did this recently (RH9->FC3). It almost worked. I can say a few things that will help you. First, make sure your machine boots to init 3 first. When you do the upgrade, tell it to let you pick the packages. Make sure policycoreutils and targeted policy are selected. On a normal upgrade they weren't picked up by dependencies. Look around for the other SE Linux tools and make sure they are selected. Also make sure yum is selected. The first time it boots, it should try to relabel the filesystem. If not, you'll need to boot to single user mode and touch /.autorelabel. Then there's gnome...It didn't pick up everything that it needed. I had to manually install several packages and configure the panels by hand. I still don't have the same icons for web browser that a clean install does. Maybe upgrading to FC4 will resync the missing pieces for me. In short it was an adventure. But you can get it almost working. -Steve Grubb __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Odd boolean in /etc/selinux/strict/booleans?
by Valdis.Kletnieks＠vt.edu 31 Mar '05

31 Mar '05

selinux-policy-strict-1.23.5-2 off Fedora devel tree today... [/etc/selinux]3 grep -ri disable_games . Binary file ./strict/policy/policy.19 matches Binary file ./strict/policy/policy.18 matches ./strict/src/policy/domains/program/games.te:bool disable_games_trans false; ./strict/src/policy/macros/program/games_domain.te:if (! disable_games_trans) { ./strict/src/policy/policy.conf:if (! disable_games_trans) { ./strict/src/policy/policy.conf:if (! disable_games_trans) { ./strict/src/policy/policy.conf:if (! disable_games_trans) { ./strict/src/policy/policy.conf:bool disable_games_trans false; Binary file ./strict/src/policy/policy.19 matches ./strict/booleans:disable_games=0 How come it's disable_games in strict/booleans, but disable_games_trans in the policy?

3 11

senlinux configuration, are you sure it's the right way?
by Farkas Levente 31 Mar '05

31 Mar '05

hi, after i having played a few days with selinux, apache and other daemons and programs the whole selinux configuration seems to me a bit confusing. if i found any kind of problem with the "default" selinux setup which is not big thing since most systems are different and there are a lots of program which are not included in the core distro. i have to report it and the next update will include it. my question why selinux include the default policies? why selinux-policy-* contains the right acces rights for all included deamons, programs? wouldn't it be much better to all package include it's own policy and in the rpm postinstall session reload/add/modify the new policies. this is something similar to the libs. i only install only those lib which needed for me and at the postinstall session run an ldconfig. i wouldn't like to install all libs! why should i install policies for eg. apache when i don't run apache? why should i update selinux-policy-* just because there was a bug in the apache part of the policy when i don't run apache? the current case is something one big monolitic policy configuration which most of the time not suitable for anyone (anyone who run anything else then the default need to modify it or run any webscript or). of course my main problem not with apache policies rather then the whole system and way of configuration of selinux. wouldn't be any easier and modularized way to use selinux and configure it for the needed thing. probably there is need for some core policy but all others policy can be modularized. or do i missed something? just my 2c. yours. -- Levente "Si vis pacem para bellum!"

3 7

upgrade from redhat9
by Hariharan, Vadivelu (IE10) 31 Mar '05

31 Mar '05

Hi , Is there any simple way of upgrading to Fedora from redhat 9. I already have redhat9 installed on my m/c ------------------ Hari Haran 9886484326 26588360 ext: 3134 ------------------

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux March 2005