selinux April 2007

selinux@lists.fedoraproject.org

28 participants
32 discussions

Re: autoreconf fails in setools of revision 4290
by NZzi 18 Apr '07

18 Apr '07

J. Tang wrote: > On Wed, 2007-04-18 at 10:06 +0800, Ken YANG wrote: >> the build tools i use are: >> >> automake-1.10-5 >> autoconf-2.61-8.fc7 >> make-3.81-6.fc7 > > Hello Ken. > > I was able to reproduce your issue on a Rawhide system. The reason is > due to automake. Fedora Core 6 (which is what SETools was tested upon) > ships with automake 1.9; Rawhide has automake 1.10. This newer version > of automake now considers GNU make extensions to be fatal errors, > whereas previous versions of automake ignored them. > > Quick Answer: From SVN checkout, do this as the first step: > > $ autoreconf -Wno-portability -i > >> as i mentioned before, the 3.1 tags in svn also failed with this error >> but the 3.1 version of fc7 can be built without any errors: > > This is because the source RPM contains the distributed, post-automake > files. That is, it has the result of a 'make dist'. thanks very much for your guiding. > >> apol had "segmentation fault" errors in analyzing "all base" policy, >> i.e. all modules in "module.conf" are changed into "base" > > There is a critical error in libsepol-2.0.2 that prevents SETools from > opening source policies. Unfortunately, recompiling SETools against > libsepol-2.0.3 is not sufficient; it also requires a fix that is only in > the development branch of SETools. > >> "setools(a)tresys.com" is the mailing list of setools? if yes, i will send > > Yes. if i have some setools problems(maybe bugs) in future, where can i send? i can not find "subscribe" of setools mailing list, but i find the "Active Tickets" in setools wiki. actually, i don't know what this mean. i find there are bug and feature. if the setools mailing list is private, i will send problem/bug to the fedora-selinux mailing list in future, ok? >

1 0

ANN: SELinux Policy IDE (SLIDE) version 1.1
by David Sugar 18 Apr '07

18 Apr '07

Version 1.1 of the SELinux Policy IDE (SLIDE) from Tresys is now available for download from the Tresys Open Source website at http://oss.tresys.com. SLIDE is an Eclipse plug-in that integrates with the SELinux Reference Policy to provide a development environment for building SELinux policy. SLIDE features: * A graphical user interface for policy development, including policy syntax highlighting, context suggestions, and integrated compilation. * Integration with SELinux Reference Policy, including quick lookup and documentation for interfaces. * Wizards and easy to use templates to automate common tasks from creating a new SELinux policy to adding an interface into an existing module. * Integrated remote policy installation and audit log monitoring, to facilitate policy testing. * Seamless integration with the power of standard Eclipse. Version 1.1 highlights: * Disabled interfaces indicated in module editor. * Improved documentation on the open source web site. * Updates to SLIDERemote to work with SETools version 3.1. * Support for new fields in build.conf editor. * Fixed problems with the Console output. If you would like to contribute, currently the best help would be to test and provide feedback on the SLIDE plugin and SLIDE Remote.

1 0

rawhide update errors
by Richard Hally 18 Apr '07

18 Apr '07

from todays yum update from rawhide: Updating : selinux-policy-strict ##################### [ 29/121] Updating : selinux-policy-mls ##################### [ 30/121] Updating : selinux-policy-targeted ##################### [ 31/121] /sbin/fixfiles: line 62: 17611 Done sed -r -e 's,:s0, ,g' $FC 17612 | sort -u 17613 Done(1) | /usr/bin/diff -b ${PREFCTEMPFILE} - 17614 | grep '^[<>]' 17615 | cut -c3- 17616 | grep ^/ 17617 | egrep -v '(^/home|^/root|^/tmp|^/dev)' 17618 | sed -r -e 's,[[:blank:]].*,,g' -e 's|$([/[:alnum:]]+)$\?|{\1,}|g' -e 's|([/[:alnum:]])\?|{\1,}|g' -e 's|\?.*|*|g' -e 's|$.*|*|g' -e 's|\[.*|*|g' -e 's|\.\*.*|*|g' -e 's|\.\+.*|*|g' 17619 | sort -u 17620 | sort -d 17621 | while read pattern; do if ! echo "$pattern" | grep -q -f ${TEMPFILE} 2> /dev/null; then echo "$pattern"; case "$pattern" in *"*") echo "$pattern" | sed 's,\*$,,g' >> ${TEMPFILE} ;; esac; fi; done 17622 Done(1) | while read pattern; do find $pattern ! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o -fstype xfs $ -prune -o $ -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev $ -prune -o -print; done 2> /dev/null 17623 Segmentation fault | ${RESTORECON} $2 -v -f - Updating : selinux-policy-devel ##################### [ 32/121] Updating : policycoreutils-gui ##################### [ 33/121] Updating : libsepol-devel ##################### [ 34/121] Richard

1 0

Re: autoreconf fails in setools of revision 4290
by NZzi 17 Apr '07

17 Apr '07

Jeremy A. Mowery wrote: > On Tuesday 17 April 2007 04:46, you wrote: >> hi all, >> >> i use autoconf-2.61-8.fc7 in fc7 rawhide >> >> autoreconf of this version fails in building setools of >> revision 4290. >> >> i also test setools 3.1 tags, it fails with the same errors: >> >> ...... >> sediff/Makefile.am:45: notdir $@: non-POSIX variable name >> sediff/Makefile.am:45: (probably a GNU make extension) >> sediff/Makefile.am:48: notdir $@: non-POSIX variable name >> sediff/Makefile.am:48: (probably a GNU make extension) >> sediff/Makefile.am:51: notdir $@: non-POSIX variable name >> sediff/Makefile.am:51: (probably a GNU make extension) >> autoreconf: automake failed with exit status: 1 >> > We were unable to reproduce this error. > We are currently building with: > autoconf (GNU Autoconf) 2.59 > automake (GNU automake) 1.9.6 > GNU Make 3.80 > > Could you send further information about the build tools you are using? the build tools i use are: automake-1.10-5 autoconf-2.61-8.fc7 make-3.81-6.fc7 as i mentioned before, the 3.1 tags in svn also failed with this error but the 3.1 version of fc7 can be built without any errors: setools-3.1-3.fc7.src.rpm by the way, when i use the setools in fc7 rawhide: setools-3.1-4.fc7.src.rpm apol had "segmentation fault" errors in analyzing "all base" policy, i.e. all modules in "module.conf" are changed into "base" the same errors occured in setools-3.1-3.fc7.src.rpm. but apol from setools-3.1-3.src.rpm can analyze the same base.pp without any errors. i forget where i got this srpm, maybe from tresys website, but i am sure that it is not from fc repos. finally, it seems that this problem is not belong to selinux list, so i CC to fedora-selinux list. "setools(a)tresys.com" is the mailing list of setools? if yes, i will send similar problems to this list. > > - Jeremy A. Mowery >> thanks in advance >> >> Ken YANG >

1 0

Targeted policy does not allow lvm output redirection ?
by Davide Bolcioni 16 Apr '07

16 Apr '07

Greetings, I tried the following: lvm vgs -o vg_name,vg_extent_size --units=k | cat > /tmp/vgs2 lvm vgs -o vg_name,vg_extent_size --units=k > /tmp/vgs1 and obtained -rw-r--r-- 1 root root 0 Apr 15 11:49 /tmp/vgs1 -rw-r--r-- 1 root root 28 Apr 15 11:49 /tmp/vgs2 but as you can see in the attached /var/log/audit.d/audit.log fragment, writing from an executable running in the lvm_t context to an object labeled with the tmp_t context is not allowed by the targeted policy. My setup: libselinux-1.33.4-2.fc6 selinux-policy-targeted-2.4.6-49.fc6 selinux-policy-2.4.6-49.fc6 Should I open a Bugzilla for this ? Thank you for your consideration, Davide Bolcioni -- There is no place like /home.

2 1

setrans.conf
by Ivan Makale 16 Apr '07

16 Apr '07

I'm studying SELinux and I'd like to find a clear explanation of the syntax used in the setrans.conf file. Have anybody a web resource to suggest? So to give an example, s0-s0:c0.c1023=SystemLow-SystemHigh s0:c0.c1023=SystemHigh Is '-' indicating a range between sensitivity levels and the ''.' a range between categories? What's the difference between "s0" only and "s0-s0"? And so on... Thank you, Ivan Makale

2 1

X server won't start using MLS policy
by Elihu Smails 11 Apr '07

11 Apr '07

I have followed the instructions at http://fedoraproject.org/wiki/SELinux/FedoraMLSHowto on how to install the MLS policy. I have it working under Fedora Core 6, but when I boot to runlevel 5, I get an error saying that the X server cannot be started. Does anyone know how to fix this problem? Thanks -- ..Cheers Mark

2 1

Latest selinux update & ping
by Jouni Viikari 11 Apr '07

11 Apr '07

Hi, After the latest selinux updates I get a lot of these messages at my log: SELinux is preventing /bin/ping (ping_t) "search" to locale (locale_t) or audit log: denied { search } for pid=16255 comm="ping" name="locale" dev=dm-0 ino=3113039 scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:locale_t:s0 tclass=dir type=SYSCALL msg=audit(1176300990.257:65255): arch=40000003 syscall=5 success=no exit=-13 a0=bf91d6e0 a1=0 a2=1b6 a3=8816018 items=0 ppid=18973 pid=18974 auid=4294967295 uid=507 gid=507 euid=0 suid =0 fsuid=0 egid=507 sgid=507 fsgid=507 tty=(none) comm="ping" exe="/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null) type=AVC msg=audit(1176300990.257:65256): avc: denied { search } for pid=18974 comm="ping" name="locale" dev=dm-0 ino=3113039 scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:loca le_t:s0 tclass=dir The last line repeats itself many times. The pings are run by Big Brother which as a one task pings my network to see all is up. Is this a local problem here, selinux problem or ping problem? -Jouni

2 1

Many to one translations in setrans.conf
by Joe Nall 11 Apr '07

11 Apr '07

We have been using /etc/selinux/mls/setrans.conf files that use multiple equivalent translations to support common aliases. For example: s2:c1.c225,c227.c253=CONFIDENTIAL//REL FU s2:c1.c225,c227.c253=C O N F I D E N T I A L REL FU s2:c1.c225,c227.c253=C O N F I D E N T I A L RELEASABLE TO FU s2:c1.c225,c227.c253=CONFIDENTIAL//REL BAR s2:c1.c225,c227.c253=C O N F I D E N T I A L REL BAR s2:c1.c225,c227.c253=C O N F I D E N T I A L RELEASABLE TO BAR This has the effect of mapping all of these labels to a common context. This context maps back to the first translation (CONFIDENTIAL//REL FU). 'semanage translation -a -T ...' has different behavior. When a translation is added, it rewrites the file using the last (C O N F I D E N T I A L RELEASABLE TO BAR) translation and deletes the other translations. It also moves all of the comments to the top, moving them away from the translation they are documenting. Should we be using this many to one behavior to support aliases? Is it broken in other ways that we have not discovered yet? joe

2 1

Re: denied avcs Rawhide how to troubleshoot
by Antonio Olivares 10 Apr '07

10 Apr '07

----- Original Message ---- From: Daniel J Walsh <dwalsh(a)redhat.com> To: Antonio Olivares <olivares14031(a)yahoo.com> Cc: fedora-selinux-list(a)redhat.com Sent: Tuesday, April 10, 2007 12:46:29 PM Subject: Re: denied avcs Rawhide how to troubleshoot Antonio Olivares wrote: Dear list, > I am running rawhide and I get these denied avcs > > [olivares@localhost ~]$ cat /etc/fedora-release > Fedora release 6.92 (Rawhide) > [olivares@localhost ~]$ > > There is a tool semanage, but I do not know how to use it. Is there any reference to this new tool. > How do I fix this using chcon -? or other tools to troubleshoot this. > > audit(1176209974.281:4): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1440" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:5): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1680" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:6): avc: denied { create } for pid=991 comm="cIreate_floppy_d" name="fd0u1722" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:7): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1743" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:8): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1760" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:9): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1920" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:10): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1840" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:11): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1600" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:12): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u360" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:13): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u720" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:14): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u820" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:15): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u830" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:16): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1040" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:17): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1120" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > audit(1176209974.281:18): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u800" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file > > > > > Thanks, > > Antonio > > > > > > ____________________________________________________________________________________ > Don't pick lemons. > See all the new 2007 cars at Yahoo! Autos. > http://autos.yahoo.com/new_cars.html > > -- > fedora-selinux-list mailing list > fedora-selinux-list(a)redhat.com > https://www.redhat.com/mailman/listinfo/fedora-selinux-list > Please submit this as a udev bug. Done! https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235953 Regards, Antonio ____________________________________________________________________________________ Don't pick lemons. See all the new 2007 cars at Yahoo! Autos. http://autos.yahoo.com/new_cars.html

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux April 2007