Kernel panic when using refpolicy

Kernel panic when using refpolicy

[Kim Lawson-Jenkins]

Hi,

I'm running RHEL5.  I downloaded refpolicy-20070629.tar.bz2 and
selinux-refpolicy-sources-20070629-1.noarch.rpm and installed the files for
the reference policy.  When rebooting the system there was a fatal error -
Kernel panic - not syncing: Fatal exception.

There were many unknown Boolean errors for libsepol.load.booleans and there
was the following error - 
libsepol.sepol_genbools: error while reading /etc/selinux/refpolicy/Booleans

It looks like ifconfig was running when the kernel panic occurred.  To
recover booted into single-user mode and changed the SELINUXTYPE in the file
/etc/selinux/config from refpolicy to targeted.  I can easily repeat the
problem by using the SELinux Management Tool to change the System Default
Policy Type from targeted to refpolicy and rebooting.  I've looked at all of
the documentation to see if I missed a step or downloaded an incorrect file
but I can't find anything.  Can anyone give me some insight into what the
problem may be?  Thanks in advance for a response.

Kim


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Kernel panic when using refpolicy

[Christopher J. PeBenito]

On Fri, 2007-09-07 at 13:14 -0500, Kim Lawson-Jenkins wrote:
> I'm running RHEL5.  I downloaded refpolicy-20070629.tar.bz2 and
> selinux-refpolicy-sources-20070629-1.noarch.rpm and installed the files for
> the reference policy.  When rebooting the system there was a fatal error -
> Kernel panic - not syncing: Fatal exception.
> 
> There were many unknown Boolean errors for libsepol.load.booleans and there
> was the following error - 
> libsepol.sepol_genbools: error while reading /etc/selinux/refpolicy/Booleans
> 
> It looks like ifconfig was running when the kernel panic occurred.  To
> recover booted into single-user mode and changed the SELINUXTYPE in the file
> /etc/selinux/config from refpolicy to targeted.  I can easily repeat the
> problem by using the SELinux Management Tool to change the System Default
> Policy Type from targeted to refpolicy and rebooting.  I've looked at all of
> the documentation to see if I missed a step or downloaded an incorrect file
> but I can't find anything.  Can anyone give me some insight into what the
> problem may be?  Thanks in advance for a response.

You set TYPE=targeted, not TYPE=targeted-mcs, right?  If so, I suspect
that you've hit the kernel bug in RHEL5 that happens when the SELinux
MLS support is disabled.  Loading a MCS policy turns on the MLS support.
In fact the RHEL5 targeted policy is targeted-mcs, in refpolicy terms.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Kernel panic when using refpolicy

[Kim Lawson-Jenkins]

Chris (and Eric & Brian),

I was running in permissive mode and yes, I did have TYPE=targeted, not
TYPE=targeted-mcs.  I'll make the change.  Thanks everyone for the
responses.

Kim

-----Original Message-----
From: Christopher J. PeBenito [mailto:cpebenito@tresys.com] 
Sent: Friday, September 07, 2007 12:44 PM
To: Kim Lawson-Jenkins
Cc: selinux@tycho.nsa.gov
Subject: Re: Kernel panic when using refpolicy

On Fri, 2007-09-07 at 13:14 -0500, Kim Lawson-Jenkins wrote:
> I'm running RHEL5.  I downloaded refpolicy-20070629.tar.bz2 and
> selinux-refpolicy-sources-20070629-1.noarch.rpm and installed the files
for
> the reference policy.  When rebooting the system there was a fatal error -
> Kernel panic - not syncing: Fatal exception.
> 
> There were many unknown Boolean errors for libsepol.load.booleans and
there
> was the following error - 
> libsepol.sepol_genbools: error while reading
/etc/selinux/refpolicy/Booleans
> 
> It looks like ifconfig was running when the kernel panic occurred.  To
> recover booted into single-user mode and changed the SELINUXTYPE in the
file
> /etc/selinux/config from refpolicy to targeted.  I can easily repeat the
> problem by using the SELinux Management Tool to change the System Default
> Policy Type from targeted to refpolicy and rebooting.  I've looked at all
of
> the documentation to see if I missed a step or downloaded an incorrect
file
> but I can't find anything.  Can anyone give me some insight into what the
> problem may be?  Thanks in advance for a response.

You set TYPE=targeted, not TYPE=targeted-mcs, right?  If so, I suspect
that you've hit the kernel bug in RHEL5 that happens when the SELinux
MLS support is disabled.  Loading a MCS policy turns on the MLS support.
In fact the RHEL5 targeted policy is targeted-mcs, in refpolicy terms.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Kernel panic when using refpolicy

[Eric Paris]

going to want more of the panic information.  Whole boot output would
be great.  That's just the generic death message.  My first guess is
that you are enforcing, but that it can't actually find the binary
policy to install at boot time.

Before the panic did you get a message about 'enforcing and can't find
policy?'   Sounds like the most likely cause.  Do have a policy.21 in
/etc/selinux/refpolicy/policy/policy.21

-Eric

On 9/7/07, Kim Lawson-Jenkins <lawson@itd.nrl.navy.mil> wrote:
>
> Hi,
>
> I'm running RHEL5.  I downloaded refpolicy-20070629.tar.bz2 and
> selinux-refpolicy-sources-20070629-1.noarch.rpm and installed the files for
> the reference policy.  When rebooting the system there was a fatal error -
> Kernel panic - not syncing: Fatal exception.
>
> There were many unknown Boolean errors for libsepol.load.booleans and there
> was the following error -
> libsepol.sepol_genbools: error while reading /etc/selinux/refpolicy/Booleans
>
> It looks like ifconfig was running when the kernel panic occurred.  To
> recover booted into single-user mode and changed the SELINUXTYPE in the file
> /etc/selinux/config from refpolicy to targeted.  I can easily repeat the
> problem by using the SELinux Management Tool to change the System Default
> Policy Type from targeted to refpolicy and rebooting.  I've looked at all of
> the documentation to see if I missed a step or downloaded an incorrect file
> but I can't find anything.  Can anyone give me some insight into what the
> problem may be?  Thanks in advance for a response.
>
> Kim
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Kernel panic when using refpolicy

[Brian M. Williams]

Please check which type of policy that you compiled in the build.conf, in RHEL5 if you build a non-mls non-mcs policy the system will not boot.  There is a bug in the RHEL5 kernel that will not be fixed until RHEL5 U1.

> -----Original Message-----
> From: owner-selinux@tycho.nsa.gov 
> [mailto:owner-selinux@tycho.nsa.gov] On Behalf Of Kim Lawson-Jenkins
> Sent: Friday, September 07, 2007 14:15
> To: selinux@tycho.nsa.gov
> Subject: Kernel panic when using refpolicy
> 
> 
> Hi,
> 
> I'm running RHEL5.  I downloaded refpolicy-20070629.tar.bz2 and
> selinux-refpolicy-sources-20070629-1.noarch.rpm and installed 
> the files for
> the reference policy.  When rebooting the system there was a 
> fatal error -
> Kernel panic - not syncing: Fatal exception.
> 
> There were many unknown Boolean errors for 
> libsepol.load.booleans and there
> was the following error - 
> libsepol.sepol_genbools: error while reading 
> /etc/selinux/refpolicy/Booleans
> 
> It looks like ifconfig was running when the kernel panic occurred.  To
> recover booted into single-user mode and changed the 
> SELINUXTYPE in the file
> /etc/selinux/config from refpolicy to targeted.  I can easily 
> repeat the
> problem by using the SELinux Management Tool to change the 
> System Default
> Policy Type from targeted to refpolicy and rebooting.  I've 
> looked at all of
> the documentation to see if I missed a step or downloaded an 
> incorrect file
> but I can't find anything.  Can anyone give me some insight 
> into what the
> problem may be?  Thanks in advance for a response.
> 
> Kim
> 
> 
> --
> This message was distributed to subscribers of the selinux 
> mailing list.
> If you no longer wish to subscribe, send mail to 
> majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
> 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Kernel panic when using refpolicy

[Jeremiah Jahn]

[-- Attachment #1: Type: text/plain, Size: 475 bytes --]

sorry, to bring this up again, but FYI, it doesn't look like the kernel
bug got fixed in RHEL5U1. I took the most recent refpolicy and left the
type set to standard; make load; touch /.autorelabel;reboot; all hell
broke loose. however, if I set the type=mcs then do the above everything
is fine. I had to pull the harddrive, and edit the policy config to get
the system back up. 

-jj-




You have the capacity to learn from mistakes. You'll learn a lot today.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Kernel panic when using refpolicy

[Eric Paris]

Fix won't appear until 5.2 see:

https://bugzilla.redhat.com/show_bug.cgi?id=223827

I apologize to everyone who is still hitting this problem, I screwed
up on some administrative stuff and didn't get it into 5.1.  You
should be able to find links to 5.2 test kernels to verify it is fixed
in that BZ.

(as a side note RHEL specific questions like this are probably better
suited for fedora-selinux-list or RH bugzilla, but I read them all so
it doesn't really matter)

-Eric

On 12/29/07, Jeremiah Jahn <jeremiah@goodinassociates.com> wrote:
> sorry, to bring this up again, but FYI, it doesn't look like the kernel
> bug got fixed in RHEL5U1. I took the most recent refpolicy and left the
> type set to standard; make load; touch /.autorelabel;reboot; all hell
> broke loose. however, if I set the type=mcs then do the above everything
> is fine. I had to pull the harddrive, and edit the policy config to get
> the system back up.
>
> -jj-
>
>
>
>
> You have the capacity to learn from mistakes. You'll learn a lot today.
>
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.