Re: Errors in building lsm-selinux-200111191100.tgz

Re: Errors in building lsm-selinux-200111191100.tgz

[Justin Smith]

On Mon, 2001-11-26 at 16:02, Stephen Smalley wrote:
> 
> On 26 Nov 2001, Justin Smith wrote:
> 
> > policydb.o: In function `user_destroy':
> > /usr/src/selinux/module/checkpolicy/../selinux_plug/ss/policydb.c:357:
> > undefined reference to `mls_user_destroy'
> 


I've done this and this part of the build works OK. Unfortunately, I now
get the message (upon booting)

kernel panic: policydb version (6) does not match my version (7).

I'm pretty sure I deleted all of the files from the previous install
of Selinux (maybe I left something in /usr/local/selinux).

Am I doing something dumb here?


--



--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Errors in building lsm-selinux-200111191100.tgz

[Stephen Smalley]

On 26 Nov 2001, Justin Smith wrote:

> kernel panic: policydb version (6) does not match my version (7).

Did you do a 'make install' in the policy directory after installing the
new checkpolicy program (via the 'make install' in the module directory)?
There was a minor change in the policydb format in this release, so you
need to recompile the policy configuration with the new version of the
checkpolicy policy compiler.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com





--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

lsm-selinux-200111191100.tgz

[Justin Smith]

When I did make install in module, it did not complete successfully
because the makefile expected a directory to be named

/usr/src/selinux/module/selinux_plug/include/asm

and it was really 

/usr/src/selinux/module/selinux_plug/include/asm-i386

When I moved asm-i386 to asm it worked and I was able to boot
selinux.

Having done so, I received the following messages:

avc:  denied  { mounton } for  pid=75 exe=/bin/mount path=/bus/usb
dev=00:03 ino=4459
   scontext=system_u:system_r:mount_t
   tcontext=system_u:object_r:proc_t
   tclass=dir

task_precondition:  assigning context system_u:system_r:init_t to pid 2
exe=none

usb-uhci.c: v1.268:USB Universal Host Controller Interface driver

avc:  denied  { search } for  pid=93 exe=/bin/cat dev=00:08 ino=1
   scontext=system_u:system_r:initrc_t
   tcontext=system_u:object_r:unlabeled_t
   tclass=dir

avc:  denied  { read } for  pid=93 exe=/bin/cat path=/devices dev=00:08
ino=2
   scontext=system_u:system_r:initrc_t
   tcontext=system_u:object_r:unlabeled_t
   tclass=file

avc:  denied  { getattr } for  pid=93 exe=/bin/cat path=/devices
dev=00:08 ino=2
   scontext=system_u:system_r:initrc_t
   tcontext=system_u:object_r:unlabeled_t
   tclass=file

avc:  denied  { write } for  pid=10 exe=/bin/bash path=/etc/mtab
dev=03:01 ino=28440
   scontext=system_u:system_r:initrc_t
   tcontext=system_u:object_r:file_t
   tclass=file


(many times)

.................

avc:  denied  { create } for  pid=296 exe=/sbin/ipchains
   scontext=system_u:system_r:initrc_t
   tcontext=system_u:system_r:initrc_t
   tclass=rawip_socket

avc:  denied  { setopt } for  pid=296 exe=/sbin/ipchains lport=255
   scontext=system_u:system_r:initrc_t
   tcontext=system_u:system_r:initrc_t
   tclass=rawip_socket


avc:  denied  { unlink } for  pid=752 exe=/bin/umount path=/etc/mtab
dev=03:01 ino=28440
   scontext=system_u:system_r:mount_t
   tcontext=system_u:object_r:file_t
   tclass=file

avc:  denied  { search } for  pid=838 exe=/usr/sbin/httpd
path=/www/tomcat dev=03:05 ino=336750
   scontext=system_u:system_r:httpd_t
   tcontext=system_u:object_r:httpd_user_script_rw_t
   tclass=dir


(plus many messages connected with running the Gnome desktop)

--



--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: lsm-selinux-200111191100.tgz

[Stephen Smalley]

On 27 Nov 2001, Justin Smith wrote:

> When I did make install in module, it did not complete successfully
> because the makefile expected a directory to be named
<snip>
> When I moved asm-i386 to asm it worked and I was able to boot
> selinux.

include/asm and arch/machine are created by the 'make dep' in the BUILDING
instructions.  They are symbolic links that are automatically set to refer
to the appropriate architecture.  Of course, at present, we only support
x86, but by using these symbolic links, we make it easier to add support
for other architectures in the future.  I'm not sure why your include/asm
link was not set by the time you did the 'make install' in the module
directory unless you did a 'make clean'.

> Having done so, I received the following messages:
>
> avc:  denied  { mounton } for  pid=75 exe=/bin/mount path=/bus/usb
> dev=00:03 ino=4459
>    scontext=system_u:system_r:mount_t
>    tcontext=system_u:object_r:proc_t
>    tclass=dir

Ok, so you are mounting another filesystem under /proc.  Add a 'allow
mount_t proc_t:dir mounton;' rule to policy/domains/system/mount.te.

> avc:  denied  { search } for  pid=93 exe=/bin/cat dev=00:08 ino=1
>    scontext=system_u:system_r:initrc_t
>    tcontext=system_u:object_r:unlabeled_t
>    tclass=dir
>
> avc:  denied  { read } for  pid=93 exe=/bin/cat path=/devices dev=00:08
> ino=2
>    scontext=system_u:system_r:initrc_t
>    tcontext=system_u:object_r:unlabeled_t
>    tclass=file
>
> avc:  denied  { getattr } for  pid=93 exe=/bin/cat path=/devices
> dev=00:08 ino=2
>    scontext=system_u:system_r:initrc_t
>    tcontext=system_u:object_r:unlabeled_t
>    tclass=file

This indicates that you are using a filesystem type that isn't recognized
by SELinux, so it is left unlabeled.  This is most likely some kind of
pseudo filesystem type, like usbdevfs.  The handling for each pseudo
filesystem type is specialized to provide reasonable security semantics
for that type.  At present, SELinux defines labeling behaviors for procfs,
devpts, tmpfs and devfs.  I haven't used usbdevfs or looked at its
implementation, so I don't know whether it should just use the same
labeling behavior as devfs or not.

> avc:  denied  { write } for  pid=10 exe=/bin/bash path=/etc/mtab
> dev=03:01 ino=28440
>    scontext=system_u:system_r:initrc_t
>    tcontext=system_u:object_r:file_t
>    tclass=file

This is typical on the first boot of the SELinux kernel.  Run setfiles
again, as recommended by step 15 of the README.

> avc:  denied  { create } for  pid=296 exe=/sbin/ipchains
>    scontext=system_u:system_r:initrc_t
>    tcontext=system_u:system_r:initrc_t
>    tclass=rawip_socket
>
> avc:  denied  { setopt } for  pid=296 exe=/sbin/ipchains lport=255
>    scontext=system_u:system_r:initrc_t
>    tcontext=system_u:system_r:initrc_t
>    tclass=rawip_socket

Ok, so you either need to grant these permissions to initrc_t if you
want to allow this to run, or you need to define a separate domain for
ipchains that can do this.

> avc:  denied  { search } for  pid=838 exe=/usr/sbin/httpd
> path=/www/tomcat dev=03:05 ino=336750
>    scontext=system_u:system_r:httpd_t
>    tcontext=system_u:object_r:httpd_user_script_rw_t
>    tclass=dir

I'm not sure why httpd_t doesn't have this permission.  You can certainly
add it.

> (plus many messages connected with running the Gnome desktop)

Did you follow the instructions in step 4 prior to trying to run
GNOME?

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.