CentOS and SELinux refpolicy trouble

CentOS and SELinux refpolicy trouble

[Filip Bartmann]

I try use SELinux refpolicy from oss.tresys.com with CentOS 4.4.
Refpolicy I configure as targeted, and name ref-targeted. If I load the
policy into running system, then all is OK, but if I try to boot system
with this policy, then I have after "Switching to new root" first
error's, about some Unkown's booleans, then about "Error while
reading /etc/selinux/ref-targeted/booleans: Invalid argument"
Then system hangs up with killing init and : "Kernel panic - not
syncing. Out of memory and no killablable processes ..."
What I have wrong?
Filip Bartmann


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: CentOS and SELinux refpolicy trouble

[Stephen Smalley]

On Wed, 2006-11-29 at 17:57 +0100, Filip Bartmann wrote:
> I try use SELinux refpolicy from oss.tresys.com with CentOS 4.4.
> Refpolicy I configure as targeted, and name ref-targeted. If I load the
> policy into running system, then all is OK, but if I try to boot system
> with this policy, then I have after "Switching to new root" first
> error's, about some Unkown's booleans, then about "Error while
> reading /etc/selinux/ref-targeted/booleans: Invalid argument"
> Then system hangs up with killing init and : "Kernel panic - not
> syncing. Out of memory and no killablable processes ..."
> What I have wrong?

Please identify the precise version numbers of any SELinux-related
components that you updated (refpolicy, checkpolicy, anything else like
policycoreutils).

Aside from setting the TYPE and NAME in build.conf, you also need to set
(or override on the make commandline) several other definitions for a
CentOS 4 system, e.g.:
OUTPUT_POLICY = 18
DISTRO = rhel4
DIRECT_INITRC=y

Not sure about the booleans errors - what did that booleans file
contain?

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: CentOS and SELinux refpolicy trouble

[Filip Bartmann]

Stephen Smalley píše v St 29. 11. 2006 v 12:09 -0500:
> Please identify the precise version numbers of any SELinux-related
> components that you updated (refpolicy, checkpolicy, anything else like
> policycoreutils).
I have installed 

refpolicy-20061018, 
checkpolicy.i386-			 1.32-1(from tresys), 
policycoreutils.i386			 1.18.1-4.9, 
libselinux				 1.19.1-7.2, 
libsepol.i386                            1.1.1-2
setools.i386                             1.5.1-5 

> Aside from setting the TYPE and NAME in build.conf, you also need to set
> (or override on the make commandline) several other definitions for a
> CentOS 4 system, e.g.:
> OUTPUT_POLICY = 18
> DISTRO = rhel4
> DIRECT_INITRC=y
Yes, I have this setting in this file:
OUTPUT_POLICY = 18
TYPE = targeted
NAME = reftargeted
DISTRO = rhel4
DIRECT_INITRC=y
MONOLITHIC=y
POLY=n
MLS_SENS=16
MLS_CATS=256
MCS_CATS=256
QUIET=n

> Not sure about the booleans errors - what did that booleans file
> contain?
The booleans file contain default this values(it's almost defaults from
tresys refpolicy):
allow_cvs_read_shadow = 0
allow_daemons_use_tty = 0
allow_execheap = 0
allow_execmem = 0
allow_execmod = 0
allow_execstack = 0
allow_ftpd_anon_write = 0
allow_ftpd_use_cifs = 0
allow_ftpd_use_nfs = 0
allow_gpg_execstack = 0
allow_gssd_read_tmp = 1
allow_httpd_mod_auth_pam = 0
allow_java_execstack = 0
allow_kerberos = 0
allow_mount_anyfile = 0
allow_mplayer_execstack = 0
allow_nfsd_anon_write = 0
allow_ptrace = 0
allow_rsync_anon_write = 0
allow_saslauthd_read_shadow = 0
allow_smbd_anon_write = 0
allow_ssh_keysign = 0
allow_user_mysql_connect = 0
allow_write_xshm = 0
allow_ypbind = 0
allow_zebra_write_config = 0
cdrecord_read_content = 0
cron_can_relabel = 0
disable_evolution_trans = 0
disable_games_trans = 0
disable_mozilla_trans = 0
disable_thunderbird_trans = 0
fcron_crond = 0
ftp_home_dir = 0
ftpd_is_daemon = 0
global_ssp = 0
httpd_builtin_scripting = 0
httpd_can_network_connect = 0
httpd_can_network_connect_db = 0
httpd_can_network_relay = 0
httpd_enable_cgi = 0
httpd_enable_ftp_server = 0
httpd_enable_homedirs = 0
httpd_ssi_exec = 0
httpd_tty_comm = 0
httpd_unified = 0
mail_read_content = 0
mozilla_read_content = 0
named_write_master_zones = 0
nfs_export_all_ro = 0
nfs_export_all_rw = 0
pppd_can_insmod = 0
pppd_for_user = 0
read_default_t = 0
read_untrusted_content = 0
run_ssh_inetd = 0
samba_enable_home_dirs = 0
samba_share_nfs = 0
secure_mode = 0
secure_mode_insmod = 0
secure_mode_policyload = 0
spamassassin_can_network = 0
spamd_enable_home_dirs = 1
squid_connect_any = 0
ssh_sysadm_login = 0
staff_read_sysadm_file = 0
stunnel_is_daemon = 0
use_nfs_home_dirs = 0
use_samba_home_dirs = 0
user_direct_mouse = 0
user_dmesg = 0
user_net_control = 0
user_ping = 0
user_rw_noexattrfile = 0
user_tcp_server = 0
user_ttyfile_stat = 0
write_untrusted_content = 0
xdm_sysadm_login = 0

Filip Bartmann


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: CentOS and SELinux refpolicy trouble

[Stephen Smalley]

On Wed, 2006-11-29 at 19:32 +0100, Filip Bartmann wrote:
> Stephen Smalley píše v St 29. 11. 2006 v 12:09 -0500:
> > Please identify the precise version numbers of any SELinux-related
> > components that you updated (refpolicy, checkpolicy, anything else like
> > policycoreutils).
> I have installed 
> 
> refpolicy-20061018, 
> checkpolicy.i386-			 1.32-1(from tresys), 
> policycoreutils.i386			 1.18.1-4.9, 
> libselinux				 1.19.1-7.2, 
> libsepol.i386                            1.1.1-2
> setools.i386                             1.5.1-5

Looks fine.

> > Aside from setting the TYPE and NAME in build.conf, you also need to set
> > (or override on the make commandline) several other definitions for a
> > CentOS 4 system, e.g.:
> > OUTPUT_POLICY = 18
> > DISTRO = rhel4
> > DIRECT_INITRC=y
> Yes, I have this setting in this file:
> OUTPUT_POLICY = 18
> TYPE = targeted
> NAME = reftargeted
> DISTRO = rhel4
> DIRECT_INITRC=y
> MONOLITHIC=y
> POLY=n
> MLS_SENS=16
> MLS_CATS=256
> MCS_CATS=256
> QUIET=n

Looks fine.
(aside:  looks like one also has to run make install with
SETFILES=/usr/sbin/setfiles on RHEL 4 and derivatives)

> > Not sure about the booleans errors - what did that booleans file
> > contain?
> The booleans file contain default this values(it's almost defaults from
> tresys refpolicy):

Hmm...looks like it is generating boolean entries for booleans that are
only defined in strict policy even though you are building targeted.  I
also reproduced this issue on a RHEL 4 system, so it isn't just you.
However, these should yield non-fatal warnings, not a fatal error. 

Reproducing on a RHEL 4 system, I see the following output:
unknown boolean allow_gpg_execstack
unknown boolean allow_mplayer_execstack
unknown boolean allow_ptrace
unknown boolean allow_ssh_keysign
unknown boolean allow_user_mysql_connect
unknown boolean allow_write_xshm
unknown boolean cdrecord_read_content
unknown boolean cron_can_relabel
unknown boolean disable_evolution_trans
unknown boolean disable_games_trans
unknown boolean disable_mozilla_trans
unknown boolean disable_thunderbird_trans
unknown boolean mail_read_content
unknown boolean mozilla_read_content
unknown boolean pppd_for_user
unknown boolean read_untrusted_content
unknown boolean run_ssh_inetd
unknown boolean secure_mode
unknown boolean spamassassin_can_network
unknown boolean ssh_sysadm_login
unknown boolean staff_read_sysadm_file
unknown boolean user_direct_mouse
unknown boolean user_dmesg
unknown boolean user_net_control
unknown boolean user_ping
unknown boolean user_rw_noexattrfile
unknown boolean user_tcp_server
unknown boolean user_ttyfile_stat
unknown boolean write_untrusted_content
unknown boolean xdm_sysadm_login
Warning!  Error while reading /etc/selinux/refpolicy/booleans:  Invalid argument

However, it does not kill init or panic the kernel - it just proceeds
onward after these warnings.  Note:  I initially booted it permissive
after touching /.autorelabel to force a filesystem relabel, then
rebooted again in enforcing mode once the filesystem was correctly
labeled.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: CentOS and SELinux refpolicy trouble

[Christopher J. PeBenito]

On Wed, 2006-11-29 at 13:41 -0500, Stephen Smalley wrote:
> On Wed, 2006-11-29 at 19:32 +0100, Filip Bartmann wrote:
> > OUTPUT_POLICY = 18
> > TYPE = targeted
> > NAME = reftargeted
> > DISTRO = rhel4
> > DIRECT_INITRC=y
> > MONOLITHIC=y
> > POLY=n
> > MLS_SENS=16
> > MLS_CATS=256
> > MCS_CATS=256
> > QUIET=n
> 
> Looks fine.
> (aside:  looks like one also has to run make install with
> SETFILES=/usr/sbin/setfiles on RHEL 4 and derivatives)

Yes, thats an unfortunate problem with moving filesystem locations.

> > > Not sure about the booleans errors - what did that booleans file
> > > contain?
> > The booleans file contain default this values(it's almost defaults from
> > tresys refpolicy):
> 
> Hmm...looks like it is generating boolean entries for booleans that are
> only defined in strict policy even though you are building targeted.

This should get better, we've almost completed a branch of the policy
that moves booleans back to modules where it makes sense (the boolean is
only referenced in that module).  It'll be easier to make sure booleans
are around only when the policy uses them.  Hopefully that will be ready
to be merged to trunk very soon.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.