Re: SELinux on Wheezy

[Stephen Smalley <sds@tycho.nsa.gov>]

On Thu, 2012-02-09 at 09:34 -0800, C.J. Adams-Collier KF7BMP wrote:
> > That's interesting, and it might explain why your policy didn't get
> > fully installed originally.  Is that alsa.pp file from the current
> > selinux-policy package or is it a leftover of an older one?  What is the
> > error you get with it?  It should be removed if it doesn't work.
> 
> cjac@foxtrot:~$ locate alsa.pp | xargs dpkg -S | awk -F: '{print $1}' | xargs debsums | grep alsa.pp
> /usr/share/selinux/default/alsa.pp                                            OK
> cjac@foxtrot:~$ 
> 
> How do I check for an error.  Not on STDOUT or STDERR it seems...  This
> may be one of the strangest, least useful error message I've ever seen.
> But it's got stiff competition.
>
> cjac@foxtrot:~$ locate alsa.pp | xargs dpkg -S | awk -F: '{print $1}' | xargs debsums | grep alsa.pp | sudo xargs semodule -i
> semodule:  Failed on OK!

I'm not sure what you are trying to do, but the above command will
ultimately call semodule -i on both alsa.pp and the "OK" string from the
output above, and as OK is not a module or even a file it naturally
fails.  I just wanted to know what semodule -i alsa.pp reports, since
you said it failed in some way.

> > Feel free to submit a patch for the EXAMPLES section in the semodule man
> > page.  Even better would be to improve semodule so that it automatically
> > detects the base module and handles it so that you can just do semodule
> > -i *.pp in all cases and not have to worry about filtering the list and
> > handling base specially.
> 
> sounds reasonable.  git uri anyone?

SELinux userspace lives at http://userspace.selinuxproject.org.
You can clone via git clone http://oss.tresys.com/git/selinux.git .
semodule is under policycoreutils.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.