new Debian packages

new Debian packages

[Russell Coker]

I have put a new version of logcheck online, it has a minor logcheck package 
change (but nothing significant).

I have also put on a new version of my modified cron package online, it has a 
minor change to the checksecurity script (which needs a matching change to 
cron.fc) and a change to the postinst to allow it to start correctly.

http://www.coker.com.au/selinux/

-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
>From field.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

New Debian packages

[Russell Coker]

I have put a new version of my Debian packages online.  It's mostly just 
incremental improvements and bug-fixes for what I've done before, plus the 
start of my new chroot support that will be the topic of my paper for Linux 
Kongress.

Also I have setup an experimental apt repository for my SE modified packages, 
add the following to your /etc/apt/sources.list file and dselect will offer 
to upgrade the regular versions of login, cron, kdm, etc to my SE versions.

deb http://www.coker.com.au selinux/


-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
>From field.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: New Debian packages

[Russell Coker]

On Mon, 5 Aug 2002 20:08, Russell Coker wrote:
> Also I have setup an experimental apt repository for my SE modified
> packages, add the following to your /etc/apt/sources.list file and dselect
> will offer to upgrade the regular versions of login, cron, kdm, etc to my
> SE versions.

Sorry, I got the config line wrong, here's the correct entry:
deb http://www.coker.com.au/selinux/ ./

-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
>From field.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: New Debian packages

[david kelman]

Russell: thank you. the new sources.list line
is going into many debian machines (including 
mine) and is an important step foward to
making SEL more widely available. Thx! :-) 
-- 
Get your free email from www.linuxmail.org 


Powered by Outblaze

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

new Debian packages

[Russell Coker]

I have packaged the new kernel patch and the selinux-small code and uploaded
them to my web site and to Debian.

Please make sure that you install the "selinux" and "selinux-policy-default"
packages BEFORE booting a kernel compiled with the latest kernel patch.

The new kernel patch has a new type that is used in the boot phase and
will be unhappy if you have an old policy (it still seems to work
though - you can get your machine to the stage of installing the new
policy and rebooting when it's in such a state).



Russell Coker

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: new Debian packages

[Tom]

On Fri, Dec 13, 2002 at 11:31:08PM +0100, Russell Coker wrote:
> I have packaged the new kernel patch and the selinux-small code and uploaded
> them to my web site and to Debian.
> 
> Please make sure that you install the "selinux" and "selinux-policy-default"
> packages BEFORE booting a kernel compiled with the latest kernel patch.

I'll be testing this next week. Any new kernels from Brian that I could
give a shakedown while I'm at it? (I've hosed my test machine again.
Must remember to be more careful. Will probably write a new chapter
into my "things not to do with SELinux" paper. :) )


-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: new Debian packages

[Brian May]

On Sat, Dec 14, 2002 at 12:42:07AM +0100, Tom wrote:
> I'll be testing this next week. Any new kernels from Brian that I could
> give a shakedown while I'm at it? (I've hosed my test machine again.
> Must remember to be more careful. Will probably write a new chapter
> into my "things not to do with SELinux" paper. :) )

The latest patch I have, at the usual place, is for the 2.4.19
kernel.

It has at least one know security bug fixed in the kernel, plus lots
of patches I need from time to time (eg. EVMS, ACL, SE-Linux, FreeS/WAN,
DOV).

I am not sure if there are version of these patches that will work
with 2.4.20 yet, that is something I need to investigate (DOV at least
is suppost to have been integrated into the kernel by now).

Also I haven't yet been able to get EVMS working properly (the kernel
fails to "discover" EVMS volumes), but that may be my fault, and is
off-topic for this list anyway.
--
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: new Debian packages

[Russell Coker]

On Sat, 14 Dec 2002 01:53, Brian May wrote:
> On Sat, Dec 14, 2002 at 12:42:07AM +0100, Tom wrote:
> > I'll be testing this next week. Any new kernels from Brian that I could
> > give a shakedown while I'm at it? (I've hosed my test machine again.
> > Must remember to be more careful. Will probably write a new chapter
> > into my "things not to do with SELinux" paper. :) )
>
> The latest patch I have, at the usual place, is for the 2.4.19
> kernel.
>
> It has at least one know security bug fixed in the kernel, plus lots
> of patches I need from time to time (eg. EVMS, ACL, SE-Linux, FreeS/WAN,
> DOV).

That'll keep you busy!

I've given up on EVMS as Linus is not accepting the full EVMS thing and they 
have been forced to radically change their plans.  As this happened before I 
got around to doing anything serious with EVMS I decided to skip it until 
it's all settled down.

FreeS/WAN is in a similar situation, it's never going into the main kernel 
tree and there's already a replacement for 2.6.

I've been thinking that it may be time to start moving some of my machines to 
2.5.x.  I think that 2.5.x development has slowed down enough for me to port 
the LSM patches between kernels.

I'm just looking at 2.5 now.  It appears to have IPSec, it has device-mapper 
(not sure if this means LVM2 is in), it has ACLs, and lots of other nice 
things such as CryptoAPI.

Maybe next time I run SE play machines I'll run one on a 2.4.x kernel and one 
on 2.5.x (Sun gave me a RaQ to use for this sort of thing - thanks Sun).

> I am not sure if there are version of these patches that will work
> with 2.4.20 yet, that is something I need to investigate (DOV at least
> is suppost to have been integrated into the kernel by now).

What is DOV?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: new Debian packages

[Russell Coker]

On Sat, 14 Dec 2002 00:42, Tom wrote:
> On Fri, Dec 13, 2002 at 11:31:08PM +0100, Russell Coker wrote:
> > I have packaged the new kernel patch and the selinux-small code and
> > uploaded them to my web site and to Debian.
> >
> > Please make sure that you install the "selinux" and
> > "selinux-policy-default" packages BEFORE booting a kernel compiled with
> > the latest kernel patch.
>
> I'll be testing this next week. Any new kernels from Brian that I could
> give a shakedown while I'm at it? (I've hosed my test machine again.
> Must remember to be more careful. Will probably write a new chapter
> into my "things not to do with SELinux" paper. :) )

With what Brian is attempting to do with his kernels it might take him a while 
to get a new one out.  Maybe you would be better off just compiling your own.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: new Debian packages

[Brian May]

On Sat, Dec 14, 2002 at 10:45:15PM +0100, Russell Coker wrote:
> That'll keep you busy!

The main reason I haven't been racing to do 2.4.20!

> I've given up on EVMS as Linus is not accepting the full EVMS thing and they 
> have been forced to radically change their plans.  As this happened before I 
> got around to doing anything serious with EVMS I decided to skip it until 
> it's all settled down.

EVMS looks pretty good, the reason it wouldn't work on my test
machine was because the lvm EVMS module wasn't going to autoload.
All EVMS modules need to be manually loaded, it appears.

I will be interested to see what happens with EVMS now, apparently
the user front ends will remain identical, just the backend will use
existing kernel components, like LVM2 and device mapper, instead
of "re-inventing the wheel".

> FreeS/WAN is in a similar situation, it's never going into the main kernel 
> tree and there's already a replacement for 2.6.

Agreed here, it may be that I never get FreeS/WAN working as a result
(although I came pretty close on my last attempt).

> I've been thinking that it may be time to start moving some of my machines to 
> 2.5.x.  I think that 2.5.x development has slowed down enough for me to port 
> the LSM patches between kernels.
> 
> I'm just looking at 2.5 now.  It appears to have IPSec, it has device-mapper 
> (not sure if this means LVM2 is in), it has ACLs, and lots of other nice 
> things such as CryptoAPI.

My impression was that LVM2 was in already, but I might be mistaken.

> Maybe next time I run SE play machines I'll run one on a 2.4.x kernel and one 
> on 2.5.x (Sun gave me a RaQ to use for this sort of thing - thanks Sun).
> 
> > I am not sure if there are version of these patches that will work
> > with 2.4.20 yet, that is something I need to investigate (DOV at least
> > is suppost to have been integrated into the kernel by now).
> 
> What is DOV?

Data-Over-Voice, an ugly hack for ISDN in Australia to get cheaper ISDN
call rates (Telstra thinks it is a voice call, not a data call...).

Getting back to SE-Linux, and my private archive, I have been
experimentating with DAK (the official Debian archive scripts).
I have almost entirely converted my archive to use these scripts
instead of my own (which had certain limitations that were going
to be hard to fix).

This means that I can:
- Support automatic package installs, without manual intervention.
- Better checks new files, eg. to make sure the version is correct
  and there is a copy of the *.orig.tar.gz file available.
- Support automatically deleting obsolete files.
- Cryptographic signing of Release file, which can be used to ensure
  that all other files in the archive are valid.
- Support automatic building on other architectures (except
  I don't have any spare non-i386 computers to do this...).
- Automatic notifications to a mailing list for new uploads
  (would anybody be interested in subscribing to such a mailing list?).
- There are 3 distributions: unstable (where new uploads will go),
  testing (only there because some of the scripts stupidly hardcode it),
  and stable (where packages go when there appear to be working).

What I still have to do:
- Create announce mailing list?
- Fix packages that DAK rejects, due to technical errors in packaging.
- Learn who to move packages from "unstable" to "stable"
  (I suspect I know how; not tested yet).
- Think of some use for the "testing" distribution.
--
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: new Debian packages

[Les Bell]

Russell Coker <russell@coker.com.au> wrote:

>>
FreeS/WAN is in a similar situation, it's never going into the main kernel
tree and there's already a replacement for 2.6.
<<

The FreeS/WAN developers seem mostly unconcerned by this - their view is
that the kernel IPSec code is just one small part of a complete IPSec
implementation; there's also a lot of user-space code for key management,
authentication via X.509 certificates, etc. which they've been working on
for a long time now. FWIW, I'm sticking with FreeS/WAN for the time being.
. .

Best,

--- Les Bell, CISSP
[http://www.lesbell.com.au]



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: new Debian packages

[Brian May]

On Sun, Dec 15, 2002 at 11:10:06AM +1100, Les Bell wrote:
> The FreeS/WAN developers seem mostly unconcerned by this - their view is
> that the kernel IPSec code is just one small part of a complete IPSec
> implementation; there's also a lot of user-space code for key management,
> authentication via X.509 certificates, etc. which they've been working on

errr.... FreeS/WAN project aren't interested in X.509, X.509 is an extra
unsupported patch to the FreeS/WAN patch (although both are integrated
in the Debian packaging).

I asked (in person) one of the FreeS/WAN developers about this at
OLS2002, and was told that they aren't currently interested in
supporting X.509 and have no plans to support it in the future.

(please correct me if I am mistaken though).
--
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: new Debian packages

[Les Bell]

Brian May <bam@snoopy.apana.org.au> wrote:

>>
errr.... FreeS/WAN project aren't interested in X.509, X.509 is an extra
unsupported patch to the FreeS/WAN patch (although both are integrated
in the Debian packaging).
<<

You're quite right, Brian - X.509 is a patch, though it's integrated into
Super FreeS/WAN (http://www.freeswan.ca).

Best,

--- Les Bell, CISSP
[http://www.lesbell.com.au]



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

New Debian packages

[Steinar H. Gunderson]

Ian,

I uploaded a couple of new autofs versions to the Debian archive today; you
might be interested in some of the patches (mostly minor stuff, like backing
down on "set -e" in the init scripts, but there's an odd bugfix in places).
Should I send them one by one, or do you just get 4.1.3+4.1.4beta2-7 out of
the archive and pick out the patches yourself?

BTW, we're freezing really soon, so if you want something into the Debian
version in time for sarge, now is probably the time. :-)

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Re: New Debian packages

[Ian Kent]

On Sun, 3 Apr 2005, Steinar H. Gunderson wrote:

> Ian,
> 
> I uploaded a couple of new autofs versions to the Debian archive today; you
> might be interested in some of the patches (mostly minor stuff, like backing
> down on "set -e" in the init scripts, but there's an odd bugfix in places).
> Should I send them one by one, or do you just get 4.1.3+4.1.4beta2-7 out of
> the archive and pick out the patches yourself?

I've also been working on this.

I've taken my lead from Debian bug report discussions.
I'll check your patches before I put out a new version.

> 
> BTW, we're freezing really soon, so if you want something into the Debian
> version in time for sarge, now is probably the time. :-)

I'm tempted to release 4.1.4. Most of the current issues are with the 
Debian portion of the init script which we have been working on.

Do you think we can get this bit right and go straight to release?

Ian

Re: New Debian packages

[Steinar H. Gunderson]

On Mon, Apr 04, 2005 at 10:51:36AM +0800, Ian Kent wrote:
> I'm tempted to release 4.1.4. Most of the current issues are with the 
> Debian portion of the init script which we have been working on.
> 
> Do you think we can get this bit right and go straight to release?

The only gripe I can find seems to be the replication, but that is probably
too much to fix for 4.1.4. So a release seems OK, yes.

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Re: New Debian packages

[Ian Kent]

On Mon, 4 Apr 2005, Steinar H. Gunderson wrote:

> On Mon, Apr 04, 2005 at 10:51:36AM +0800, Ian Kent wrote:
> > I'm tempted to release 4.1.4. Most of the current issues are with the 
> > Debian portion of the init script which we have been working on.
> > 
> > Do you think we can get this bit right and go straight to release?
> 
> The only gripe I can find seems to be the replication, but that is probably
> too much to fix for 4.1.4. So a release seems OK, yes.

Do you mean the replicated server code. Yes it was broken and still needs 
more work. However I've tickled it again and it should be at least 
functional.

Ian

Re: New Debian packages

[Ian Kent]

On Sun, 3 Apr 2005, Steinar H. Gunderson wrote:

> Ian,
>
> I uploaded a couple of new autofs versions to the Debian archive today; you
> might be interested in some of the patches (mostly minor stuff, like backing
> down on "set -e" in the init scripts, but there's an odd bugfix in places).
> Should I send them one by one, or do you just get 4.1.3+4.1.4beta2-7 out of
> the archive and pick out the patches yourself?

I've checked the patches and here's what I've got:

052 - applied
053 - equivalent change already in place
054 - backout my changes and apply
055 - will apply
056 & 57 - will apply but think scripts are now Boune shell complaint
058 - equivalent change already in place
059 - applied

So this looks good to me.

>
> BTW, we're freezing really soon, so if you want something into the Debian
> version in time for sarge, now is probably the time. :-)

Do we have enough time for another beta and some testing time or prehaps it's
release time given the above.

I need to test localy after I make these changes anyway so it's going to
be a couple of more days.

Ian

Re: New Debian packages

[Steinar H. Gunderson]

On Tue, Apr 05, 2005 at 08:05:31PM +0800, Ian Kent wrote:
> 053 - equivalent change already in place

Note that there already was an "equivalent" change in beta2, but it was
wrong. Have you fixed it properly this time? :-)

> Do we have enough time for another beta and some testing time or prehaps it's
> release time given the above.

The version number doesn't really matter to me, so call it whatever you'd
like; 4.1.4 would probably be fine.

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Re: New Debian packages

[Ian Kent]

On Tue, 5 Apr 2005, Steinar H. Gunderson wrote:

> On Tue, Apr 05, 2005 at 08:05:31PM +0800, Ian Kent wrote:
> > 053 - equivalent change already in place
> 
> Note that there already was an "equivalent" change in beta2, but it was
> wrong. Have you fixed it properly this time? :-)

Think so.
That's the nsswitch.conf tab problem.

Ian

New Debian packages

[Steinar H. Gunderson]

Ian (and all others interested),

I've uploaded 4.1.4-3 to Debian unstable, now that sarge has shipped. You
might be interested in the following patches for inclusion in upstream:

 - 064_support_options_on_nis_maps: Supports auto.master options on
   "+"-included NIS maps.
 - 065_fix_master_map_in_ldap: Bugfix for rc.autofs.in script with master
   map in LDAP.

Also, the Debian packages have switched to using ucf for the configuration
files; you might want to include that in your Debian packages.

/* Steinar */
-- 
Homepage: http://www.sesse.net/