SE-Linux packages

SE-Linux packages

[Brian May]

Hello,

I have compiled SE-Linux versions of all required packages (except
fileutils[1]) for Debian stable. For this, I have back ported Russell's
changes to the stable version of the package, and compiled it under
a stable chroot pbuilder. This differs from Russell's approach; Russell
preferred to recompile the unstable version for stable.

While most packages are the stable version, I have used the unstable
version of logrotate, as I have been told that the stable version
of logrotate is buggy (note that the stable version is available,
just not referenced by the Packages.gz index).

There is also a kernel-source 2.4.19, with patches for SE-Linux,
ISDN DOV, and Freeswan. Also available are prebuilt kernel images
(based on the kernel-image-2.4.19-386 source package in Debian).

Also available, but not indexed in any way are udebs of the
kernel, which might be useful in creating a SE-Linux boot
disk for SE-Linux, using Debian-installer, in the future.

There are exactly three known bugs:

[1] fileutils is not available; I cannot apply the patch cleanly
to the stable version, and the unstable version requires a version
of texinfo to build not available in stable (I might end up
disabling building the documentation, same as Russell did).

[2] The kernel-image source package is missing a build depends
on libssl-dev.

[3] If installing packages after the SE-Linux version of dpkg has
been installed, but a SE-Linux kernel is not yet booted,
/etc/dpkg/postinst.d/selinux broke badly, and I had to disable it.

These packages have not yet experienced major testing, but
I would be surprised if there are any other significant problems.
Please let me know if you observe otherwise.

The apt-get entries to use are:

deb http://www.microcomaustralia.com.au/debian/ stable selinux
deb-src http://www.microcomaustralia.com.au/debian/ stable selinux

Or, if you want to access my other packages for stable (eg. amavis,
kerberos4kth, Heimdal, etc) too:

deb http://www.microcomaustralia.com.au/debian/ stable main selinux
deb-src http://www.microcomaustralia.com.au/debian/ stable main selinux

Comments?
-- 
Brian May <bam@snoopy.apana.org.au>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Russell Coker]

On Fri, 20 Sep 2002 04:21, Brian May wrote:
> [1] fileutils is not available; I cannot apply the patch cleanly
> to the stable version, and the unstable version requires a version
> of texinfo to build not available in stable (I might end up
> disabling building the documentation, same as Russell did).

I have just updated my patch for unstable to the latest "coreutils" based 
replacement for fileutils and shellutils.  You may want to base your work on 
that and maintain one package instead of two.

My coreutils stuff is in http://www.coker.com.au/selinux/coreutils/

> [3] If installing packages after the SE-Linux version of dpkg has
> been installed, but a SE-Linux kernel is not yet booted,
> /etc/dpkg/postinst.d/selinux broke badly, and I had to disable it.

Yes, you could have just removed the "-e" in that script though...

Probably should make the script check for a running SE kernel and only try to 
do anything if it's running.

> Comments?

Good work.  I'll remove my woody repository in the near future in favour of 
your work.

-- 
There is no point PGP/GPG signing an email unless the signature can be
verified.  If you post to a list then don't sign the message unless your
key is available on public key servers and has been signed by someone
who is in the web of trust, otherwise you just waste bandwidth and CPU.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Anton Emmerfors]

On Fri, Sep 20, 2002 at 05:47:53PM +0200, Russell Coker wrote:
> 
> > [3] If installing packages after the SE-Linux version of dpkg has
> > been installed, but a SE-Linux kernel is not yet booted,
> > /etc/dpkg/postinst.d/selinux broke badly, and I had to disable it.
> 
> Yes, you could have just removed the "-e" in that script though...
> 
> Probably should make the script check for a running SE kernel and only try to 
> do anything if it's running.

I encountered the same problem and hacked the script as follows. Not
sure if it is the best test but it works for me...


	/Anton

-8<--8=--

#!/bin/sh -e

SELINUX=$(avc_enforcing 2>&1)
if [ "x$SELINUX" = "xpermissive" -o "x$SELINUX" = "xenforcing" ]; then
  if [ -e /etc/selinux ]; then
    make -s -C /etc/selinux file_contexts/file_contexts
    SETFILES=/usr/sbin/setfiles
    if [ -x /usr/sbin/setfiles.old ]; then
      SETFILES=/usr/sbin/setfiles.old
    fi
    dpkg -L $1 | grep ^/.. | $SETFILES -q -s /etc/selinux/file_contexts/file_contexts
    if [ -x /usr/sbin/setfiles.old -a "$1" = "selinux" ]; then
      rm /usr/sbin/setfiles.old
    fi
  fi
else
  echo "Not running on SELinux-enabled kernel, files not relabeled."
  echo "Run 'make -C /etc/selinux/ relabel' manually to relabel."
fi

-8<--8=--
						

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Brian May]

On Fri, Sep 20, 2002 at 05:47:53PM +0200, Russell Coker wrote:
> I have just updated my patch for unstable to the latest "coreutils" based 
> replacement for fileutils and shellutils.  You may want to base your work on 
> that and maintain one package instead of two.
> 
> My coreutils stuff is in http://www.coker.com.au/selinux/coreutils/

Ok, I have compiled that for woody.

I have also compiled your latest selinux package for woody.

I have put both of these in my repository at the address previously
given.

However, there seem to be two policy errors, and I cannot see how to fix
them:

1. run_deb_t is defined twice; once in run_deb.te, and once in
dpkg.te (run_program macro).

2. mailman_queue_gph_t is not defined but required by the su_mini_domain
macro.

I have hacked solutions to these problems, but think a better solution
is required.
-- 
Brian May <bam@snoopy.apana.org.au>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Russell Coker]

On Tue, 24 Sep 2002 05:07, Brian May wrote:
> On Fri, Sep 20, 2002 at 05:47:53PM +0200, Russell Coker wrote:
> > I have just updated my patch for unstable to the latest "coreutils" based
> > replacement for fileutils and shellutils.  You may want to base your work
> > on that and maintain one package instead of two.
> >
> > My coreutils stuff is in http://www.coker.com.au/selinux/coreutils/
>
> Ok, I have compiled that for woody.
>
> I have also compiled your latest selinux package for woody.
>
> I have put both of these in my repository at the address previously
> given.
>
> However, there seem to be two policy errors, and I cannot see how to fix
> them:
>
> 1. run_deb_t is defined twice; once in run_deb.te, and once in
> dpkg.te (run_program macro).

run_deb.te should not exist any more.  The diff created by dpkg-buildpackage 
seems to have problems with deleted files.

> 2. mailman_queue_gph_t is not defined but required by the su_mini_domain
> macro.

I don't know the best way to solve this.  It would probably be best for you to 
devise a solution as you use gnome-pty-helper, it's difficult for me to solve 
problems that don't occur for me...

> I have hacked solutions to these problems, but think a better solution
> is required.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Brian May]

On Tue, Sep 24, 2002 at 01:54:35PM +0200, Russell Coker wrote:
 > However, there seem to be two policy errors, and I cannot see how to fix
> > them:
> >
> > 1. run_deb_t is defined twice; once in run_deb.te, and once in
> > dpkg.te (run_program macro).
> 
> run_deb.te should not exist any more.  The diff created by dpkg-buildpackage 
> seems to have problems with deleted files.

You will have to delete it in debian/rules I think.

Deleted files are not supported in the diff files for Debian packages.

Of course, it shouldn't fail if the files are already deleted.

> > 2. mailman_queue_gph_t is not defined but required by the su_mini_domain
> > macro.
> 
> I don't know the best way to solve this.  It would probably be best for you to 
> devise a solution as you use gnome-pty-helper, it's difficult for me to solve 
> problems that don't occur for me...

I could solve it, but I do not know what the original author was
intending.

For instance in su_macros.te,  su_mini_domain, it has:

ifdef(`gnome-pty-helper.te',
`allow $1_su_t $1_gph_t:fd use;
allow $1_t $1_gph_t:fd use;')

allow $1_su_t privfd:fd use;

# Write to utmp.
allow $1_su_t initrc_var_run_t:file rw_file_perms;

# Use the network.
can_network($1_su_t)
')dnl end su_mini_domain

Which immediately raises two concerns:

1. Why is gph_domain not used instead?

2. If I copy the following line to the top of su_mini_domain:

type $1_gph_t, domain, gphdomain;

I get duplicate symbols being defined.

I can only conclude that su_mini_domain is being called inconsistantly,
maybe sometimes it is called with a call to gph_domain, and sometimes it
is called instead of the call to gph_domain (pure speculation on my
part).
-- 
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Russell Coker]

On Fri, 27 Sep 2002 08:09, Brian May wrote:
> On Tue, Sep 24, 2002 at 01:54:35PM +0200, Russell Coker wrote:
>  > However, there seem to be two policy errors, and I cannot see how to fix
>  >
> > > them:
> > >
> > > 1. run_deb_t is defined twice; once in run_deb.te, and once in
> > > dpkg.te (run_program macro).
> >
> > run_deb.te should not exist any more.  The diff created by
> > dpkg-buildpackage seems to have problems with deleted files.
>
> You will have to delete it in debian/rules I think.
>
> Deleted files are not supported in the diff files for Debian packages.
>
> Of course, it shouldn't fail if the files are already deleted.

It doesn't really matter though.  This is only a problem for you and I at the 
moment.  The auto-builders aren't building the packages due to compilation 
errors.  If someone builds their own package they can still decide to remove 
that file after installing the package and get a working system.

I expect that a new upstream release isn't too far off, Steve has just 
released a patch for a new policy version and I'm sure he'll want to get that 
officially released soonish...

> > > 2. mailman_queue_gph_t is not defined but required by the
> > > su_mini_domain macro.
> >
> > I don't know the best way to solve this.  It would probably be best for
> > you to devise a solution as you use gnome-pty-helper, it's difficult for
> > me to solve problems that don't occur for me...
>
> I could solve it, but I do not know what the original author was
> intending.

The intention is for minimal su functionality in the mini-domain.

> For instance in su_macros.te,  su_mini_domain, it has:
>
> ifdef(`gnome-pty-helper.te',
> `allow $1_su_t $1_gph_t:fd use;
> allow $1_t $1_gph_t:fd use;')

I've moved the above out of the minidomain.

I've put the result on http://www.coker.com.au/selinux/policy.tgz let me know 
if it works.

> 1. Why is gph_domain not used instead?

I don't know.  I've never done anything with gph stuff apart from copy other 
people's policy around.  You are probably the best person to sort these 
things out as you are the most active gph-SE user who's not totally busy on 
other things.

> 2. If I copy the following line to the top of su_mini_domain:
>
> type $1_gph_t, domain, gphdomain;
>
> I get duplicate symbols being defined.

That's not the right approach.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Russell Coker]

+<20020924030750.GA28681@snoopy.apana.org.au>
In-Reply-To: <20020924030750.GA28681@snoopy.apana.org.au>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-Id: <200209241354.35906.russell@coker.com.au>

On Tue, 24 Sep 2002 05:07, Brian May wrote:
> On Fri, Sep 20, 2002 at 05:47:53PM +0200, Russell Coker wrote:
> > I have just updated my patch for unstable to the latest "coreutils" based
> > replacement for fileutils and shellutils.  You may want to base your work
> > on that and maintain one package instead of two.
> >
> > My coreutils stuff is in http://www.coker.com.au/selinux/coreutils/
>
> Ok, I have compiled that for woody.
>
> I have also compiled your latest selinux package for woody.
>
> I have put both of these in my repository at the address previously
> given.
>
> However, there seem to be two policy errors, and I cannot see how to fix
> them:
>
> 1. run_deb_t is defined twice; once in run_deb.te, and once in
> dpkg.te (run_program macro).

run_deb.te should not exist any more.  The diff created by dpkg-buildpackage
seems to have problems with deleted files.

> 2. mailman_queue_gph_t is not defined but required by the su_mini_domain
> macro.

I don't know the best way to solve this.  It would probably be best for you to
devise a solution as you use gnome-pty-helper, it's difficult for me to solve
problems that don't occur for me...

> I have hacked solutions to these problems, but think a better solution
> is required.

--
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Brian May]

I am currently copying newer versions of kernel-patch, kernel-source,
kernel-image, and selinux, to the same location:

deb http://www.microcomaustralia.com.au/debian/ woody main selinux

(the "main" part is optional)

These have been updated to use Russell's latest files.

Also, I have now deviated from the "Debian" standard, and enabled DMA
and multimode for IDE by default in the kernel images (since there I saw
reports that enabling it during startup could cause data loss; not sure
how accurate they are...)

I have also packaged the latest version of devfsd (required for
SE-Linux) and put it here.

I have not yet had a chance to test any of this, and it may take several
hours to rsync my changes over my 64kbs, so please be patient if try
straight away and get file not found errors.
-- 
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Tom]

On Fri, Sep 27, 2002 at 07:29:47PM +1000, Brian May wrote:
> I am currently copying newer versions of kernel-patch, kernel-source,
> kernel-image, and selinux, to the same location:
> 
> deb http://www.microcomaustralia.com.au/debian/ woody main selinux

Is it possible that the selinux-policy-default is broken? I've done
everything I could to make sure I have a clean build (including rm -rf
/etc/selinux) and I still get several hundred errors on install or
make. Here are some:

ERROR 'permission access is not defined for class chr_file' at token ';' on line 4043:
allow sysadm_su_t null_device_t:chr_file { ioctl read getattr access lock poll write append };
#line 4020
ERROR 'permission poll is not defined for class chr_file' at token ';' on line 4043:
allow sysadm_su_t null_device_t:chr_file { ioctl read getattr access lock poll write append };
#line 4020
ERROR 'permission poll is not defined for class udp_socket' at token ';' on line 4073:
allow sysadm_su_t self:udp_socket { create ioctl read getattr poll write setattr append bind connect getopt setopt shutdown };
#line 4020
ERROR 'permission poll is not defined for class tcp_socket' at token ';' on line 4075:
allow sysadm_su_t self:tcp_socket { create ioctl read getattr poll write setattr append bind connect getopt setopt shutdown listen accept };
#line 4020
ERROR 'permission poll is not defined for class udp_socket' at token ';' on line 4181:
allow sysadm_su_t mount_t:udp_socket { ioctl read getattr poll write setattr append bind connect getopt setopt shutdown };
#line 4020
ERROR 'unknown type shell_exec_t' at token ';' on line 4233:
allow sysadm_su_t shell_exec_t:file { getattr access execute };
#line 4020
/usr/sbin/checkpolicy:  error(s) encountered while parsing configuration


-- 
PGP/GPG key: http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Stephen Smalley]

On Tue, 1 Oct 2002, Tom wrote:

> Is it possible that the selinux-policy-default is broken? I've done
> everything I could to make sure I have a clean build (including rm -rf
> /etc/selinux) and I still get several hundred errors on install or
> make. Here are some:
>
> ERROR 'permission access is not defined for class chr_file' at token ';' on line 4043:
> allow sysadm_su_t null_device_t:chr_file { ioctl read getattr access lock poll write append };

I posted a patch on 9/24 (signull-obsolete) that removed obsolete
permissions from the access vector definitions.  See
http://marc.theaimsgroup.com/?l=selinux&m=103289918201533&w=2.  It looks
like you are trying to compile a policy that still has those obsolete
permissions against the new access_vectors definitions, which naturally
won't work so well.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE-Linux packages

[Russell Coker]

On Tue, 1 Oct 2002 10:07, Tom wrote:
> On Fri, Sep 27, 2002 at 07:29:47PM +1000, Brian May wrote:
> > I am currently copying newer versions of kernel-patch, kernel-source,
> > kernel-image, and selinux, to the same location:
> >
> > deb http://www.microcomaustralia.com.au/debian/ woody main selinux
>
> Is it possible that the selinux-policy-default is broken? I've done
> everything I could to make sure I have a clean build (including rm -rf
> /etc/selinux) and I still get several hundred errors on install or
> make. Here are some:

I suspect that you may have chosen to ignore the changes (or selected "always 
ignore" on a previous upgrade).  When you do this you are taking parts of the 
policy out of the automatic upgrade path and therefore if an upgrade is 
necessary to produce a compilable policy then the policy will not compile.

To resolve this you can edit /usr/share/selinux/policy/ignorediff and remove 
the files you don't want to protect from modifications and then run
"se_dpkg --configure -a".

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.