SE Linux on Debian

SE Linux on Debian

[Tracy R Reed]

[-- Attachment #1: Type: text/plain, Size: 2134 bytes --]

I am trying to get SE Linux working on my debian system. I've been running
RedHat for years and I'm somewhat new to debian. :) I am running testing.
I installed 2.4.19 and the lsm-new-2002082308-2.4.19.patch.12.gz with
apt-get also. The kernel is running just fine. But I am having trouble
with the policy and utils.

I installed the debs with apt-get from:

deb http://www.microcomaustralia.com.au/debian/ stable selinux

because that is what is in the topic on the IRC channel. Is it ok to
install these from stable even though my distro is actually testing?

Here are the debs:

libselinux-dev
selinux
selinux-policy-default 

But the new ps, ls, sshd, etc. do not seem to be included here. Where do I
get those? Are they not in a deb? 

When I installed the new policy it asked a lot of questions such as:

Setting up selinux-policy-default (2002082308-4.bam.1) ...
File "domains/program/apache.te" changed.
Copy/Ignore/Always ignore/view Diff [c/I/a/d]? 

I said Copy to all of them. I'm not running all of that but I will be
playing with various different things so I want the latest policies
installed. When it was done asking questions I got this error:

/usr/sbin/checkpolicy:  loading policy configuration from /etc/security/selinux/src/policy.conf

ERROR 'parse error' at token 'run_program' on line 71322:
run_program(sysadm_t, sysadm_r, deb, dpkg_exec_t, dpkg_t)
#
/usr/sbin/checkpolicy:  error(s) encountered while parsing configuration
make: *** [/etc/security/selinux/policy.12] Error 1
dpkg: error processing selinux-policy-default (--configure):
 subprocess post-installation script returned error exit status 2

Errors were encountered while processing:
 selinux-policy-default
E: Sub-process /usr/bin/dpkg returned an error code (1)

Whenever I install a new package apt-get tries to recompile the policy
(why?) and I get the same error.

Any help is greatly appreciated!

-- 
Tracy Reed      http://www.ultraviolet.org
"Our products just aren't engineered for security." - Brian Valentine, 
senior VP in charge of Microsoft's Windows development 5 Sept 2002

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: SE Linux on Debian

[Russell Coker]

On Wed, 2 Oct 2002 00:36, Tracy R Reed wrote:
> deb http://www.microcomaustralia.com.au/debian/ stable selinux
>
> because that is what is in the topic on the IRC channel. Is it ok to
> install these from stable even though my distro is actually testing?

Yes, but you can get my packages for unstable from:
deb http://www.coker.com.au/selinux/ ./

> Here are the debs:
>
> libselinux-dev
> selinux
> selinux-policy-default
>
> But the new ps, ls, sshd, etc. do not seem to be included here. Where do I
> get those? Are they not in a deb?

They are in coreutils, fileutils, shellutils, textutils, cron, dpkg, ssh, 
login, logrotate, procps, and psmisc packages.

> When I installed the new policy it asked a lot of questions such as:
>
> Setting up selinux-policy-default (2002082308-4.bam.1) ...
> File "domains/program/apache.te" changed.
> Copy/Ignore/Always ignore/view Diff [c/I/a/d]?
>
> I said Copy to all of them. I'm not running all of that but I will be
> playing with various different things so I want the latest policies
> installed. When it was done asking questions I got this error:
>
> /usr/sbin/checkpolicy:  loading policy configuration from
> /etc/security/selinux/src/policy.conf
>
> ERROR 'parse error' at token 'run_program' on line 71322:
> run_program(sysadm_t, sysadm_r, deb, dpkg_exec_t, dpkg_t)

It looks like you are missing the run_program_macros.te file.  It should be in 
/etc/selinux/macros/programs , you can copy it manually from 
/usr/share/selinux/policy/default/macros/program/run_program_macros.te .

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Tracy R Reed]

[-- Attachment #1: Type: text/plain, Size: 1724 bytes --]

On Wed, Oct 02, 2002 at 02:01:46AM +0200, Russell Coker spake thusly:
> Yes, but you can get my packages for unstable from:
> deb http://www.coker.com.au/selinux/ ./

Ok, I'll do this just to keep things consistant.

> > But the new ps, ls, sshd, etc. do not seem to be included here. Where do I
> > get those? Are they not in a deb?
> 
> They are in coreutils, fileutils, shellutils, textutils, cron, dpkg, ssh, 
> login, logrotate, procps, and psmisc packages.

Yes, but these are the non-SE Linux patched utils, right?

> It looks like you are missing the run_program_macros.te file.  It should be in 
> /etc/selinux/macros/programs , you can copy it manually from 
> /usr/share/selinux/policy/default/macros/program/run_program_macros.te .

Ok, I copied that file into place. Now the error I get is:

/usr/sbin/checkpolicy:  loading policy configuration from
/etc/security/selinux/src/policy.conf
ERROR 'name conflict for type run_deb_t' at token ';' on line 121201:
#
type run_deb_t, domain, privrole, privuser, privlog, auth;
/usr/sbin/checkpolicy:  error(s) encountered while parsing configuration
make: *** [/etc/security/selinux/policy.12] Error 1

Upon doing some digging in policy.conf I see that type run_deb_t is indeed
declared twice. It is declared in all.te and in all_domains.te but those
are in /usr/share/selinux/policy/current and default. What is the
relationship of those two dirs to /etc/selinux/domains? Looks like stuff
has been moved around compared to the RedHat version.

-- 
Tracy Reed      http://www.ultraviolet.org
"Our products just aren't engineered for security." - Brian Valentine, 
senior VP in charge of Microsoft's Windows development 5 Sept 2002

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: SE Linux on Debian

[Brian May]

On Tue, Oct 01, 2002 at 03:36:38PM -0700, Tracy R Reed wrote:
> Here are the debs:
> libselinux-dev
> selinux
> selinux-policy-default 
> 
> But the new ps, ls, sshd, etc. do not seem to be included here. Where do I
> get those? Are they not in a deb? 

I think you are looking for the coreutils, fileutils, shellutils, and
procps packages.

> ERROR 'parse error' at token 'run_program' on line 71322:
> run_program(sysadm_t, sysadm_r, deb, dpkg_exec_t, dpkg_t)
> #
> /usr/sbin/checkpolicy:  error(s) encountered while parsing configuration
> make: *** [/etc/security/selinux/policy.12] Error 1
> dpkg: error processing selinux-policy-default (--configure):
>  subprocess post-installation script returned error exit status 2
> 
> Errors were encountered while processing:
>  selinux-policy-default
> E: Sub-process /usr/bin/dpkg returned an error code (1)

I believe that problem should be fixed in my latest version.

Now I get another error though:

mkdir -p /etc/security/selinux
/usr/sbin/checkpolicy -o tmp/pol /etc/security/selinux/src/policy.conf
/usr/sbin/checkpolicy:  loading policy configuration from
/etc/security/selinux/src/policy.conf
ERROR 'unknown type devfs_t' at token ';' on line 49839:
# allow writes to devpts devices
allow domain devfs_t:chr_file { ioctl read getattr lock write append };
/usr/sbin/checkpolicy:  error(s) encountered while parsing configuration
make: *** [/etc/security/selinux/policy.12] Error 1

Where is this type defined? It doesn't appear to be in
domains/program/devfsd.te.
-- 
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Tracy R Reed]

[-- Attachment #1: Type: text/plain, Size: 985 bytes --]

On Wed, Oct 02, 2002 at 11:48:15AM +1000, Brian May spake thusly:
> I think you are looking for the coreutils, fileutils, shellutils, and
> procps packages.

But are those patched for SE Linux?

> Now I get another error though:

I fixed that with Russells help but now I have another problem:

home:/etc/selinux# make
mkdir -p /etc/security/selinux
/usr/sbin/checkpolicy -o tmp/pol /etc/security/selinux/src/policy.conf
/usr/sbin/checkpolicy:  loading policy configuration from
/etc/security/selinux/src/policy.conf
ERROR 'name conflict for type run_deb_t' at token ';' on line 121201:
#
type run_deb_t, domain, privrole, privuser, privlog, auth;
/usr/sbin/checkpolicy:  error(s) encountered while parsing configuration
make: *** [/etc/security/selinux/policy.12] Error 1

-- 
Tracy Reed      http://www.ultraviolet.org
"Our products just aren't engineered for security." - Brian Valentine, 
senior VP in charge of Microsoft's Windows development 5 Sept 2002

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: SE Linux on Debian

[Tom]

On Tue, Oct 01, 2002 at 10:10:22PM -0700, Tracy R Reed wrote:
> On Wed, Oct 02, 2002 at 11:48:15AM +1000, Brian May spake thusly:
> > I think you are looking for the coreutils, fileutils, shellutils, and
> > procps packages.
> 
> But are those patched for SE Linux?

yes, they are. look into the version string, if it has "bam" in it,
it's the patched version.


> home:/etc/selinux# make
> mkdir -p /etc/security/selinux
> /usr/sbin/checkpolicy -o tmp/pol /etc/security/selinux/src/policy.conf
> /usr/sbin/checkpolicy:  loading policy configuration from
> /etc/security/selinux/src/policy.conf
> ERROR 'name conflict for type run_deb_t' at token ';' on line 121201:
> #
> type run_deb_t, domain, privrole, privuser, privlog, auth;
> /usr/sbin/checkpolicy:  error(s) encountered while parsing configuration
> make: *** [/etc/security/selinux/policy.12] Error 1

you need to delete two files:

/etc/selinux/domains/program/run_deb.te
/etc/selinux/domains/program/run_init.te

their content was moved into other files, so they are not needed
anymore now and result in the above conflict



-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Brian May]

On Wed, Oct 02, 2002 at 07:42:01AM +0200, Tom wrote:
> you need to delete two files:
> 
> /etc/selinux/domains/program/run_deb.te
> /etc/selinux/domains/program/run_init.te
> 
> their content was moved into other files, so they are not needed
> anymore now and result in the above conflict

This problem should be fixed in the latest version of my package...
-- 
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Tracy R Reed]

[-- Attachment #1: Type: text/plain, Size: 1089 bytes --]

On Wed, Oct 02, 2002 at 07:42:01AM +0200, Tom spake thusly:
> yes, they are. look into the version string, if it has "bam" in it,
> it's the patched version.

Ah, I get it now. I upgraded everything except procps because my apt-get
thinks (rightly so) that the SE Linux package is an older version. I have
to figure out how to force it to do the downgrade.

> /etc/selinux/domains/program/run_deb.te
> /etc/selinux/domains/program/run_init.te

Ah. Actually they were in 

/usr/share/selinux/policy/current/

and

/usr/share/selinux/policy/default/

What's the difference? But I removed them and now the policy compiles.
Yeay!  Thanks for the help.

Next question: Just for kicks I did avc_toggle. The machine halted
instantly. So...how far is this from being a useable policy? :) I was able
to do this under RedHat and the system still worked properly for the most
part.

-- 
Tracy Reed      http://www.ultraviolet.org
"Our products just aren't engineered for security." - Brian Valentine, 
senior VP in charge of Microsoft's Windows development 5 Sept 2002

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: SE Linux on Debian

[Tracy R Reed]

[-- Attachment #1: Type: text/plain, Size: 1522 bytes --]

It seemed like make relabel would be a good idea to ensure everything is
labelled properly after all of the messing around I have done and I got
this:

home:/etc/selinux# make relabel
/usr/sbin/setfiles file_contexts/file_contexts `mount | awk '/(ext[23]|reiserfs)/{print $3}'`
/usr/sbin/setfiles:  Running on a SELinux kernel, using new system calls /usr/sbin/setfiles:  read 767 specifications
/usr/sbin/setfiles:  invalid context system_u:object_r:home_root_t on line number 86
/usr/sbin/setfiles:  invalid context system_u:object_r:games_exec_t on line number 616
/usr/sbin/setfiles:  invalid context system_u:object_r:var_log_inetd_t on line number 647
/usr/sbin/setfiles:  invalid context system_u:object_r:rndc_conf_t on line number 759
/usr/sbin/setfiles:  invalid context system_u:object_r:useradd_exec_t on line number 995
/usr/sbin/setfiles:  invalid context system_u:object_r:useradd_exec_t on line number 996
/usr/sbin/setfiles:  invalid context system_u:object_r:useradd_exec_t on line number 997
/usr/sbin/setfiles:  invalid context system_u:object_r:useradd_exec_t on line number 998
/usr/sbin/setfiles:  invalid context system_u:object_r:vmware_user_conf_t on line number 1053
/usr/sbin/setfiles:  invalid context system_u:object_r:xauth_exec_t on line number 1058
make: *** [relabel] Error 1


-- 
Tracy Reed      http://www.ultraviolet.org
"Our products just aren't engineered for security." - Brian Valentine, 
senior VP in charge of Microsoft's Windows development 5 Sept 2002

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: SE Linux on Debian

[Tom]

On Tue, Oct 01, 2002 at 11:27:15PM -0700, Tracy R Reed wrote:
> Ah. Actually they were in 
> 
> /usr/share/selinux/policy/current/
> 
> and
> 
> /usr/share/selinux/policy/default/
> 
> What's the difference? But I removed them and now the policy compiles.
> Yeay!  Thanks for the help.

That's just some symlinking, I believe.


> Next question: Just for kicks I did avc_toggle. The machine halted
> instantly. 

Welcome to SELinux. :)
I guess this happens to everyone at least once.

However, the (old) default policy worked fine for me and I don't think
there have been so many critical changes. Anything uncommon you
have, like raid, scsi, root filesystems on /dev/hdc7 or something?


-- 
PGP/GPG key: http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Tom]

On Tue, Oct 01, 2002 at 11:50:17PM -0700, Tracy R Reed wrote:
> It seemed like make relabel would be a good idea to ensure everything is
> labelled properly after all of the messing around I have done and I got
> this:

Absolutely, yes. You should relabel twice: Once before rebooting into
the SELinux kernel, once after (to label the files created during
shutdown and boot).


> home:/etc/selinux# make relabel
> /usr/sbin/setfiles file_contexts/file_contexts `mount | awk '/(ext[23]|reiserfs)/{print $3}'`
> /usr/sbin/setfiles:  Running on a SELinux kernel, using new system calls /usr/sbin/setfiles:  read 767 specifications
> /usr/sbin/setfiles:  invalid context system_u:object_r:home_root_t on line number 86
> /usr/sbin/setfiles:  invalid context system_u:object_r:games_exec_t on line number 616
> /usr/sbin/setfiles:  invalid context system_u:object_r:var_log_inetd_t on line number 647
> /usr/sbin/setfiles:  invalid context system_u:object_r:rndc_conf_t on line number 759
> /usr/sbin/setfiles:  invalid context system_u:object_r:useradd_exec_t on line number 995
> /usr/sbin/setfiles:  invalid context system_u:object_r:useradd_exec_t on line number 996
> /usr/sbin/setfiles:  invalid context system_u:object_r:useradd_exec_t on line number 997
> /usr/sbin/setfiles:  invalid context system_u:object_r:useradd_exec_t on line number 998
> /usr/sbin/setfiles:  invalid context system_u:object_r:vmware_user_conf_t on line number 1053
> /usr/sbin/setfiles:  invalid context system_u:object_r:xauth_exec_t on line number 1058
> make: *** [relabel] Error 1

I've seen these during my yesterday burnout, too. Check if your loaded
policy, policy on disk and kernel all match in versions. Did it load
the policy correctly? Try make load again. Also, I think you can delete
the /etc/selinux/file_contexts/file_contexts file since it should be
created from the .fc files.
Also, when you remove .te files, don't forget to remove the
corresponding .fc files, too.


-- 
PGP/GPG key: http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Tracy R Reed]

[-- Attachment #1: Type: text/plain, Size: 799 bytes --]

On Wed, Oct 02, 2002 at 09:20:56AM +0200, Tom spake thusly:
> That's just some symlinking, I believe.

Ah. Confusing. :)

> Welcome to SELinux. :)
> I guess this happens to everyone at least once.
> 
> However, the (old) default policy worked fine for me and I don't think
> there have been so many critical changes. Anything uncommon you
> have, like raid, scsi, root filesystems on /dev/hdc7 or something?

I realized that I still have xdm running and logged in through that so I
was logged in as xdm_t and my username wasn't in the users file which of
course causes all sorts of problems.

-- 
Tracy Reed      http://www.ultraviolet.org
"Our products just aren't engineered for security." - Brian Valentine, 
senior VP in charge of Microsoft's Windows development 5 Sept 2002

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: SE Linux on Debian

[Russell Coker]

On Wed, 2 Oct 2002 02:54, Tracy R Reed wrote:
> > > But the new ps, ls, sshd, etc. do not seem to be included here. Where
> > > do I get those? Are they not in a deb?
> >
> > They are in coreutils, fileutils, shellutils, textutils, cron, dpkg, ssh,
> > login, logrotate, procps, and psmisc packages.
>
> Yes, but these are the non-SE Linux patched utils, right?

The packages on my site and on Brian's site are the SE patched ones.

> Ok, I copied that file into place. Now the error I get is:
>
> /usr/sbin/checkpolicy:  loading policy configuration from
> /etc/security/selinux/src/policy.conf
> ERROR 'name conflict for type run_deb_t' at token ';' on line 121201:
> #
> type run_deb_t, domain, privrole, privuser, privlog, auth;
> /usr/sbin/checkpolicy:  error(s) encountered while parsing configuration
> make: *** [/etc/security/selinux/policy.12] Error 1
>
> Upon doing some digging in policy.conf I see that type run_deb_t is indeed
> declared twice. It is declared in all.te and in all_domains.te but those
> are in /usr/share/selinux/policy/current and default. What is the
> relationship of those two dirs to /etc/selinux/domains? Looks like stuff
> has been moved around compared to the RedHat version.

This comes from run_deb.te which is supposed to be removed.  There is a bug in 
Brian's package.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Russell Coker]

On Wed, 2 Oct 2002 09:30, Tracy R Reed wrote:
> I realized that I still have xdm running and logged in through that so I
> was logged in as xdm_t and my username wasn't in the users file which of
> course causes all sorts of problems.

If you want an X login then the only Debian package for you is kdm (the KDE 
XDM program), and that's for the 2.2.2 version of KDE.

There is a patch for GDM which I haven't packaged because it's not something I 
use (and the things I use don't work to my satisfaction yet).

If kde 2.2.2 isn't an option for you then you have to use startx.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Russell Coker]

On Wed, 2 Oct 2002 09:20, Tom wrote:
> On Tue, Oct 01, 2002 at 11:27:15PM -0700, Tracy R Reed wrote:
> > Ah. Actually they were in
> >
> > /usr/share/selinux/policy/current/
> >
> > and
> >
> > /usr/share/selinux/policy/default/
> >
> > What's the difference? But I removed them and now the policy compiles.
> > Yeay!  Thanks for the help.
>
> That's just some symlinking, I believe.

No.  /usr/share/selinux/policy/default/ is the files shipped in the Debian 
package (use "dpkg -L selinux-policy-default" to see this).  
/usr/share/selinux/policy/current/ is the files that are actually in use, and 
the symlink /etc/selinux points to it.

There's no symlinks under /usr/share/selinux.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Russell Coker]

On Wed, 2 Oct 2002 03:48, Brian May wrote:
> Now I get another error though:
>
> mkdir -p /etc/security/selinux
> /usr/sbin/checkpolicy -o tmp/pol /etc/security/selinux/src/policy.conf
> /usr/sbin/checkpolicy:  loading policy configuration from
> /etc/security/selinux/src/policy.conf
> ERROR 'unknown type devfs_t' at token ';' on line 49839:
> # allow writes to devpts devices
> allow domain devfs_t:chr_file { ioctl read getattr lock write append };
> /usr/sbin/checkpolicy:  error(s) encountered while parsing configuration
> make: *** [/etc/security/selinux/policy.12] Error 1
>
> Where is this type defined? It doesn't appear to be in
> domains/program/devfsd.te.

That was removed in the last NSA release (over a month ago).  Check the list 
archives, it was discussed on the list at the time.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Brian May]

On Wed, Oct 02, 2002 at 10:54:16AM +0200, Russell Coker wrote:
> That was removed in the last NSA release (over a month ago).  Check the list 
> archives, it was discussed on the list at the time.

Why is domains/program/devfsd.te still using it then?
-- 
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Russell Coker]

On Wed, 2 Oct 2002 23:31, Brian May wrote:
> On Wed, Oct 02, 2002 at 10:54:16AM +0200, Russell Coker wrote:
> > That was removed in the last NSA release (over a month ago).  Check the
> > list archives, it was discussed on the list at the time.
>
> Why is domains/program/devfsd.te still using it then?

It isn't.

The package selinux-policy-default_2002082308-3_all.deb that I released didn't 
have it, neither did selinux-policy-default_2002082308-1_all.deb , and it's 
not in the CVS.

Maybe there's another bug in the Debian diff generation?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SE Linux on Debian

[Brian May]

On Wed, Oct 02, 2002 at 11:42:11PM +0200, Russell Coker wrote:
> The package selinux-policy-default_2002082308-3_all.deb that I released didn't 
> have it, neither did selinux-policy-default_2002082308-1_all.deb , and it's 
> not in the CVS.

Isn't 2002082308-5 the latest version?

> Maybe there's another bug in the Debian diff generation?

Hang on, I was getting confused betweend devfsd_t and devfs_t.

My package was correct, it was this custom.te file that was
the problem...
-- 
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.