Basic Question

Basic Question

[Richard Mayo]

I have a basic question -- it's something I've assumed, but never
explicitly checked:

When SELinux is running in permissive mode and an action is attempted that
violates the security settings, the system logs this event.
Obviously, if SELinux were running in enforcing mode this action would have
been denied, but would an entry STILL have been made in the log file?


Thanks,
Rich Mayo



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Basic Question

[Tom]

On Mon, Dec 09, 2002 at 11:14:40AM -0500, Richard Mayo wrote:
> When SELinux is running in permissive mode and an action is attempted that
> violates the security settings, the system logs this event.
> Obviously, if SELinux were running in enforcing mode this action would have
> been denied, but would an entry STILL have been made in the log file?

Yes. As a matter of fact, this is how I refine my policies - write a
basic set, very strict, then see if it works and if not which log
entries it generates. Often, it throws errors, but works nevertheless,
that's when I put in dontaudit rules. This is why I do this in
enforcing mode, even though it's tedious - because only this way I can
see if it really needs the permissions it requests.


-- 
http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Basic Question

[Russell Coker]

On Mon, 9 Dec 2002 17:14, Richard Mayo wrote:
> I have a basic question -- it's something I've assumed, but never
> explicitly checked:
>
> When SELinux is running in permissive mode and an action is attempted that
> violates the security settings, the system logs this event.
> Obviously, if SELinux were running in enforcing mode this action would have
> been denied, but would an entry STILL have been made in the log file?

When a domain_auto_trans causes an attempt to use a domain that is not 
permitted for the role then nothing is logged in enforcing mode - the 
execution just silently fails.  In permissive mode it is allowed and a 
message is logged about an invalid context being generated (and when you 
switch back to enforcing mode the context in question is mapped to 
unlabelled_t from memory).

In all other cases of access being denied the message will be logged in 
enforcing mode (subject to the usual rate limit).

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Basic Question

[Brian May]

On Mon, Dec 09, 2002 at 07:24:50PM +0100, Russell Coker wrote:
> In all other cases of access being denied the message will be logged in 
> enforcing mode (subject to the usual rate limit).

Just in case Russell didn't make it clear, in enforcing mode
there is a rate limit; from the comment for avc_ratelimit:

/* 
 * This enforces a rate limit: not more than one kernel message
 * every 5secs to make a denial-of-service attack impossible.
 */ 

This only takes affect in enforcing mode:

static inline int check_avc_ratelimit(void)  
{
        if (selinux_enforcing)
                return avc_ratelimit();
        else {
                /* If permissive, then never suppress messages. */
                return 1;
        }
}

Over messages are simply discarded:

void avc_audit(...)
{
   ...

        if (!check_avc_ratelimit())
                return;

   ...

	print avc message here
}
-- 
Brian May <bam@snoopy.apana.org.au>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

basic question

[Yakov Lerner]

I have bare repo X, and two clones A and B (basically my work copy and
home copy of same personal files. I use 'git-pull origin' and 'git
push origin master' to sync files).

The same file 'xxx' was modified on A and on B, and committed on both.
In A, trying now 'git-pull origin', I get 'xxx: needs update'.
Which commands do I use now to merge xxx on A ?

Thanks
Yakov

Re: basic question

[Alex Riesen]

On 4/25/07, Yakov Lerner <iler.ml@gmail.com> wrote:
> I have bare repo X, and two clones A and B (basically my work copy and
> home copy of same personal files. I use 'git-pull origin' and 'git
> push origin master' to sync files).
>
> The same file 'xxx' was modified on A and on B, and committed on both.
> In A, trying now 'git-pull origin', I get 'xxx: needs update'.
> Which commands do I use now to merge xxx on A ?
>

You have _not_ committed the file xxx in A.

git commit -a
git pull B

Basic Question.

[Cleiton Reis]

Hello !

 A basic question :

 There's a way to start a PPP connection like an ADSL connection
always in the same
 interface (eg. ppp0 ) ?

 I have two adsl Links and I would like to start adsl1 always in ppp0 
and the adsl2 always in the ppp1, otherwise  when I reboot and the
adsl1 fail to connect,  the adsl2 start in ppp0 and my
firewall rules screw up !

 Regards.

Re: Basic Question.

[Clifford Kite]

On Tue, 6 Dec 2005, Cleiton Reis wrote:

|Hello !
|
| A basic question :
|
| There's a way to start a PPP connection like an ADSL connection
|always in the same
| interface (eg. ppp0 ) ?
|
| I have two adsl Links and I would like to start adsl1 always in ppp0 
|and the adsl2 always in the ppp1, otherwise  when I reboot and the
|adsl1 fail to connect,  the adsl2 start in ppp0 and my
|firewall rules screw up !

Man pppd, see whether the option "unit <num>" is what you want.

---
Clifford Kite

Re: Basic Question.

[James Carlson]

Clifford Kite writes:
> | I have two adsl Links and I would like to start adsl1 always in ppp0 
> |and the adsl2 always in the ppp1, otherwise  when I reboot and the
> |adsl1 fail to connect,  the adsl2 start in ppp0 and my
> |firewall rules screw up !
> 
> Man pppd, see whether the option "unit <num>" is what you want.

... or use the /etc/ppp/ip-up script interface to rewrite the firewall
rules on the fly.

(Agreed; there needs to be a better way to deal with this issue.)

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>

Re: Basic Question.

[Bill Unruh]

On Tue, 6 Dec 2005, James Carlson wrote:

> Clifford Kite writes:
>> | I have two adsl Links and I would like to start adsl1 always in ppp0
>> |and the adsl2 always in the ppp1, otherwise  when I reboot and the
>> |adsl1 fail to connect,  the adsl2 start in ppp0 and my
>> |firewall rules screw up !
>>
>> Man pppd, see whether the option "unit <num>" is what you want.
>
> ... or use the /etc/ppp/ip-up script interface to rewrite the firewall
> rules on the fly.
>
> (Agreed; there needs to be a better way to deal with this issue.)
>

One of the real problems with linux appears to be the difficulty of
associating a unit with a physical device. Thus with ethernet, it depends
on which hardware device the system just happens to look at first which
gets called eth0. The aliases established in /etc/modprobe.conf seem to be
just ignored.  Similarly with ppp, and everything else. This really
needs a unified way of dealing with it. the unit option in pppd helps, but
if for some reason that unit is unavailable, ppp simply grabs whatever
anyway.

To have to set up a script which determines which units are which and
rewrites all references to the unit number is not only a kludge but is also
extremely prone to bugs. That is not the way to go.

Re: Basic Question.

[James Carlson]

Bill Unruh writes:
> One of the real problems with linux appears to be the difficulty of
> associating a unit with a physical device. Thus with ethernet, it depends
> on which hardware device the system just happens to look at first which
> gets called eth0.

OK, but it's also the case that pppd is *more* than just Linux.  In
fact, it predates Linux by quite a bit.  So, I'd argue that the
solution needs to work for other systems (BSD, Solaris) as well as
Linux.

> The aliases established in /etc/modprobe.conf seem to be
> just ignored.  Similarly with ppp, and everything else. This really
> needs a unified way of dealing with it. the unit option in pppd helps, but
> if for some reason that unit is unavailable, ppp simply grabs whatever
> anyway.
> 
> To have to set up a script which determines which units are which and
> rewrites all references to the unit number is not only a kludge but is also
> extremely prone to bugs. That is not the way to go.

I agree that's kludgy.  One of the bad parts of it is that the
interface is established and enabled *before* the filters get applied,
and that's almost certainly not what anyone concerned with security
wants.

But even if we could somehow nail down the meaning of "ppp0" and
"ppp1" and so on, I think we'd be no better off than we are today for
pppd.  The problem I see is that a system with a number of links and a
large number of peers (not just this simple configuration with two
essentially fixed ADSL links, as the original poster described) will
run into reuse problems.

In other words, "ppp0" doesn't mean the same thing over time, and it'd
be just absurd and unmanageable to allocate ppp0 through ppp9999 for
10,000 separate users and somehow keep those configurations straight.

Communicating between pppd and IP filtering (and routing and other
subsystems) by way of overloading unit number to mean "user" doesn't
seem to be a scalable or manageable answer to me.

Instead, I'd rather see these things show up as features that can be
controlled on a per-peer basis.  That'd mean at least authenticated
peer name, and probably underlying physical or virtual interface as
well (e.g., if you have ttyS0 connected to a modem on the PSTN and
ttyS1 hard-wired to an embedded system, you may have different
security and routing requirements for each).

One way to do this would be with configuration options in pppd, so
that new things could be specified in options, options.ttyname,
chap-secrets, or the command line as appropriate (per-node,
per-device, per-user, or per-invocation).  I'm not sure that's the
best way, though, and it probably requires some thought.

-- 
James Carlson         42.703N 71.076W         <carlsonj@workingcode.com>

RE: Basic Question

[VanBaren, Gerald (AGRE)]

> -----Original Message-----
> From: owner-linuxppc-embedded@lists.linuxppc.org
> [mailto:owner-linuxppc-embedded@lists.linuxppc.org]On Behalf Of
> claudio.lazzarotto@copel.com
> Sent: Friday, May 14, 2004 9:38 AM
> To: Linuxppc-Embedded; Dan Malek; Wolfgang Denk; Joakim Tjernlund;
> sanjeevr@myw.ltindia.com
> Subject: Basic Question
>
>
>
> Hello people!
>
> I'm beginning to use Linux on embedded PowerPC and ...
> ... i want to get Linux installed on a powerPC board MPC850
> based system  equipped with the follow PPCBoot bootloader:
>
> PPCBoot 2.0.0 (Jul 21 2003 - 11:22:03)
>
> CPU:   XPC850xxZTB at 48 MHz: 2 kB I-Cache 1 kB D-Cache
> DRAM:  32 MB
> FLASH:  8 MB
> In:    serial
> Out:   serial
> Err:   serial
> Net:   SCC ETHERNET
>
> Where can I get a linux version and how can I have it
> ported to this board?
>
> Thanks
>
> Claudio A. Lazzarotto


Basic answers: U-Boot is the successor to PPCBoot.  Both are hosted on SourceForge.  You should switch to U-Boot, PPCBoot became U-Boot and is no longer actively maintained.
  http://sourceforge.net/projects/u-boot/

Wolfgang Denk has very good linux support that will help _you_ to port linux to your board.  See his Embedded Linux Development Kit (ELDK).
  http://www.denx.de/
  http://www.denx.de/twiki/bin/view/DULG/Manual
If you don't feel up to the job, there are several companies and probably more than a few freelance engineers willing to do it for a fee.  In terms of companies, Denx and MontaVista are the ones most visible in the U-Boot arena.

gvb


** Sent via the linuxppc-embedded mail list. See http://lists.linuxppc.org/

Basic Question

[claudio.lazzarotto]

Hello people!

I'm beginning to use Linux on embedded PowerPC and ...
... i want to get Linux installed on a powerPC board MPC850
based system  equipped with the follow PPCBoot bootloader:

PPCBoot 2.0.0 (Jul 21 2003 - 11:22:03)

CPU:   XPC850xxZTB at 48 MHz: 2 kB I-Cache 1 kB D-Cache
DRAM:  32 MB
FLASH:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:   SCC ETHERNET

Where can I get a linux version and how can I have it
ported to this board?

Thanks

Claudio A. Lazzarotto


** Sent via the linuxppc-embedded mail list. See http://lists.linuxppc.org/

Re: Basic Question

[Wolfgang Denk]

In message <OF5C26E385.CEFF94F3-ON03256E94.004A7A67@COPELnet> you wrote:
>
> I'm beginning to use Linux on embedded PowerPC and ...
> ... i want to get Linux installed on a powerPC board MPC850
> based system  equipped with the follow PPCBoot bootloader:
...
> Where can I get a linux version and how can I have it
> ported to this board?

Well, maybe you would get more replies if you  told  us  which  board
this is after all? What's the config name in PPCBoot?

Best regards,

Wolfgang Denk

--
Software Engineering:  Embedded and Realtime Systems,  Embedded Linux
Phone: (+49)-8142-4596-87  Fax: (+49)-8142-4596-88  Email: wd@denx.de
Wisdom is one of the few things that looks bigger the further away it
is.                               - Terry Pratchett, _Witches Abroad_

** Sent via the linuxppc-embedded mail list. See http://lists.linuxppc.org/

Basic question

[Venkat Raghu]

Hi,

I am new to MTD. I want to know about:

1) I want to write some data into flash memory, from
kernel level. So is it true that every time I write 
some data into flash, I have to erase entire sector.

2) Could any one give me a sample algorithm/psuedocode
of writing into flash.

Any more info about mtd will be really useful.

Regards
Venkat.



__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com

Basic question

[nejhdeh]

Hi,

Thanks to your reply erlier. I successfult compiled my device driver separatly 
as module.o and then ran a script to insmod into the kernel.

I have another basic question.

I have two PC systems. First one acts as my development system which I 
develope code using KDevelop running Red Hat linux (2.4.18). When I compile 
my application code (say app.0) and my device driver code (say module.o) then 
I FTP these files into my target system which is a scalled down single-board 
computer (with minimal RAM and disk) which runs linux 2.2.20.

Most of the time everything is O.K. However, when it comes to the device 
driver module (module.o), I get some kernel mismatch problems (obvisouly).

E.g. the file_operations struct in 2.2.20 is different to 2.4.18

My question is: How can I tell gcc or even within the module itself (e.g. 
KERNEL_VERSION) to compile for lower version kernel (i.e tell kernel 2.4.18 
to compile for 2.2.20)

Regards

Nejhdeh Ghevondian

Re: Basic question

[Bill Davidsen]

On Fri, 19 Jul 2002, nejhdeh wrote:
> My question is: How can I tell gcc or even within the module itself (e.g. 
> KERNEL_VERSION) to compile for lower version kernel (i.e tell kernel 2.4.18 
> to compile for 2.2.20)

You go to the 2.2.20 kernel tree and use 'make.' You can't move modules
from one kernel to another, they're totally different programs!

-- 
bill davidsen <davidsen@tmr.com>
  CTO, TMR Associates, Inc
Doing interesting things with little computers since 1979.

Re: Basic question

[nejhdeh]

Hi,
I have a question about fork() and messages..

For simplicity, I have a parent process that forks() two child processes (say 
pid1 & pid2).

How do I set priority levels of child1 vs child2. I want child1 to have a much 
higher priority level, since its going to read inputs from a serial device in 
the outside world?

Using basic signal calls say SIGUSR1, how can I communicate (without 
semaphores) between child1 and child2 through the parent? For instance if the 
child1 gets blocked forever trying to read the serial device then I want to 
notify the parent to kill child2??

Your time in this matter is greatly appreciated.


> Regards
>
> Nejhdeh Ghevondian

Basic question

[nejhdeh]

I end up getting all the required source codes from kernel-source-2.4.18-5.RPM
> 

> Now, it appears for me to use the kernel routines such as enable_irq 
(defined 
> in (/usr/src/linux-2.4.18-5/arch/i386/kernel/irq.c) I have to make the 
entire 
> kernel.o, since there are a lot of dependencies.
> 

> Do I need to go this far?? 
> 

> What is a simpler way to use these routines (in irq.c) with my application??
> 

> How do I link this module (i.e irq.o) with my application?? I get heaps of 
> unresoleved errors.

Re: Basic question

[Erik Mouw]

On Tue, Jul 16, 2002 at 11:08:39AM +1000, nejhdeh wrote:
> I end up getting all the required source codes from kernel-source-2.4.18-5.RPM
> > 
> 
> > Now, it appears for me to use the kernel routines such as enable_irq 
> (defined 
> > in (/usr/src/linux-2.4.18-5/arch/i386/kernel/irq.c) I have to make the 
> entire 
> > kernel.o, since there are a lot of dependencies.
> > 
> 
> > Do I need to go this far?? 
> > 
> 
> > What is a simpler way to use these routines (in irq.c) with my application??
> > 
> 
> > How do I link this module (i.e irq.o) with my application?? I get heaps of 
> > unresoleved errors.

You can't link kernel sources against applications and expect that it
just works. The kernel is a separate piece of software, all kernel
communication with the kernel goes through the file IO and system call
APIs.


Erik

-- 
J.A.K. (Erik) Mouw
Email: J.A.K.Mouw@its.tudelft.nl
WWW: http://www-ict.its.tudelft.nl/~erik/

Basic question..

[Raghava Raju]

   Hi

        I am new to kernel programming. I have
   just written a module consisting of init and
cleanup
   functions. I call init function of the module in
   kernel initialization function. So when system
   comes up, it shows that it entered module init 
   function(printk in "init" print some string), but 
   when I do lsmod it is not there in  list of 
   modules. But if I do insmod module, the module is
   listed in lsmod output. So is it that calling init
   module and insmod are not equivalent?

   Thank You
   Raghava.



__________________________________________________
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

Re: Basic question..

[Richard B. Johnson]

On Wed, 1 Aug 2001, Raghava Raju wrote:

> 
> 
>    Hi
> 
>         I am new to kernel programming. I have
>    just written a module consisting of init and
> cleanup
>    functions. I call init function of the module in
>    kernel initialization function. So when system
>    comes up, it shows that it entered module init 
>    function(printk in "init" print some string), but 
>    when I do lsmod it is not there in  list of 
>    modules. But if I do insmod module, the module is
>    listed in lsmod output. So is it that calling init
>    module and insmod are not equivalent?
> 
>    Thank You
>    Raghava.

If it's built into the kernel (a driver), it's not a module.
It won't show when executing `lsmod`. It also can't be removed.
Only drivers inserted as modules show with `lsmod`.


Cheers,
Dick Johnson

Penguin : Linux version 2.4.1 on an i686 machine (799.53 BogoMips).

    I was going to compile a list of innovations that could be
    attributed to Microsoft. Once I realized that Ctrl-Alt-Del
    was handled in the BIOS, I found that there aren't any.

Re: Basic question..

[Robert Love]

On 01 Aug 2001 13:44:01 -0700, Raghava Raju wrote:
>         I am new to kernel programming. I have
>    just written a module consisting of init and
> cleanup
>    functions. I call init function of the module in
>    kernel initialization function. So when system
>    comes up, it shows that it entered module init 
>    function(printk in "init" print some string), but 
>    when I do lsmod it is not there in  list of 
>    modules. But if I do insmod module, the module is
>    listed in lsmod output. So is it that calling init
>    module and insmod are not equivalent?

this is correct. calling the init function from within the kernel is not
the same as using insmod.  calling the init function is just that --
calling some linked-in function from within the kernel.

if you want to load a module from within the kernel, what you want is:
#include<linux/kmod.h>
int request_module(const char * module_name);

you will need kmod compiled in.

however, i suppose this is not what you want.  if you want to load your
code into the kernel -- statically linked -- then its not a module.  its
a member of the kernel.  have fun, enjoy the place.

if you want it to be a module, then its seperate, and you should load it
via insmod/modprobe/kmod.

-- 
Robert M. Love
rml at ufl.edu
rml at tech9.net