Re: Debian Kernel Images

[Russell Coker <russell@coker.com.au>]

[-- Attachment #1: Type: text/plain, Size: 1512 bytes --]

On Mon, 20 Jan 2003 12:48, Tom wrote:
> Jan 20 13:33:16 nsa3 kernel:
> SELinux: initialized (dev 00:00, type rootfs), not configured for labeling
> Jan 20 13:33:16 nsa3 kernel:
> Jan 20 13:33:16 nsa3 kernel: avc:  denied  { read } for  pid=1
> exe=/sbin/init path=/ dev=00:00 ino=1 scontext=system_u:system_r:init_t
> tcontext=system_u:object_r:unlabeled_t tclass=dir

OK, so what you are seeing is a rootfs access due to the kernel 
inappropriately failing to close some file handles in a kernel thread.

I have attached a patch to fix this, Brian please include it in your next 
kernel build.  Also are you using the Debian kernel-source package?  If so 
then a bug should be filed against it requesting the patch to be included.  I 
intentionally removed the patch in question when Steve added it to a LSM 
patch because I believe that as it is not an LSM issue (just a general kernel 
bug) it is not required in an LSM system (it is less necessary in a LSM 
system than in a non-LSM system) and therefore is best avoided so that it 
doesn't needlessly cause patch conflicts.

Please note that as far as I am aware I was the first person to discover this 
2.4.20 kernel bug, and I did so through SE Linux blocking (and logging) the 
inappropriate access.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[-- Attachment #2: initrd.patch --]
[-- Type: text/x-diff, Size: 359 bytes --]

--- linux-2.4.20.lsm-old/init/do_mounts.c	2002-12-13 19:33:23.000000000 +0100
+++ linux-2.4.20.lsm/init/do_mounts.c	2002-12-13 19:36:48.000000000 +0100
@@ -812,6 +812,8 @@
 	/* switch root and cwd back to / of rootfs */
 	sys_fchdir(root_fd);
 	sys_chroot(".");
+	close(old_fd);
+	close(root_fd);
 	sys_umount("/old/dev", 0);
 
 	if (real_root_dev == ram0) {