run_init woes

run_init woes

[Tom]

I've started writing a policy for PXE daemon, improving tftpd policy,
etc - when something weird happend to me.

# run_init /etc/init.d/pxe start
Authenticating root.
Password:
Starting PXE daemon: Intel PXE daemon, PXE-2.0 Beta-1 (build 001)
Copyright (C) 1999  Intel Corporation
pxe.


So far, so good. Except that the pxe daemon dies right away. No debug 
output either, nothing in the logfiles.

However, if I do

# /etc/init.d/pxe start

Everything works just fine. (the machine is running in permissive mode)
Except that it runs in the wrong domain, of course. But IMHO this shows
that the problem isn't in the pxe daemon.

Also, if I do a reboot, the pxe daemon comes up just fine, running in
the correct domain and everything.


Is there anything in run_init that could cause this kind of problems?
If so, what can I about it? If not, what is it that I'm missing here?


(I have the feeling I've had this before, but I could find nothing in
the mailing list archive)


-- 
PGP/GPG key: http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: run_init woes

[Stephen Smalley]

On Thu, 2003-05-22 at 05:28, Tom wrote:
> I've started writing a policy for PXE daemon, improving tftpd policy,
> etc - when something weird happend to me.
> 
> # run_init /etc/init.d/pxe start
> Authenticating root.
> Password:
> Starting PXE daemon: Intel PXE daemon, PXE-2.0 Beta-1 (build 001)
> Copyright (C) 1999  Intel Corporation
> pxe.
> 
> 
> So far, so good. Except that the pxe daemon dies right away. No debug 
> output either, nothing in the logfiles.

What happens if you do the following (in permissive mode, of course):
	runas system_u:system_r:initrc_t /etc/init.d/pxe start

Are you using the extension to run_init created by Russell Coker to
create a separate pty for the daemon, or just the normal run_init
program?  What happens if you use the upstream run_init without his
modification?   

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: run_init woes

[Tom]

On Thu, May 22, 2003 at 08:10:20AM -0400, Stephen Smalley wrote:
> What happens if you do the following (in permissive mode, of course):
> 	runas system_u:system_r:initrc_t /etc/init.d/pxe start

It starts up and runs in the correct domain. (pxe_t)


> Are you using the extension to run_init created by Russell Coker to
> create a separate pty for the daemon, or just the normal run_init
> program?  

I'm using Russells run_init from his current debian packages. I assume
that it comes with his extensions.



> What happens if you use the upstream run_init without his
> modification?   

I've just downloaded and compiled it, and it works fine.

Russell - I've also made a few other experiments, since I was so sure I
had seen this before. rsync (as a daemon) also has the same problem,
but it throws an error message into the logfile:

May 22 15:27:38 setest rsyncd[681]: rsync error: received SIGUSR1 or SIGINT (code 20) at rsync.c(229)


It also works fine with the upstream run_init. Of course, there are
these messages which were the initial cause for the modification:

May 22 15:28:13 setest kernel: avc:  denied  { read write } for  pid=688 exe=/usr/bin/rsync path=/0 dev=00:07 ino=2 scontext=system_u:system_r:rsyncd_t tcontext=root:object_r:user_devpts_t tclass=chr_file


-- 
PGP/GPG key: http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: run_init woes

[Russell Coker]

On Thu, 22 May 2003 19:28, Tom wrote:
> I've started writing a policy for PXE daemon, improving tftpd policy,
> etc - when something weird happend to me.
>
> # run_init /etc/init.d/pxe start
> Authenticating root.
> Password:
> Starting PXE daemon: Intel PXE daemon, PXE-2.0 Beta-1 (build 001)
> Copyright (C) 1999  Intel Corporation
> pxe.
>
>
> So far, so good. Except that the pxe daemon dies right away. No debug
> output either, nothing in the logfiles.

Are you using my run_init or the NSA one?

If using mine then put "sleep 1" in the shell script after the daemon gets 
run.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: run_init woes

[Tom]

On Thu, May 22, 2003 at 10:41:35PM +1000, Russell Coker wrote:
> Are you using my run_init or the NSA one?

yours, see the other mail.


> If using mine then put "sleep 1" in the shell script after the daemon gets 
> run.

This makes rsync happy, but not pxe. I've tried with sleep 1, 2 and 5


Is there any way to enable stracing? I know I'd like to see what the
heck is happening.


-- 
PGP/GPG key: http://web.lemuria.org/pubkey.html
pub  1024D/2D7A04F5 2002-05-16 Tom Vogt <tom@lemuria.org>
     Key fingerprint = C731 64D1 4BCF 4C20 48A4  29B2 BF01 9FA1 2D7A 04F5

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.