udev, tmp_t (on tmpfs on /dev), and matchpathcon failing

udev, tmp_t (on tmpfs on /dev), and matchpathcon failing

[Luke Kenneth Casson Leighton]

hello hello, this is with 1.14 utils and libselinux1: matchpathcon appears to be
failing ... on everything.

it says "matchpathcon(/) failed No such file or directory"

*clueless*...

okay, strace shows /etc/selinux/targeted/contexts/file_contexts
doesn't exist.

okkaay...

okay.  right.  i symlink
/etc/selinux/targeted/contexts/file_contexts/file_contexts to
/etc/selinux/src/contexts/file_contexts/file_contexts

and off it goes.

gawd, wish i'd found this earlier, i've been creating audit rules
like stonk, not knowing what was wrong.

*sigh*  okay.

russell (someone?), the debian 1.14 (or greater) selinux-policy-default
package could uhm, do with um, updating to match what the rpm spec
does :)

l.

-- 
-- 
Information I post is with honesty, integrity, and the expectation that
you will take full responsibility if acting on the information contained,
and that, should you find it to be flawed or even mildly useful, you
will act with both honesty and integrity in return - and tell me.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: udev, tmp_t (on tmpfs on /dev), and matchpathcon failing

[Russell Coker]

On Sun, 1 Aug 2004 23:52, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> russell (someone?), the debian 1.14 (or greater) selinux-policy-default
> package could uhm, do with um, updating to match what the rpm spec
> does :)

No, it does not.

The needs of Debian are different from the needs of Red Hat.  I don't think 
that Debian has any need for the targeted policy, but if someone does wish to 
produce such a policy then they can make a selinux-policy-targeted package to 
provide it which would conflict with selinux-policy-default.  I planned it 
this way YEARS ago.

The design of Debian has some significant differences from the Red Hat design.  
One such difference is that packages which provide conflicting ways of 
performing the same task can not be installed at the same time in Debian.  In 
Debian it is impossible to install Sendmail and Postfix at the same time.  If 
there is a selinux-policy-targeted package for Debian then it will conflict 
with selinux-policy-default for the same reason.

The upgrade path from the older version of the SE Linux packages 
(before /etc/selinux/config) is extremely painful.  But once you get there it 
will all work fine.

If you start rm'ing trees of files that my packages install and then replacing 
them with trees taken from other places then you can expect difficulty.  In 
fact you will probably end up repeating some of the work I did in 2001 when I 
first started working on SE Linux.

Also when you have problems please report the first error that occurs.  Not 
the error that occurs after you have tried ten different methods of working 
around the first error.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: udev, tmp_t (on tmpfs on /dev), and matchpathcon failing

[Luke Kenneth Casson Leighton]

On Mon, Aug 02, 2004 at 12:44:08AM +1000, Russell Coker wrote:
> On Sun, 1 Aug 2004 23:52, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > russell (someone?), the debian 1.14 (or greater) selinux-policy-default
> > package could uhm, do with um, updating to match what the rpm spec
> > does :)
> 
> No, it does not.
> 
> The needs of Debian are different from the needs of Red Hat.  I don't think 
> that Debian has any need for the targeted policy, but if someone does wish to 
> produce such a policy then they can make a selinux-policy-targeted package to 
> provide it which would conflict with selinux-policy-default.  I planned it 
> this way YEARS ago.
> 
> The design of Debian has some significant differences from the Red Hat design.  
> One such difference is that packages which provide conflicting ways of 
> performing the same task can not be installed at the same time in Debian.  In 
> Debian it is impossible to install Sendmail and Postfix at the same time.  If 
> there is a selinux-policy-targeted package for Debian then it will conflict 
> with selinux-policy-default for the same reason.
> 
> The upgrade path from the older version of the SE Linux packages 
> (before /etc/selinux/config) is extremely painful.  But once you get there it 
> will all work fine.
> 
> If you start rm'ing trees of files that my packages install and then replacing 
> them with trees taken from other places then you can expect difficulty.  In 
> fact you will probably end up repeating some of the work I did in 2001 when I 
> first started working on SE Linux.
> 
> Also when you have problems please report the first error that occurs.  Not 
> the error that occurs after you have tried ten different methods of working 
> around the first error.
 
 sorry, russell.

 i'm again moving rather quickly through one thing to the next, not
 really understanding why things are failing, and just trying something
 else until it works.

 my apologies for throwing up a large number of [post-analysis]
 irrelevant issues.

 i've pretty much abandoned all of my [heavily-modified] 1.12 stuff
 in favour of starting from scratch on the 1.14 stuff, and adding
 things as necessary (fireflier.te, usbmount.te, mods to fsadm.te
 to support usbmount.te using diskinfo and sg_map).

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.