Re: State of Debian SELinux

[Dale Amon <amon@vnl.com>]

[-- Attachment #1: Type: text/plain, Size: 4198 bytes --]

On Mon, Sep 19, 2005 at 08:27:50AM -0400, Stephen Smalley wrote:
> Index: libsepol/ChangeLog
> ===================================================================
> RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/ChangeLog,v
> retrieving revision 1.59
> retrieving revision 1.60
> diff -u -p -r1.59 -r1.60
> --- libsepol/ChangeLog	6 Sep 2005 17:52:49 -0000	1.59
> +++ libsepol/ChangeLog	9 Sep 2005 14:32:32 -0000	1.60
> @@ -1,3 +1,7 @@
> +1.9.1 2005-09-09
> +	* Fixed expand_avtab and expand_cond_av_list to keep separate
> +	entries with identical keys but different enabled flags.
> +
>  1.8 2005-09-06
>  	* Updated version for release.
>  
> Index: libsepol/VERSION
> ===================================================================
> RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/VERSION,v
> retrieving revision 1.54
> retrieving revision 1.55
> diff -u -p -r1.54 -r1.55
> --- libsepol/VERSION	6 Sep 2005 17:52:49 -0000	1.54
> +++ libsepol/VERSION	9 Sep 2005 14:32:32 -0000	1.55
> @@ -1 +1 @@
> -1.8
> +1.9.1
> Index: libsepol/src/expand.c
> ===================================================================
> RCS file: /nfshome/pal/CVS/selinux-usr/libsepol/src/expand.c,v
> retrieving revision 1.10
> retrieving revision 1.11
> diff -u -p -r1.10 -r1.11
> --- libsepol/src/expand.c	23 Aug 2005 13:05:18 -0000	1.10
> +++ libsepol/src/expand.c	9 Sep 2005 14:32:35 -0000	1.11
> @@ -1916,17 +1916,29 @@ int expand_module(policydb_t *base, poli
>  
>  static int expand_avtab_insert(avtab_t *a, avtab_key_t *k, avtab_datum_t *d)
>  {
> +	avtab_ptr_t node;
>  	avtab_datum_t *avd;
>  	int rc;
> -
> -	avd = avtab_search(a, k);
> -	if (!avd) {
> +	
> +	node = avtab_search_node(a, k);
> +	if (!node) {
>  		rc = avtab_insert(a, k, d);
>  		if (rc)
>  			DEBUG(__FUNCTION__, "Out of memory!\n");
>  		return rc;
>  	}
> -	
> +
> +	if ((k->specified & AVTAB_ENABLED) != 
> +	    (node->key.specified & AVTAB_ENABLED)) {
> +		node = avtab_insert_nonunique(a, k, d);
> +		if (!node) {
> +			DEBUG(__FUNCTION__, "Out of memory!\n");
> +			return -1;
> +		}
> +		return 0;
> +	}
> +
> +	avd = &node->datum;
>  	switch (k->specified & ~AVTAB_ENABLED) {
>  	case AVTAB_ALLOWED:
>  	case AVTAB_AUDITALLOW:
> @@ -2035,7 +2047,8 @@ static int expand_cond_insert(cond_av_li
>  	cond_av_list_t *nl;
>  
>  	node = avtab_search_node(expa, k);
> -	if (!node) {
> +	if (!node ||
> +	    (k->specified & AVTAB_ENABLED) != (node->key.specified & AVTAB_ENABLED)) {
>  		node = avtab_insert_nonunique(expa, k, d);
>  		if (!node) {
>  			DEBUG(__FUNCTION__, "Out of memory!\n");


To save time I did this in a chroot.

The debian version is 1.8-1; your patch applied cleanly
against this. I incremented the changelog to reflect
the version change and built 1.9-1 debian packages
which installed.

However, rerunning dselect still shows the same error
messages as before.

Reading package lists... Done
Building dependency tree... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
Need to get 0B of archives.
After unpacking 0B of additional disk space will be used.
Do you want to continue [Y/n]? 
Setting up selinux-policy-default (1.18-1) ...
/usr/bin/checkpolicy:  loading policy configuration from policy.conf
libsepol.expand_avtab_insert: Type conflict!
Out of memory - unable to check assertions
Check assertions failed.
make: *** [/etc/selinux/policy/policy.20] Error 255
dpkg: error processing selinux-policy-default (--configure):
 subprocess post-installation script returned error exit status 2
Errors were encountered while processing:
 selinux-policy-default


I could swap the drives out and try this live instead
of from chroot, but I doubt it would matter.

Suggestions?

-- 
------------------------------------------------------
   Dale Amon     amon@islandone.org    +44-7802-188325
       International linux systems consultancy
     Hardware & software system design, security
    and networking, systems programming and Admin
	      "Have Laptop, Will Travel"
------------------------------------------------------

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]