More Debian bugs

More Debian bugs

[Dale Amon]

[-- Attachment #1: Type: text/plain, Size: 1825 bytes --]

As I plough onwards... with last nights set of hacks
I was able to label files today. But that is about it.
The latest debian packaged kernel turns out to have
POLICYVERS=19 in security.h. However, the selinux-policy-default
package builds a policy.20. 

I have other error messages which may or may not
follow from that problem. When I attempt a load_policy:

sepol_genusers: can't find system.users
No such file or directory
unable to get boolean names: No surc file or directory

I also note there are some dangling softlinks created
by the setools package:

/usr/share/setools/
lrwxrwxrwx  1 root root     24 2005-09-23 18:18 seaudit-report.conf -> /etc/seaudit-report.conf
lrwxrwxrwx  1 root root     23 2005-09-23 18:18 seaudit-report.css -> /etc/seaudit-report.css
lrwxrwxrwx  1 root root     16 2005-09-23 18:18 seuser.conf -> /etc/seuser.conf

But the targets are not at those locations, they are:
/etc/setools/
-rw-r--r--  1 root root 2805 2005-09-15 08:29 seaudit-report.conf
-rw-r--r--  1 root root 3040 2005-09-15 08:29 seaudit-report.css
-rw-r--r--  1 root root 1815 2005-09-15 08:29 seuser.conf

Although I have not looked at Stephens patches, I
would very much be surprised if I could just change
the defines in security.h, rebuild the kernel and
have it work...

I've got a bad feeling that the debian kernel
(2.6.12-1-686) is using a very out of date 
selinux patch set.

-- 
------------------------------------------------------
             Artemis Systems Development
   Dale Amon     amon@islandone.org    +44-7802-188325
       International linux systems consultancy
     Hardware & software system design, security
    and networking, systems programming and Admin
	      "Have Laptop, Will Travel"
------------------------------------------------------

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: More Debian bugs

[Stephen Smalley]

On Fri, 2005-09-23 at 20:52 +0100, Dale Amon wrote:
> As I plough onwards... with last nights set of hacks
> I was able to label files today. But that is about it.
> The latest debian packaged kernel turns out to have
> POLICYVERS=19 in security.h. However, the selinux-policy-default
> package builds a policy.20. 

You can change it to build policy.19 by adding the -c 19 option to
checkpolicy.  Attached policy Makefile diff from upstream CVS causes it
to build both versions and load the right one.

> I have other error messages which may or may not
> follow from that problem. When I attempt a load_policy:
> 
> sepol_genusers: can't find system.users
> No such file or directory
> unable to get boolean names: No surc file or directory

That's technically ok; load_policy will fall back to just the raw binary
policy image if those files don't exist.  But the Debian policy package
should create them nonetheless, like the Fedora one.

> I also note there are some dangling softlinks created
> by the setools package:
> 
> /usr/share/setools/
> lrwxrwxrwx  1 root root     24 2005-09-23 18:18 seaudit-report.conf -> /etc/seaudit-report.conf
> lrwxrwxrwx  1 root root     23 2005-09-23 18:18 seaudit-report.css -> /etc/seaudit-report.css
> lrwxrwxrwx  1 root root     16 2005-09-23 18:18 seuser.conf -> /etc/seuser.conf
> 
> But the targets are not at those locations, they are:
> /etc/setools/
> -rw-r--r--  1 root root 2805 2005-09-15 08:29 seaudit-report.conf
> -rw-r--r--  1 root root 3040 2005-09-15 08:29 seaudit-report.css
> -rw-r--r--  1 root root 1815 2005-09-15 08:29 seuser.conf

Hmmm...on Fedora, they aren't symlinks and there is no /etc/setools.
You may just want to grab the latest upstream tarball for setools from
Tresys and build it directly.  But note that setools is purely optional;
it is not required for operation of SELinux at all.  

> Although I have not looked at Stephens patches, I
> would very much be surprised if I could just change
> the defines in security.h, rebuild the kernel and
> have it work...

No, but checkpolicy always provides backwards compatibility via the -c
option, so you can just build via checkpolicy -c 19 -o policy.19
policy.conf. 

> I've got a bad feeling that the debian kernel
> (2.6.12-1-686) is using a very out of date 
> selinux patch set.

It should still be useable.  

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: More Debian bugs

[Stephen Smalley]

[-- Attachment #1: Type: text/plain, Size: 524 bytes --]

On Fri, 2005-09-23 at 16:10 -0400, Stephen Smalley wrote:
> You can change it to build policy.19 by adding the -c 19 option to
> checkpolicy.  Attached policy Makefile diff from upstream CVS causes it
> to build both versions and load the right one.

Might help if I actually attached that diff.  But note that you can just
modify your Makefile manually if you like to insert the -c 19 option to
checkpolicy when it is invoked.  This diff includes some other unrelated
changes.

-- 
Stephen Smalley
National Security Agency

[-- Attachment #2: policy-Makefile.diff --]
[-- Type: text/x-patch, Size: 2827 bytes --]

Index: policy/Makefile
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/policy/Makefile,v
retrieving revision 1.81
retrieving revision 1.82
diff -u -p -r1.81 -r1.82
--- policy/Makefile	5 Jul 2005 19:30:10 -0000	1.81
+++ policy/Makefile	15 Sep 2005 08:14:12 -0000	1.82
@@ -15,6 +15,9 @@
 # Set to y if MLS is enabled in the policy.
 MLS=n
 
+# Set to y if MCS is enabled in the policy
+MCS=n
+
 FLASKDIR = flask/
 PREFIX = /usr
 BINDIR = $(PREFIX)/bin
@@ -24,14 +27,18 @@ CHECKPOLICY = $(BINDIR)/checkpolicy
 GENHOMEDIRCON = $(SBINDIR)/genhomedircon
 SETFILES = $(SBINDIR)/setfiles
 VERS := $(shell $(CHECKPOLICY) $(POLICYCOMPAT) -V |cut -f 1 -d ' ')
+PREVERS := 19
 KERNVERS := $(shell cat /selinux/policyvers)
 POLICYVER := policy.$(VERS)
 TOPDIR = $(DESTDIR)/etc/selinux
+TYPE=strict
 ifeq ($(MLS),y)
 TYPE=mls
-else
-TYPE=strict
 endif
+ifeq ($(MCS),y)
+TYPE=mcs
+endif
+
 INSTALLDIR = $(TOPDIR)/$(TYPE)
 POLICYPATH = $(INSTALLDIR)/policy
 SRCPATH = $(INSTALLDIR)/src
@@ -54,6 +61,10 @@ ifeq ($(MLS),y)
 POLICYFILES += mls
 CHECKPOLMLS += -M
 endif
+ifeq ($(MCS), y)
+POLICYFILES += mcs
+CHECKPOLMLS += -M
+endif
 DEFCONTEXTFILES = initial_sid_contexts fs_use genfs_contexts net_contexts
 POLICYFILES += $(ALL_TUNABLES) $(TE_RBAC_FILES)
 POLICYFILES += $(USER_FILES)
@@ -148,8 +159,10 @@ $(LOADPATH): policy.conf $(CHECKPOLICY) 
 	@echo "Compiling policy ..."
 	@mkdir -p $(POLICYPATH)
 	$(CHECKPOLICY) $(CHECKPOLMLS) -o $@ policy.conf
-ifneq ($(MLS),y)
+ifneq ($(VERS),$(PREVERS))
+	$(CHECKPOLICY) -c $(PREVERS) -o $(POLICYPATH)/policy.$(PREVERS) policy.conf
 endif
+
 # Note: Can't use install, so not sure how to deal with mode, user, and group
 #	other than by default.
 
@@ -162,7 +175,11 @@ $(POLICYVER):  policy.conf $(FC) $(CHECK
 
 reload tmp/load: $(LOADPATH) 
 	@echo "Loading Policy ..."
+ifeq ($(VERS), $(KERNVERS))
 	$(LOADPOLICY) $(LOADPATH)
+else
+	$(LOADPOLICY) $(POLICYPATH)/policy.$(PREVERS)
+endif
 	touch tmp/load
 
 load: tmp/load $(FCPATH) 
@@ -328,3 +345,22 @@ mlsconvert: 
 	@sed "s/MLS=n/MLS=y/" Makefile > Makefile.new
 	@mv Makefile.new Makefile
 	@echo "Done"
+
+mcsconvert: 
+	@for file in $(CONTEXTFILES); do \
+		echo "Converting $$file"; \
+		sed -e 's/_t\b/_t:s0/g' $$file > $$file.new && \
+		mv $$file.new $$file; \
+	done
+	@for file in $(USER_FILES); do \
+		echo "Converting $$file"; \
+		sed -r -e 's/\;/ level s0 range s0;/' $$file | \
+		sed -r -e 's/(user (root|system_u).*);/\1 - s0:c0.c127;/' > $$file.new; \
+		mv $$file.new $$file; \
+	done
+	@sed -e '/sid kernel/s/s0/s0 - s0:c0.c127/' initial_sid_contexts > initial_sid_contexts.new && mv initial_sid_contexts.new initial_sid_contexts
+	@echo "Enabling MCS in the Makefile"
+	@sed "s/MCS=y/MCS=y/" Makefile > Makefile.new
+	@mv Makefile.new Makefile
+	@echo "Done"
+

Re: More Debian bugs

[Dale Amon]

[-- Attachment #1: Type: text/plain, Size: 2468 bytes --]

On Fri, Sep 23, 2005 at 04:10:32PM -0400, Stephen Smalley wrote:
> You can change it to build policy.19 by adding the -c 19 option to
> checkpolicy.  Attached policy Makefile diff from upstream CVS causes it
> to build both versions and load the right one.

Good. Still, someone should update the patches in Debian. If
they are that far behind, lord only knows what other bugs
are still in there.
 
> > sepol_genusers: can't find system.users
> > No such file or directory
> > unable to get boolean names: No surc file or directory
> 
> That's technically ok; load_policy will fall back to just the raw binary
> policy image if those files don't exist.  But the Debian policy package
> should create them nonetheless, like the Fedora one.

Okay, that should mean I'm just about there. 
 
> > I also note there are some dangling softlinks created
> > by the setools package:
> > 
> > /usr/share/setools/
> > lrwxrwxrwx  1 root root     24 2005-09-23 18:18 seaudit-report.conf -> /etc/seaudit-report.conf
> > lrwxrwxrwx  1 root root     23 2005-09-23 18:18 seaudit-report.css -> /etc/seaudit-report.css
> > lrwxrwxrwx  1 root root     16 2005-09-23 18:18 seuser.conf -> /etc/seuser.conf
> > 
> > But the targets are not at those locations, they are:
> > /etc/setools/
> > -rw-r--r--  1 root root 2805 2005-09-15 08:29 seaudit-report.conf
> > -rw-r--r--  1 root root 3040 2005-09-15 08:29 seaudit-report.css
> > -rw-r--r--  1 root root 1815 2005-09-15 08:29 seuser.conf
> 
> Hmmm...on Fedora, they aren't symlinks and there is no /etc/setools.
> You may just want to grab the latest upstream tarball for setools from
> Tresys and build it directly.  But note that setools is purely optional;
> it is not required for operation of SELinux at all.  

I included these for completeness... like the other
error messages they are not fatal but are something
that the packager should fix just to be tidy.

I'll have to see if I have time to swap drives this
evening and have another go. I presume I'm on my own
over the weekend...

-- 
------------------------------------------------------
             Artemis Systems Development
   Dale Amon     amon@islandone.org    +44-7802-188325
       International linux systems consultancy
     Hardware & software system design, security
    and networking, systems programming and Admin
	      "Have Laptop, Will Travel"
------------------------------------------------------

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: More Debian bugs

[Dale Amon]

[-- Attachment #1: Type: text/plain, Size: 675 bytes --]

Stephen:

I could use some advice on what packages are causing
the problem I hit on Friday. I suspect some version
of something is wrong or that something is missing.

Would you like a current copy of the package versions
loaded from Debian unstable and from Coker?

-- 
------------------------------------------------------
             Artemis Systems Development
   Dale Amon     amon@islandone.org    +44-7802-188325
       International linux systems consultancy
     Hardware & software system design, security
    and networking, systems programming and Admin
	      "Have Laptop, Will Travel"
------------------------------------------------------

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: More Debian bugs

[Russell Coker]

On Saturday 24 September 2005 05:52, Dale Amon <amon@vnl.com> wrote:
> As I plough onwards... with last nights set of hacks
> I was able to label files today. But that is about it.
> The latest debian packaged kernel turns out to have
> POLICYVERS=19 in security.h. However, the selinux-policy-default
> package builds a policy.20.

I've just uploaded a new policy package to Debian that fixes this issue and 
many other problems.  With this and Manoj's recent package uploads things are 
starting to get back into shape for Debian SE Linux.

One thing to note is that udev now seems a standard part of sid.  Udev on it's 
own seems a bit broken in Debian (for example not mounting /dev/pts), and in 
conjunction with SE Linux there's even more fun.  I don't expect udev and SE 
Linux to work well together on Debian for some weeks or maybe months.

Also my policy package for Debian still asks heaps of questions.  I won't fix 
that until we get the reference policy going.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: More Debian bugs

[Luke Kenneth Casson Leighton]

On Sun, Oct 09, 2005 at 08:19:31PM +1000, Russell Coker wrote:
> On Saturday 24 September 2005 05:52, Dale Amon <amon@vnl.com> wrote:
> > As I plough onwards... with last nights set of hacks
> > I was able to label files today. But that is about it.
> > The latest debian packaged kernel turns out to have
> > POLICYVERS=19 in security.h. However, the selinux-policy-default
> > package builds a policy.20.
> 
> I've just uploaded a new policy package to Debian that fixes this issue and 
> many other problems.  With this and Manoj's recent package uploads things are 
> starting to get back into shape for Debian SE Linux.
> 
> One thing to note is that udev now seems a standard part of sid.  Udev on it's 
> own seems a bit broken in Debian (for example not mounting /dev/pts), and in 
> conjunction with SE Linux there's even more fun.  I don't expect udev and SE 
> Linux to work well together on Debian for some weeks or maybe months.
 
 ah.

 there are two ways this needs to be fixed.

 1) initrd removed from debian

 2) udev moved into initrd like you have with redhat.

 gotta run.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: More Debian bugs

[Russell Coker]

On Monday 10 October 2005 00:50, Luke Kenneth Casson Leighton <lkcl@lkcl.net> 
wrote:
> > One thing to note is that udev now seems a standard part of sid.  Udev on
> > it's own seems a bit broken in Debian (for example not mounting
> > /dev/pts), and in conjunction with SE Linux there's even more fun.  I
> > don't expect udev and SE Linux to work well together on Debian for some
> > weeks or maybe months.
>
>  ah.
>
>  there are two ways this needs to be fixed.
>
>  1) initrd removed from debian
>
>  2) udev moved into initrd like you have with redhat.

3)  Bugs in udev just get fixed.  This is the one I expect to happen.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: More Debian bugs

[Luke Kenneth Casson Leighton]

On Mon, Oct 10, 2005 at 06:44:50AM +1000, Russell Coker wrote:
> On Monday 10 October 2005 00:50, Luke Kenneth Casson Leighton <lkcl@lkcl.net> 
> wrote:
> > > One thing to note is that udev now seems a standard part of sid.  Udev on
> > > it's own seems a bit broken in Debian (for example not mounting
> > > /dev/pts), and in conjunction with SE Linux there's even more fun.  I
> > > don't expect udev and SE Linux to work well together on Debian for some
> > > weeks or maybe months.
> >
> >  ah.
> >
> >  there are two ways this needs to be fixed.
> >
> >  1) initrd removed from debian
> >
> >  2) udev moved into initrd like you have with redhat.
> 
> 3)  Bugs in udev just get fixed.  This is the one I expect to happen.
 
 until 2) happens, debian/selinux is vulnerable to the "/dev
 being moved to /.dev and getting relabelled inappropriately or
 accidentally having selinux filecontexts removed by fsck and
 there being nothing to put them back" problem because no-one
 wants to or will acknowledge whether it's appropriate to add
 /.dev/* to the file contexts source alongside /dev and /udev
 *grumble, rhubarb* :)

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: More Debian bugs

[Russell Coker]

On Monday 10 October 2005 08:08, Luke Kenneth Casson Leighton <lkcl@lkcl.net> 
wrote:
> > 3)  Bugs in udev just get fixed.  This is the one I expect to happen.
>
>  until 2) happens, debian/selinux is vulnerable to the "/dev
>  being moved to /.dev and getting relabelled inappropriately or
>  accidentally having selinux filecontexts removed by fsck and
>  there being nothing to put them back" problem because no-one
>  wants to or will acknowledge whether it's appropriate to add
>  /.dev/* to the file contexts source alongside /dev and /udev
>  *grumble, rhubarb* :)

I've already added the minimal entries for /dev/.static/dev to the 
file_contexts in the recent Debian policy packages.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: More Debian bugs

[Luke Kenneth Casson Leighton]

On Mon, Oct 10, 2005 at 09:09:24AM +1000, Russell Coker wrote:

> >  /.dev/* to the file contexts source alongside /dev and /udev
> >  *grumble, rhubarb* :)
> 
> I've already added the minimal entries for /dev/.static/dev to the 
> file_contexts in the recent Debian policy packages.
 
 hurrah!

 hm, sounds like it's time to try it again...

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: More Debian bugs

[Dale Amon]

[-- Attachment #1: Type: text/plain, Size: 632 bytes --]

On Mon, Oct 10, 2005 at 10:05:08AM +0100, Luke Kenneth Casson Leighton wrote:
>  hm, sounds like it's time to try it again...

I've been on the road the last couple weeks, will try
again when I get home a week or so from now.

-- 
------------------------------------------------------
             Artemis Systems Development
   Dale Amon     amon@islandone.org    +44-7802-188325
       International linux systems consultancy
     Hardware & software system design, security
    and networking, systems programming and Admin
	      "Have Laptop, Will Travel"
------------------------------------------------------

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]