(no subject)

[selinux770]

Hi there.

I'm trying to enable SELinux on my Nokia 770 Internet Tablet which is running a modified Debian Linux for ARM processors. Until now I have replaced and installed several files and packages, but now I need further guidance. It seems like SELinux is working in some kind of way. But one main problem/question that persists is that i get a
Controlling term:               unknown (Operation not supported)
when doing a sestatus -v.

The "Current context" for user root is system_u:system_r:sshd_t when i log in via ssh.
(uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:kernel_t)

Within the device (when opening a console or whatever) the "Current context" is system_u:system_r:kernel_t.
(uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:kernel_t)
Just as many other (nearly all) processes, too.

So my questions:
1. What is the controlling term in sestatus for? What does it mean if it's unknown and how bad is this problem?
2. Are the wrong contexts of users a policy based problem or are they derived by the problem with the controlling term (or even orthers)? I need to know this since I changed much on the device for SELinux and now I'm not sure if I should continue searching missing functionalities within the system or searching for errors in the policy or file labelling.

If you need any more information feel free to ask.

Thanks in advance
Roland Bender

Further information:
~# sestatus -v
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 19
Policy from config file:        .

Process contexts:
Current context:                system_u:system_r:sshd_t
Init context:                   system_u:system_r:init_t

File contexts:
Controlling term:               unknown (Operation not supported)
/etc/passwd                     system_u:object_r:etc_t
/etc/shadow                     system_u:object_r:shadow_t
/bin/bash                       system_u:object_r:shell_exec_t -> system_u:object_r:shell_exec_t
/bin/login                      system_u:object_r:login_exec_t
/bin/sh                         system_u:object_r:bin_t -> system_u:object_r:shell_exec_t
/sbin/init                      system_u:object_r:init_exec_t
/var/lib/install/sbin/sshd      system_u:object_r:sshd_exec_t
/lib/libc.so.6                  system_u:object_r:lib_t -> system_u:object_r:shlib_t
/lib/ld-linux.so.2              system_u:object_r:lib_t -> system_u:object_r:ld_so_t

~# uname -r
2.6.12.3-omap1

-- 


"Feel free" – 10 GB Mailbox, 100 FreeSMS/Monat ...
Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re:

[Russell Coker]

On Friday 18 August 2006 05:57, selinux770@tortenboxer.de wrote:
> Within the device (when opening a console or whatever) the "Current
> context" is system_u:system_r:kernel_t. (uid=0(root) gid=0(root)
> groups=0(root) context=system_u:system_r:kernel_t) Just as many other
> (nearly all) processes, too.

Your main problem is that you don't have a SE Linux modified login program.  
There are patches floating around for kdm, xdm, and gdm, you will have to 
select whichever is appropriate for your use and build a new gdm.

Eventually we want the standard xdm programs to support SE Linux.

-- 
http://etbe.blogspot.com/          My Blog
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.