Controlling term: unknown (Operation not supported)

Controlling term: unknown (Operation not supported)

[selinux770]

Hi once again, sorry for not putting a subject into my last email. Bad start on this list. So let's start over:

I'm trying to enable SELinux on my Nokia 770 Internet Tablet which is running a modified Debian Linux for ARM processors. Until now I have replaced and installed several files and packages, but now I need further guidance. It seems like SELinux is working in some kind of way. But one main problem/question that persists is that i get a
Controlling term:               unknown (Operation not supported)
when doing a sestatus -v.

The "Current context" for user root is system_u:system_r:sshd_t when i log in via ssh.
(uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:kernel_t)

Within the device (when opening a console or whatever) the "Current context" is system_u:system_r:kernel_t.
(uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:kernel_t)
Just as many other (nearly all) processes, too.

So my questions:
1. What is the controlling term in sestatus for? What does it mean if it's unknown and how bad is this problem?
2. Are the wrong contexts of users a policy based problem or are they derived by the problem with the controlling term (or even orthers)? I need to know this since I changed much on the device for SELinux and now I'm not sure if I should continue searching missing functionalities within the system or searching for errors in the policy or file labelling.

If you need any more information feel free to ask.

Thanks in advance
Roland Bender

Further information:
~# sestatus -v
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 19
Policy from config file:        .

Process contexts:
Current context:                system_u:system_r:sshd_t
Init context:                   system_u:system_r:init_t

File contexts:
Controlling term:               unknown (Operation not supported)
/etc/passwd                     system_u:object_r:etc_t
/etc/shadow                     system_u:object_r:shadow_t
/bin/bash                       system_u:object_r:shell_exec_t -> system_u:object_r:shell_exec_t
/bin/login                      system_u:object_r:login_exec_t
/bin/sh                         system_u:object_r:bin_t -> system_u:object_r:shell_exec_t
/sbin/init                      system_u:object_r:init_exec_t
/var/lib/install/sbin/sshd      system_u:object_r:sshd_exec_t
/lib/libc.so.6                  system_u:object_r:lib_t -> system_u:object_r:shlib_t
/lib/ld-linux.so.2              system_u:object_r:lib_t -> system_u:object_r:ld_so_t

~# uname -r
2.6.12.3-omap1
-- 


Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Controlling term: unknown (Operation not supported)

[Stephen Smalley]

On Thu, 2006-08-17 at 22:13 +0200, selinux770@tortenboxer.de wrote:
> Hi once again, sorry for not putting a subject into my last email. Bad start on this list. So let's start over:
> 
> I'm trying to enable SELinux on my Nokia 770 Internet Tablet which is running a modified Debian Linux for ARM processors. Until now I have replaced and installed several files and packages, but now I need further guidance. It seems like SELinux is working in some kind of way. But one main problem/question that persists is that i get a
> Controlling term:               unknown (Operation not supported)
> when doing a sestatus -v.

Means that there is no tty/pty or it doesn't support getxattr for some
reason.  Normal output would be something like:
Controlling term:               root:object_r:secadm_devpts_t:SystemLow

What does 'tty' show?  What does 'ls -Z `tty`' show?

> The "Current context" for user root is system_u:system_r:sshd_t when i log in via ssh.
> (uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:kernel_t)

sshd_t or kernel_t (you have two different results above)?
sshd_t means that sshd never transitioned out of its context into the
user's context.  Does your sshd include the SELinux changes?

> Within the device (when opening a console or whatever) the "Current context" is system_u:system_r:kernel_t.
> (uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:kernel_t)
> Just as many other (nearly all) processes, too.

Initial task starts life in kernel_t, then transitions to init_t upon
executing /sbin/init (if labeled init_exec_t).  Then everything
transitions from there.  Possibly /sbin/init wasn't labeled when you
booted?

> So my questions:
> 1. What is the controlling term in sestatus for? What does it mean if it's unknown and how bad is this problem?
> 2. Are the wrong contexts of users a policy based problem or are they derived by the problem with the controlling term (or even orthers)? I need to know this since I changed much on the device for SELinux and now I'm not sure if I should continue searching missing functionalities within the system or searching for errors in the policy or file labelling.

I don't think they are related.

> Process contexts:
> Current context:                system_u:system_r:sshd_t
> Init context:                   system_u:system_r:init_t

This one is surprising; if init made it into init_t, nothing should be
in kernel_t other than kernel threads.  Unless you told it to re-exec
via telinit after setting its file label.  Which would only fix it and
not all of its descendants, so reboot required.

> /var/lib/install/sbin/sshd      system_u:object_r:sshd_exec_t

That's a strange location.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.