load_policy() with upstart on mint 9 fluxbox

load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

I admit it, I'm a total newb at this upstart thing, anyways
I installed all the packages for mint 9 fluxbox, but the policy
is not loading during boot
what/where might I look to read up on this, so I can get the policy 
loaded at boot...

Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

I admit it, I'm a total newb at this upstart thing, anyways
I installed all the packages for mint 9 fluxbox, but the policy
is not loading during boot
what/where might I look to read up on this, so I can get the policy 
loaded at boot...

Justin P. Mattock

Re: load_policy() with upstart on mint 9 fluxbox

[Serge E. Hallyn]

Quoting Justin P. Mattock (justinmattock@gmail.com):
> I admit it, I'm a total newb at this upstart thing, anyways
> I installed all the packages for mint 9 fluxbox, but the policy
> is not loading during boot
> what/where might I look to read up on this, so I can get the policy
> loaded at boot...

iiuc that should happen in initrd, before upstart is running.

man initramfs-tools for some info on how to tweak your initrd.

-serge

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/19/2010 06:54 PM, Serge E. Hallyn wrote:
> Quoting Justin P. Mattock (justinmattock@gmail.com):
>> I admit it, I'm a total newb at this upstart thing, anyways
>> I installed all the packages for mint 9 fluxbox, but the policy
>> is not loading during boot
>> what/where might I look to read up on this, so I can get the policy
>> loaded at boot...
>
> iiuc that should happen in initrd, before upstart is running.
>
> man initramfs-tools for some info on how to tweak your initrd.
>
> -serge
>


ahh.. no wonder this is not loading(but could be wrong), i.e. I dont 
have initramfs for the kernel im using, just make, make install..

Thanks for the info on this, I'll look at the man page

Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/19/2010 06:54 PM, Serge E. Hallyn wrote:
> Quoting Justin P. Mattock (justinmattock at gmail.com):
>> I admit it, I'm a total newb at this upstart thing, anyways
>> I installed all the packages for mint 9 fluxbox, but the policy
>> is not loading during boot
>> what/where might I look to read up on this, so I can get the policy
>> loaded at boot...
>
> iiuc that should happen in initrd, before upstart is running.
>
> man initramfs-tools for some info on how to tweak your initrd.
>
> -serge
>


ahh.. no wonder this is not loading(but could be wrong), i.e. I dont 
have initramfs for the kernel im using, just make, make install..

Thanks for the info on this, I'll look at the man page

Justin P. Mattock

Re: load_policy() with upstart on mint 9 fluxbox

alright... maybe I have an older version of upstart or something, cause 
I finally got the image thing made and booted, and still nothing.

upstart version is 0.6.5-7

will look at what opensuse does, since I did not have to build initramfs
kernel, in order for the policy to load.

Justin P. Mattock


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

alright... maybe I have an older version of upstart or something, cause 
I finally got the image thing made and booted, and still nothing.

upstart version is 0.6.5-7

will look at what opensuse does, since I did not have to build initramfs
kernel, in order for the policy to load.

Justin P. Mattock

Re: load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

o.k. I think I found the problem with this.. selinuxfs is not being 
mounted during boot to  /selinux (I manually had to mount and 
load_policy), even an entry i fstab is being ignored.
(probably why initrd isnt working).

Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

o.k. I think I found the problem with this.. selinuxfs is not being 
mounted during boot to  /selinux (I manually had to mount and 
load_policy), even an entry i fstab is being ignored.
(probably why initrd isnt working).

Justin P. Mattock

Re: load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

o.k. finally connected the dots that I needed to create a initrd.img
in order for this to load(im a total newbie!!)

Anyways the policy loads everything went in and am now in full
enforcement mode.. only real issue is with lxde
same bug here:
https://bugzilla.redhat.com/show_bug.cgi?id=552885

seems lxde is in /usr/sbin reason probably for the wrong filelabel..

Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

o.k. finally connected the dots that I needed to create a initrd.img
in order for this to load(im a total newbie!!)

Anyways the policy loads everything went in and am now in full
enforcement mode.. only real issue is with lxde
same bug here:
https://bugzilla.redhat.com/show_bug.cgi?id=552885

seems lxde is in /usr/sbin reason probably for the wrong filelabel..

Justin P. Mattock

Re: load_policy() with upstart on mint 9 fluxbox

[Serge E. Hallyn]

Quoting Justin P. Mattock (justinmattock@gmail.com):
> o.k. finally connected the dots that I needed to create a initrd.img
> in order for this to load(im a total newbie!!)
> 
> Anyways the policy loads everything went in and am now in full
> enforcement mode.. only real issue is with lxde
> same bug here:
> https://bugzilla.redhat.com/show_bug.cgi?id=552885
> 
> seems lxde is in /usr/sbin reason probably for the wrong filelabel..

Cool, so does following the steps outlined in that bug make it
work for you?

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
> Quoting Justin P. Mattock (justinmattock@gmail.com):
>> o.k. finally connected the dots that I needed to create a initrd.img
>> in order for this to load(im a total newbie!!)
>>
>> Anyways the policy loads everything went in and am now in full
>> enforcement mode.. only real issue is with lxde
>> same bug here:
>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>
>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>
> Cool, so does following the steps outlined in that bug make it
> work for you?
>

What I normally have is /boot/System.map-* and vmlinuz-* to load the 
kernel.. Seems sysvinit knows how to take things there and load_policy()

for upstart whatever it's doing(like what you said) needs to go through
initrd. Yesterday I though thats what I had done with:
fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image 
kernel_headers

but missed one last step:
mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
then after doing this everything loaded as is..

Note: guess this is whats being called to do all of this:
/usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy

As for the file labels in /var/run seems most of the files in there are 
labeled with initrc_t (keep in mind I chose debian as the distro in 
build.conf, so maybe this is why)..

As for lxde, before using chcon I was getting a login context of 
name:staff_r:netutils_t:s0 then after relabeling those files:

(chcon to this context like the bug report had shown)
system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
system_u:object_r:xdm_var_run_t:s0 lxdm.pid

I login with the proper context that I chose:
name:staff_r:staff_t:s0

Right now I think everything is running o.k. on this operating system..
(nice,small, and functional..with a touch of SELinux on top...)

Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
> Quoting Justin P. Mattock (justinmattock at gmail.com):
>> o.k. finally connected the dots that I needed to create a initrd.img
>> in order for this to load(im a total newbie!!)
>>
>> Anyways the policy loads everything went in and am now in full
>> enforcement mode.. only real issue is with lxde
>> same bug here:
>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>
>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>
> Cool, so does following the steps outlined in that bug make it
> work for you?
>

What I normally have is /boot/System.map-* and vmlinuz-* to load the 
kernel.. Seems sysvinit knows how to take things there and load_policy()

for upstart whatever it's doing(like what you said) needs to go through
initrd. Yesterday I though thats what I had done with:
fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image 
kernel_headers

but missed one last step:
mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
then after doing this everything loaded as is..

Note: guess this is whats being called to do all of this:
/usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy

As for the file labels in /var/run seems most of the files in there are 
labeled with initrc_t (keep in mind I chose debian as the distro in 
build.conf, so maybe this is why)..

As for lxde, before using chcon I was getting a login context of 
name:staff_r:netutils_t:s0 then after relabeling those files:

(chcon to this context like the bug report had shown)
system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
system_u:object_r:xdm_var_run_t:s0 lxdm.pid

I login with the proper context that I chose:
name:staff_r:staff_t:s0

Right now I think everything is running o.k. on this operating system..
(nice,small, and functional..with a touch of SELinux on top...)

Justin P. Mattock

Re: load_policy() with upstart on mint 9 fluxbox

[Shaz]

On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
<justinmattock@gmail.com> wrote:
> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>>
>> Quoting Justin P. Mattock (justinmattock@gmail.com):
>>>
>>> o.k. finally connected the dots that I needed to create a initrd.img
>>> in order for this to load(im a total newbie!!)
>>>
>>> Anyways the policy loads everything went in and am now in full
>>> enforcement mode.. only real issue is with lxde
>>> same bug here:
>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>>
>>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>>
>> Cool, so does following the steps outlined in that bug make it
>> work for you?
>>
>
> What I normally have is /boot/System.map-* and vmlinuz-* to load the
> kernel.. Seems sysvinit knows how to take things there and load_policy()
>
> for upstart whatever it's doing(like what you said) needs to go through
> initrd. Yesterday I though thats what I had done with:
> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
> kernel_headers
>
> but missed one last step:
> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
> then after doing this everything loaded as is..
>
> Note: guess this is whats being called to do all of this:
> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>
> As for the file labels in /var/run seems most of the files in there are
> labeled with initrc_t (keep in mind I chose debian as the distro in
> build.conf, so maybe this is why)..
>
> As for lxde, before using chcon I was getting a login context of
> name:staff_r:netutils_t:s0 then after relabeling those files:
>
> (chcon to this context like the bug report had shown)
> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>
> I login with the proper context that I chose:
> name:staff_r:staff_t:s0
>
> Right now I think everything is running o.k. on this operating system..
> (nice,small, and functional..with a touch of SELinux on top...)

Dear Justin,

"initrd" helps to load selinux and label "init" so that transitions
can take effect. Be it upstart or sysvinit!

If this is not done then all your processes will be loaded with
unconfined_t. Rest of the details you are considering should not
matter and they might be confusing if you tried to load selinux with
experimentation rather then proper bootstrap through initrd.

Hope this helps.

-- 
Shahbaz Khan
Assit. R&D Engineer,
SERG, IM|Sciences.

http://shazkhan.wordpress.com/
http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49
http://imsciences.edu.pk/serg/
http://csrdu.org/

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Shaz]

On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
<justinmattock@gmail.com> wrote:
> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>>
>> Quoting Justin P. Mattock (justinmattock at gmail.com):
>>>
>>> o.k. finally connected the dots that I needed to create a initrd.img
>>> in order for this to load(im a total newbie!!)
>>>
>>> Anyways the policy loads everything went in and am now in full
>>> enforcement mode.. only real issue is with lxde
>>> same bug here:
>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>>
>>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>>
>> Cool, so does following the steps outlined in that bug make it
>> work for you?
>>
>
> What I normally have is /boot/System.map-* and vmlinuz-* to load the
> kernel.. Seems sysvinit knows how to take things there and load_policy()
>
> for upstart whatever it's doing(like what you said) needs to go through
> initrd. Yesterday I though thats what I had done with:
> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
> kernel_headers
>
> but missed one last step:
> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
> then after doing this everything loaded as is..
>
> Note: guess this is whats being called to do all of this:
> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>
> As for the file labels in /var/run seems most of the files in there are
> labeled with initrc_t (keep in mind I chose debian as the distro in
> build.conf, so maybe this is why)..
>
> As for lxde, before using chcon I was getting a login context of
> name:staff_r:netutils_t:s0 then after relabeling those files:
>
> (chcon to this context like the bug report had shown)
> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>
> I login with the proper context that I chose:
> name:staff_r:staff_t:s0
>
> Right now I think everything is running o.k. on this operating system..
> (nice,small, and functional..with a touch of SELinux on top...)

Dear Justin,

"initrd" helps to load selinux and label "init" so that transitions
can take effect. Be it upstart or sysvinit!

If this is not done then all your processes will be loaded with
unconfined_t. Rest of the details you are considering should not
matter and they might be confusing if you tried to load selinux with
experimentation rather then proper bootstrap through initrd.

Hope this helps.

-- 
Shahbaz Khan
Assit. R&D Engineer,
SERG, IM|Sciences.

http://shazkhan.wordpress.com/
http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49
http://imsciences.edu.pk/serg/
http://csrdu.org/

Re: load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/20/2010 11:26 PM, Shaz wrote:
> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
> <justinmattock@gmail.com>  wrote:
>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>>>
>>> Quoting Justin P. Mattock (justinmattock@gmail.com):
>>>>
>>>> o.k. finally connected the dots that I needed to create a initrd.img
>>>> in order for this to load(im a total newbie!!)
>>>>
>>>> Anyways the policy loads everything went in and am now in full
>>>> enforcement mode.. only real issue is with lxde
>>>> same bug here:
>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>>>
>>>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>>>
>>> Cool, so does following the steps outlined in that bug make it
>>> work for you?
>>>
>>
>> What I normally have is /boot/System.map-* and vmlinuz-* to load the
>> kernel.. Seems sysvinit knows how to take things there and load_policy()
>>
>> for upstart whatever it's doing(like what you said) needs to go through
>> initrd. Yesterday I though thats what I had done with:
>> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
>> kernel_headers
>>
>> but missed one last step:
>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>> then after doing this everything loaded as is..
>>
>> Note: guess this is whats being called to do all of this:
>> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>>
>> As for the file labels in /var/run seems most of the files in there are
>> labeled with initrc_t (keep in mind I chose debian as the distro in
>> build.conf, so maybe this is why)..
>>
>> As for lxde, before using chcon I was getting a login context of
>> name:staff_r:netutils_t:s0 then after relabeling those files:
>>
>> (chcon to this context like the bug report had shown)
>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>>
>> I login with the proper context that I chose:
>> name:staff_r:staff_t:s0
>>
>> Right now I think everything is running o.k. on this operating system..
>> (nice,small, and functional..with a touch of SELinux on top...)
>
> Dear Justin,
>
> "initrd" helps to load selinux and label "init" so that transitions
> can take effect. Be it upstart or sysvinit!
>
> If this is not done then all your processes will be loaded with
> unconfined_t. Rest of the details you are considering should not
> matter and they might be confusing if you tried to load selinux with
> experimentation rather then proper bootstrap through initrd.
>
> Hope this helps.
>

well my other machines do not use an initrd image file in /boot only 
System.map and vmlinuz(I guess doing make, make install for the kernel 
is a bit outdated these days)..

Anyways sysvinit always loaded the policy just fine and had the 
processes correct, as for upstart seems I needed to do the whole 
make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather 
keep it more simpler).

Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/20/2010 11:26 PM, Shaz wrote:
> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
> <justinmattock@gmail.com>  wrote:
>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>>>
>>> Quoting Justin P. Mattock (justinmattock at gmail.com):
>>>>
>>>> o.k. finally connected the dots that I needed to create a initrd.img
>>>> in order for this to load(im a total newbie!!)
>>>>
>>>> Anyways the policy loads everything went in and am now in full
>>>> enforcement mode.. only real issue is with lxde
>>>> same bug here:
>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>>>
>>>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>>>
>>> Cool, so does following the steps outlined in that bug make it
>>> work for you?
>>>
>>
>> What I normally have is /boot/System.map-* and vmlinuz-* to load the
>> kernel.. Seems sysvinit knows how to take things there and load_policy()
>>
>> for upstart whatever it's doing(like what you said) needs to go through
>> initrd. Yesterday I though thats what I had done with:
>> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
>> kernel_headers
>>
>> but missed one last step:
>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>> then after doing this everything loaded as is..
>>
>> Note: guess this is whats being called to do all of this:
>> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>>
>> As for the file labels in /var/run seems most of the files in there are
>> labeled with initrc_t (keep in mind I chose debian as the distro in
>> build.conf, so maybe this is why)..
>>
>> As for lxde, before using chcon I was getting a login context of
>> name:staff_r:netutils_t:s0 then after relabeling those files:
>>
>> (chcon to this context like the bug report had shown)
>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>>
>> I login with the proper context that I chose:
>> name:staff_r:staff_t:s0
>>
>> Right now I think everything is running o.k. on this operating system..
>> (nice,small, and functional..with a touch of SELinux on top...)
>
> Dear Justin,
>
> "initrd" helps to load selinux and label "init" so that transitions
> can take effect. Be it upstart or sysvinit!
>
> If this is not done then all your processes will be loaded with
> unconfined_t. Rest of the details you are considering should not
> matter and they might be confusing if you tried to load selinux with
> experimentation rather then proper bootstrap through initrd.
>
> Hope this helps.
>

well my other machines do not use an initrd image file in /boot only 
System.map and vmlinuz(I guess doing make, make install for the kernel 
is a bit outdated these days)..

Anyways sysvinit always loaded the policy just fine and had the 
processes correct, as for upstart seems I needed to do the whole 
make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather 
keep it more simpler).

Justin P. Mattock

Re: load_policy() with upstart on mint 9 fluxbox

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 3610 bytes --]

On Thu, Oct 21, 2010 at 11:48 AM, Justin P. Mattock <justinmattock@gmail.com>
wrote:
> On 10/20/2010 11:26 PM, Shaz wrote:
>>
>> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
>> <justinmattock@gmail.com>  wrote:
>>>
>>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>>>>
>>>> Quoting Justin P. Mattock (justinmattock@gmail.com):
>>>>>
>>>>> o.k. finally connected the dots that I needed to create a initrd.img
>>>>> in order for this to load(im a total newbie!!)
>>>>>
>>>>> Anyways the policy loads everything went in and am now in full
>>>>> enforcement mode.. only real issue is with lxde
>>>>> same bug here:
>>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>>>>
>>>>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>>>>
>>>> Cool, so does following the steps outlined in that bug make it
>>>> work for you?
>>>>
>>>
>>> What I normally have is /boot/System.map-* and vmlinuz-* to load the
>>> kernel.. Seems sysvinit knows how to take things there and load_policy()
>>>


>>> for upstart whatever it's doing(like what you said) needs to go through
>>> initrd. Yesterday I though thats what I had done with:
>>> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
>>> kernel_headers
>>>
>>> but missed one last step:
>>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>>> then after doing this everything loaded as is..
>>>
>>> Note: guess this is whats being called to do all of this:
>>> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>>>
>>> As for the file labels in /var/run seems most of the files in there are
>>> labeled with initrc_t (keep in mind I chose debian as the distro in
>>> build.conf, so maybe this is why)..
>>>
>>> As for lxde, before using chcon I was getting a login context of
>>> name:staff_r:netutils_t:s0 then after relabeling those files:
>>>
>>> (chcon to this context like the bug report had shown)
>>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>>>
>>> I login with the proper context that I chose:
>>> name:staff_r:staff_t:s0
>>>
>>> Right now I think everything is running o.k. on this operating system..
>>> (nice,small, and functional..with a touch of SELinux on top...)
>>
>> Dear Justin,
>>
>> "initrd" helps to load selinux and label "init" so that transitions
>> can take effect. Be it upstart or sysvinit!
>>
>> If this is not done then all your processes will be loaded with
>> unconfined_t. Rest of the details you are considering should not
>> matter and they might be confusing if you tried to load selinux with
>> experimentation rather then proper bootstrap through initrd.
>>
>> Hope this helps.
>>
>
> well my other machines do not use an initrd image file in /boot only
> System.map and vmlinuz(I guess doing make, make install for the kernel is
a
> bit outdated these days)..
>
> Anyways sysvinit always loaded the policy just fine and had the processes
> correct, as for upstart seems I needed to do the whole
> make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather keep
it
> more simpler).

AFAIK without initrd your policy will not work properly as labeling is not
handled and thus the whole security objective fails. If this is possible
without an initrd then it would be init handling it by loading selinux and
restarting itself.

>
> Justin P. Mattock
>

Thanks.

-- 
Shahbaz Khan
Assit. R&D Engineer

http://shazkhan.wordpress.com/
http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49
http://imsciences.edu.pk/serg/
http://csrdu.org/

[-- Attachment #2: Type: text/html, Size: 5060 bytes --]

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Shaz]

On Thu, Oct 21, 2010 at 11:48 AM, Justin P. Mattock <justinmattock@gmail.com>
wrote:
> On 10/20/2010 11:26 PM, Shaz wrote:
>>
>> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
>> <justinmattock@gmail.com>  wrote:
>>>
>>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>>>>
>>>> Quoting Justin P. Mattock (justinmattock at gmail.com):
>>>>>
>>>>> o.k. finally connected the dots that I needed to create a initrd.img
>>>>> in order for this to load(im a total newbie!!)
>>>>>
>>>>> Anyways the policy loads everything went in and am now in full
>>>>> enforcement mode.. only real issue is with lxde
>>>>> same bug here:
>>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>>>>
>>>>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>>>>
>>>> Cool, so does following the steps outlined in that bug make it
>>>> work for you?
>>>>
>>>
>>> What I normally have is /boot/System.map-* and vmlinuz-* to load the
>>> kernel.. Seems sysvinit knows how to take things there and load_policy()
>>>


>>> for upstart whatever it's doing(like what you said) needs to go through
>>> initrd. Yesterday I though thats what I had done with:
>>> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
>>> kernel_headers
>>>
>>> but missed one last step:
>>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>>> then after doing this everything loaded as is..
>>>
>>> Note: guess this is whats being called to do all of this:
>>> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>>>
>>> As for the file labels in /var/run seems most of the files in there are
>>> labeled with initrc_t (keep in mind I chose debian as the distro in
>>> build.conf, so maybe this is why)..
>>>
>>> As for lxde, before using chcon I was getting a login context of
>>> name:staff_r:netutils_t:s0 then after relabeling those files:
>>>
>>> (chcon to this context like the bug report had shown)
>>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>>>
>>> I login with the proper context that I chose:
>>> name:staff_r:staff_t:s0
>>>
>>> Right now I think everything is running o.k. on this operating system..
>>> (nice,small, and functional..with a touch of SELinux on top...)
>>
>> Dear Justin,
>>
>> "initrd" helps to load selinux and label "init" so that transitions
>> can take effect. Be it upstart or sysvinit!
>>
>> If this is not done then all your processes will be loaded with
>> unconfined_t. Rest of the details you are considering should not
>> matter and they might be confusing if you tried to load selinux with
>> experimentation rather then proper bootstrap through initrd.
>>
>> Hope this helps.
>>
>
> well my other machines do not use an initrd image file in /boot only
> System.map and vmlinuz(I guess doing make, make install for the kernel is
a
> bit outdated these days)..
>
> Anyways sysvinit always loaded the policy just fine and had the processes
> correct, as for upstart seems I needed to do the whole
> make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather keep
it
> more simpler).

AFAIK without initrd your policy will not work properly as labeling is not
handled and thus the whole security objective fails. If this is possible
without an initrd then it would be init handling it by loading selinux and
restarting itself.

>
> Justin P. Mattock
>

Thanks.

-- 
Shahbaz Khan
Assit. R&D Engineer

http://shazkhan.wordpress.com/
http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49
http://imsciences.edu.pk/serg/
http://csrdu.org/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20101021/747fd7dd/attachment.html 

Re: load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/21/2010 12:08 AM, Shaz wrote:
>
>
> On Thu, Oct 21, 2010 at 11:48 AM, Justin P. Mattock
> <justinmattock@gmail.com <mailto:justinmattock@gmail.com>> wrote:
>  > On 10/20/2010 11:26 PM, Shaz wrote:
>  >>
>  >> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
>  >> <justinmattock@gmail.com <mailto:justinmattock@gmail.com>>  wrote:
>  >>>
>  >>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>  >>>>
>  >>>> Quoting Justin P. Mattock (justinmattock@gmail.com
> <mailto:justinmattock@gmail.com>):
>  >>>>>
>  >>>>> o.k. finally connected the dots that I needed to create a initrd.img
>  >>>>> in order for this to load(im a total newbie!!)
>  >>>>>
>  >>>>> Anyways the policy loads everything went in and am now in full
>  >>>>> enforcement mode.. only real issue is with lxde
>  >>>>> same bug here:
>  >>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>  >>>>>
>  >>>>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>  >>>>
>  >>>> Cool, so does following the steps outlined in that bug make it
>  >>>> work for you?
>  >>>>
>  >>>
>  >>> What I normally have is /boot/System.map-* and vmlinuz-* to load the
>  >>> kernel.. Seems sysvinit knows how to take things there and
> load_policy()
>  >>>
>
>
>  >>> for upstart whatever it's doing(like what you said) needs to go through
>  >>> initrd. Yesterday I though thats what I had done with:
>  >>> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
>  >>> kernel_headers
>  >>>
>  >>> but missed one last step:
>  >>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>  >>> then after doing this everything loaded as is..
>  >>>
>  >>> Note: guess this is whats being called to do all of this:
>  >>> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>  >>>
>  >>> As for the file labels in /var/run seems most of the files in there are
>  >>> labeled with initrc_t (keep in mind I chose debian as the distro in
>  >>> build.conf, so maybe this is why)..
>  >>>
>  >>> As for lxde, before using chcon I was getting a login context of
>  >>> name:staff_r:netutils_t:s0 then after relabeling those files:
>  >>>
>  >>> (chcon to this context like the bug report had shown)
>  >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>  >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>  >>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>  >>>
>  >>> I login with the proper context that I chose:
>  >>> name:staff_r:staff_t:s0
>  >>>
>  >>> Right now I think everything is running o.k. on this operating system..
>  >>> (nice,small, and functional..with a touch of SELinux on top...)
>  >>
>  >> Dear Justin,
>  >>
>  >> "initrd" helps to load selinux and label "init" so that transitions
>  >> can take effect. Be it upstart or sysvinit!
>  >>
>  >> If this is not done then all your processes will be loaded with
>  >> unconfined_t. Rest of the details you are considering should not
>  >> matter and they might be confusing if you tried to load selinux with
>  >> experimentation rather then proper bootstrap through initrd.
>  >>
>  >> Hope this helps.
>  >>
>  >
>  > well my other machines do not use an initrd image file in /boot only
>  > System.map and vmlinuz(I guess doing make, make install for the
> kernel is a
>  > bit outdated these days)..
>  >
>  > Anyways sysvinit always loaded the policy just fine and had the processes
>  > correct, as for upstart seems I needed to do the whole
>  > make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather
> keep it
>  > more simpler).
>
> AFAIK without initrd your policy will not work properly as labeling is
> not handled and thus the whole security objective fails. If this is
> possible without an initrd then it would be init handling it by loading
> selinux and restarting itself.

pretty much what I use over here..(make bisecting easier since I dont 
have to deal with the hundreds of vmlinuz tags, just one that gets 
written over)

Now the question(I guess)is, is how/why is upstart not _realizing_ this 
is a system without initrd lets go over here and get the system started?
(id imagine the code might have if then/else or something..)

Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/21/2010 12:08 AM, Shaz wrote:
>
>
> On Thu, Oct 21, 2010 at 11:48 AM, Justin P. Mattock
> <justinmattock at gmail.com <mailto:justinmattock@gmail.com>> wrote:
>  > On 10/20/2010 11:26 PM, Shaz wrote:
>  >>
>  >> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
>  >> <justinmattock at gmail.com <mailto:justinmattock@gmail.com>>  wrote:
>  >>>
>  >>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>  >>>>
>  >>>> Quoting Justin P. Mattock (justinmattock at gmail.com
> <mailto:justinmattock@gmail.com>):
>  >>>>>
>  >>>>> o.k. finally connected the dots that I needed to create a initrd.img
>  >>>>> in order for this to load(im a total newbie!!)
>  >>>>>
>  >>>>> Anyways the policy loads everything went in and am now in full
>  >>>>> enforcement mode.. only real issue is with lxde
>  >>>>> same bug here:
>  >>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>  >>>>>
>  >>>>> seems lxde is in /usr/sbin reason probably for the wrong filelabel..
>  >>>>
>  >>>> Cool, so does following the steps outlined in that bug make it
>  >>>> work for you?
>  >>>>
>  >>>
>  >>> What I normally have is /boot/System.map-* and vmlinuz-* to load the
>  >>> kernel.. Seems sysvinit knows how to take things there and
> load_policy()
>  >>>
>
>
>  >>> for upstart whatever it's doing(like what you said) needs to go through
>  >>> initrd. Yesterday I though thats what I had done with:
>  >>> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
>  >>> kernel_headers
>  >>>
>  >>> but missed one last step:
>  >>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>  >>> then after doing this everything loaded as is..
>  >>>
>  >>> Note: guess this is whats being called to do all of this:
>  >>> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>  >>>
>  >>> As for the file labels in /var/run seems most of the files in there are
>  >>> labeled with initrc_t (keep in mind I chose debian as the distro in
>  >>> build.conf, so maybe this is why)..
>  >>>
>  >>> As for lxde, before using chcon I was getting a login context of
>  >>> name:staff_r:netutils_t:s0 then after relabeling those files:
>  >>>
>  >>> (chcon to this context like the bug report had shown)
>  >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>  >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>  >>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>  >>>
>  >>> I login with the proper context that I chose:
>  >>> name:staff_r:staff_t:s0
>  >>>
>  >>> Right now I think everything is running o.k. on this operating system..
>  >>> (nice,small, and functional..with a touch of SELinux on top...)
>  >>
>  >> Dear Justin,
>  >>
>  >> "initrd" helps to load selinux and label "init" so that transitions
>  >> can take effect. Be it upstart or sysvinit!
>  >>
>  >> If this is not done then all your processes will be loaded with
>  >> unconfined_t. Rest of the details you are considering should not
>  >> matter and they might be confusing if you tried to load selinux with
>  >> experimentation rather then proper bootstrap through initrd.
>  >>
>  >> Hope this helps.
>  >>
>  >
>  > well my other machines do not use an initrd image file in /boot only
>  > System.map and vmlinuz(I guess doing make, make install for the
> kernel is a
>  > bit outdated these days)..
>  >
>  > Anyways sysvinit always loaded the policy just fine and had the processes
>  > correct, as for upstart seems I needed to do the whole
>  > make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather
> keep it
>  > more simpler).
>
> AFAIK without initrd your policy will not work properly as labeling is
> not handled and thus the whole security objective fails. If this is
> possible without an initrd then it would be init handling it by loading
> selinux and restarting itself.

pretty much what I use over here..(make bisecting easier since I dont 
have to deal with the hundreds of vmlinuz tags, just one that gets 
written over)

Now the question(I guess)is, is how/why is upstart not _realizing_ this 
is a system without initrd lets go over here and get the system started?
(id imagine the code might have if then/else or something..)

Justin P. Mattock

Re: load_policy() with upstart on mint 9 fluxbox

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 4781 bytes --]

On Thu, Oct 21, 2010 at 6:40 PM, Justin P. Mattock
<justinmattock@gmail.com>wrote:

> On 10/21/2010 12:08 AM, Shaz wrote:
>
>>
>>
>> On Thu, Oct 21, 2010 at 11:48 AM, Justin P. Mattock
>> <justinmattock@gmail.com <mailto:justinmattock@gmail.com>> wrote:
>>  > On 10/20/2010 11:26 PM, Shaz wrote:
>>  >>
>>  >> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
>>  >> <justinmattock@gmail.com <mailto:justinmattock@gmail.com>>  wrote:
>>
>>  >>>
>>  >>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>>  >>>>
>>  >>>> Quoting Justin P. Mattock (justinmattock@gmail.com
>> <mailto:justinmattock@gmail.com>):
>>
>>  >>>>>
>>  >>>>> o.k. finally connected the dots that I needed to create a
>> initrd.img
>>  >>>>> in order for this to load(im a total newbie!!)
>>  >>>>>
>>  >>>>> Anyways the policy loads everything went in and am now in full
>>  >>>>> enforcement mode.. only real issue is with lxde
>>  >>>>> same bug here:
>>  >>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>  >>>>>
>>  >>>>> seems lxde is in /usr/sbin reason probably for the wrong
>> filelabel..
>>  >>>>
>>  >>>> Cool, so does following the steps outlined in that bug make it
>>  >>>> work for you?
>>  >>>>
>>  >>>
>>  >>> What I normally have is /boot/System.map-* and vmlinuz-* to load the
>>  >>> kernel.. Seems sysvinit knows how to take things there and
>> load_policy()
>>  >>>
>>
>>
>>  >>> for upstart whatever it's doing(like what you said) needs to go
>> through
>>  >>> initrd. Yesterday I though thats what I had done with:
>>  >>> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
>>  >>> kernel_headers
>>  >>>
>>  >>> but missed one last step:
>>  >>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>>  >>> then after doing this everything loaded as is..
>>  >>>
>>  >>> Note: guess this is whats being called to do all of this:
>>  >>> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>>  >>>
>>  >>> As for the file labels in /var/run seems most of the files in there
>> are
>>  >>> labeled with initrc_t (keep in mind I chose debian as the distro in
>>  >>> build.conf, so maybe this is why)..
>>  >>>
>>  >>> As for lxde, before using chcon I was getting a login context of
>>  >>> name:staff_r:netutils_t:s0 then after relabeling those files:
>>  >>>
>>  >>> (chcon to this context like the bug report had shown)
>>  >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>>  >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>>  >>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>>  >>>
>>  >>> I login with the proper context that I chose:
>>  >>> name:staff_r:staff_t:s0
>>  >>>
>>  >>> Right now I think everything is running o.k. on this operating
>> system..
>>  >>> (nice,small, and functional..with a touch of SELinux on top...)
>>  >>
>>  >> Dear Justin,
>>  >>
>>  >> "initrd" helps to load selinux and label "init" so that transitions
>>  >> can take effect. Be it upstart or sysvinit!
>>  >>
>>  >> If this is not done then all your processes will be loaded with
>>  >> unconfined_t. Rest of the details you are considering should not
>>  >> matter and they might be confusing if you tried to load selinux with
>>  >> experimentation rather then proper bootstrap through initrd.
>>  >>
>>  >> Hope this helps.
>>  >>
>>  >
>>  > well my other machines do not use an initrd image file in /boot only
>>  > System.map and vmlinuz(I guess doing make, make install for the
>> kernel is a
>>  > bit outdated these days)..
>>  >
>>  > Anyways sysvinit always loaded the policy just fine and had the
>> processes
>>  > correct, as for upstart seems I needed to do the whole
>>  > make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather
>> keep it
>>  > more simpler).
>>
>> AFAIK without initrd your policy will not work properly as labeling is
>> not handled and thus the whole security objective fails. If this is
>> possible without an initrd then it would be init handling it by loading
>> selinux and restarting itself.
>>
>
> pretty much what I use over here..(make bisecting easier since I dont have
> to deal with the hundreds of vmlinuz tags, just one that gets written over)
>
> Now the question(I guess)is, is how/why is upstart not _realizing_ this is
> a system without initrd lets go over here and get the system started?
> (id imagine the code might have if then/else or something..)
>

Why do you expect Upstart or init to know if initrd was used or not? Is this
a feature that upstart should handle? I guess not because initrd is used for
early drivers and configuration before the rootfs can be utilized properly.

-- 
Shahbaz Khan
Assist. R&D Engineer

http://shazkhan.wordpress.com/
http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49
http://imsciences.edu.pk/serg/
http://csrdu.org/

[-- Attachment #2: Type: text/html, Size: 6996 bytes --]

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Shaz]

On Thu, Oct 21, 2010 at 6:40 PM, Justin P. Mattock
<justinmattock@gmail.com>wrote:

> On 10/21/2010 12:08 AM, Shaz wrote:
>
>>
>>
>> On Thu, Oct 21, 2010 at 11:48 AM, Justin P. Mattock
>> <justinmattock at gmail.com <mailto:justinmattock@gmail.com>> wrote:
>>  > On 10/20/2010 11:26 PM, Shaz wrote:
>>  >>
>>  >> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
>>  >> <justinmattock at gmail.com <mailto:justinmattock@gmail.com>>  wrote:
>>
>>  >>>
>>  >>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>>  >>>>
>>  >>>> Quoting Justin P. Mattock (justinmattock at gmail.com
>> <mailto:justinmattock@gmail.com>):
>>
>>  >>>>>
>>  >>>>> o.k. finally connected the dots that I needed to create a
>> initrd.img
>>  >>>>> in order for this to load(im a total newbie!!)
>>  >>>>>
>>  >>>>> Anyways the policy loads everything went in and am now in full
>>  >>>>> enforcement mode.. only real issue is with lxde
>>  >>>>> same bug here:
>>  >>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>>  >>>>>
>>  >>>>> seems lxde is in /usr/sbin reason probably for the wrong
>> filelabel..
>>  >>>>
>>  >>>> Cool, so does following the steps outlined in that bug make it
>>  >>>> work for you?
>>  >>>>
>>  >>>
>>  >>> What I normally have is /boot/System.map-* and vmlinuz-* to load the
>>  >>> kernel.. Seems sysvinit knows how to take things there and
>> load_policy()
>>  >>>
>>
>>
>>  >>> for upstart whatever it's doing(like what you said) needs to go
>> through
>>  >>> initrd. Yesterday I though thats what I had done with:
>>  >>> fakeroot make-kpkg --initrd --append-to-version=-custom kernel_image
>>  >>> kernel_headers
>>  >>>
>>  >>> but missed one last step:
>>  >>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>>  >>> then after doing this everything loaded as is..
>>  >>>
>>  >>> Note: guess this is whats being called to do all of this:
>>  >>> /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>>  >>>
>>  >>> As for the file labels in /var/run seems most of the files in there
>> are
>>  >>> labeled with initrc_t (keep in mind I chose debian as the distro in
>>  >>> build.conf, so maybe this is why)..
>>  >>>
>>  >>> As for lxde, before using chcon I was getting a login context of
>>  >>> name:staff_r:netutils_t:s0 then after relabeling those files:
>>  >>>
>>  >>> (chcon to this context like the bug report had shown)
>>  >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>>  >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>>  >>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>>  >>>
>>  >>> I login with the proper context that I chose:
>>  >>> name:staff_r:staff_t:s0
>>  >>>
>>  >>> Right now I think everything is running o.k. on this operating
>> system..
>>  >>> (nice,small, and functional..with a touch of SELinux on top...)
>>  >>
>>  >> Dear Justin,
>>  >>
>>  >> "initrd" helps to load selinux and label "init" so that transitions
>>  >> can take effect. Be it upstart or sysvinit!
>>  >>
>>  >> If this is not done then all your processes will be loaded with
>>  >> unconfined_t. Rest of the details you are considering should not
>>  >> matter and they might be confusing if you tried to load selinux with
>>  >> experimentation rather then proper bootstrap through initrd.
>>  >>
>>  >> Hope this helps.
>>  >>
>>  >
>>  > well my other machines do not use an initrd image file in /boot only
>>  > System.map and vmlinuz(I guess doing make, make install for the
>> kernel is a
>>  > bit outdated these days)..
>>  >
>>  > Anyways sysvinit always loaded the policy just fine and had the
>> processes
>>  > correct, as for upstart seems I needed to do the whole
>>  > make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would rather
>> keep it
>>  > more simpler).
>>
>> AFAIK without initrd your policy will not work properly as labeling is
>> not handled and thus the whole security objective fails. If this is
>> possible without an initrd then it would be init handling it by loading
>> selinux and restarting itself.
>>
>
> pretty much what I use over here..(make bisecting easier since I dont have
> to deal with the hundreds of vmlinuz tags, just one that gets written over)
>
> Now the question(I guess)is, is how/why is upstart not _realizing_ this is
> a system without initrd lets go over here and get the system started?
> (id imagine the code might have if then/else or something..)
>

Why do you expect Upstart or init to know if initrd was used or not? Is this
a feature that upstart should handle? I guess not because initrd is used for
early drivers and configuration before the rootfs can be utilized properly.

-- 
Shahbaz Khan
Assist. R&D Engineer

http://shazkhan.wordpress.com/
http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49
http://imsciences.edu.pk/serg/
http://csrdu.org/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20101021/ec72df64/attachment.html 

Re: load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/21/2010 07:36 AM, Shaz wrote:
>
>
> On Thu, Oct 21, 2010 at 6:40 PM, Justin P. Mattock
> <justinmattock@gmail.com <mailto:justinmattock@gmail.com>> wrote:
>
>     On 10/21/2010 12:08 AM, Shaz wrote:
>
>
>
>         On Thu, Oct 21, 2010 at 11:48 AM, Justin P. Mattock
>         <justinmattock@gmail.com <mailto:justinmattock@gmail.com>
>         <mailto:justinmattock@gmail.com
>         <mailto:justinmattock@gmail.com>>> wrote:
>          > On 10/20/2010 11:26 PM, Shaz wrote:
>          >>
>          >> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
>          >> <justinmattock@gmail.com <mailto:justinmattock@gmail.com>
>         <mailto:justinmattock@gmail.com
>         <mailto:justinmattock@gmail.com>>>  wrote:
>
>          >>>
>          >>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>          >>>>
>          >>>> Quoting Justin P. Mattock (justinmattock@gmail.com
>         <mailto:justinmattock@gmail.com>
>         <mailto:justinmattock@gmail.com <mailto:justinmattock@gmail.com>>):
>
>          >>>>>
>          >>>>> o.k. finally connected the dots that I needed to create a
>         initrd.img
>          >>>>> in order for this to load(im a total newbie!!)
>          >>>>>
>          >>>>> Anyways the policy loads everything went in and am now in
>         full
>          >>>>> enforcement mode.. only real issue is with lxde
>          >>>>> same bug here:
>          >>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>          >>>>>
>          >>>>> seems lxde is in /usr/sbin reason probably for the wrong
>         filelabel..
>          >>>>
>          >>>> Cool, so does following the steps outlined in that bug make it
>          >>>> work for you?
>          >>>>
>          >>>
>          >>> What I normally have is /boot/System.map-* and vmlinuz-* to
>         load the
>          >>> kernel.. Seems sysvinit knows how to take things there and
>         load_policy()
>          >>>
>
>
>          >>> for upstart whatever it's doing(like what you said) needs
>         to go through
>          >>> initrd. Yesterday I though thats what I had done with:
>          >>> fakeroot make-kpkg --initrd --append-to-version=-custom
>         kernel_image
>          >>> kernel_headers
>          >>>
>          >>> but missed one last step:
>          >>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>          >>> then after doing this everything loaded as is..
>          >>>
>          >>> Note: guess this is whats being called to do all of this:
>          >>>
>         /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>          >>>
>          >>> As for the file labels in /var/run seems most of the files
>         in there are
>          >>> labeled with initrc_t (keep in mind I chose debian as the
>         distro in
>          >>> build.conf, so maybe this is why)..
>          >>>
>          >>> As for lxde, before using chcon I was getting a login
>         context of
>          >>> name:staff_r:netutils_t:s0 then after relabeling those files:
>          >>>
>          >>> (chcon to this context like the bug report had shown)
>          >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>          >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>          >>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>          >>>
>          >>> I login with the proper context that I chose:
>          >>> name:staff_r:staff_t:s0
>          >>>
>          >>> Right now I think everything is running o.k. on this
>         operating system..
>          >>> (nice,small, and functional..with a touch of SELinux on top...)
>          >>
>          >> Dear Justin,
>          >>
>          >> "initrd" helps to load selinux and label "init" so that
>         transitions
>          >> can take effect. Be it upstart or sysvinit!
>          >>
>          >> If this is not done then all your processes will be loaded with
>          >> unconfined_t. Rest of the details you are considering should not
>          >> matter and they might be confusing if you tried to load
>         selinux with
>          >> experimentation rather then proper bootstrap through initrd.
>          >>
>          >> Hope this helps.
>          >>
>          >
>          > well my other machines do not use an initrd image file in
>         /boot only
>          > System.map and vmlinuz(I guess doing make, make install for the
>         kernel is a
>          > bit outdated these days)..
>          >
>          > Anyways sysvinit always loaded the policy just fine and had
>         the processes
>          > correct, as for upstart seems I needed to do the whole
>          > make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would
>         rather
>         keep it
>          > more simpler).
>
>         AFAIK without initrd your policy will not work properly as
>         labeling is
>         not handled and thus the whole security objective fails. If this is
>         possible without an initrd then it would be init handling it by
>         loading
>         selinux and restarting itself.
>
>
>     pretty much what I use over here..(make bisecting easier since I
>     dont have to deal with the hundreds of vmlinuz tags, just one that
>     gets written over)
>
>     Now the question(I guess)is, is how/why is upstart not _realizing_
>     this is a system without initrd lets go over here and get the system
>     started?
>     (id imagine the code might have if then/else or something..)
>
>
> Why do you expect Upstart or init to know if initrd was used or not?

well, I guess it's safe to say there are people in the world who dont 
make initrd images for their system(unless Im the only one..)

Is
> this a feature that upstart should handle?

would of been nice, this way I didn't have to wast my time tracking down 
why load_policy() is not loading..(but ended up being a good learning 
experience)

  I guess not because initrd is
> used for early drivers and configuration before the rootfs can be
> utilized properly.
>

sure.. and as well as not having initrd..(like what I have over here)

Justin P. Mattock

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

[refpolicy] load_policy() with upstart on mint 9 fluxbox

[Justin P. Mattock]

On 10/21/2010 07:36 AM, Shaz wrote:
>
>
> On Thu, Oct 21, 2010 at 6:40 PM, Justin P. Mattock
> <justinmattock at gmail.com <mailto:justinmattock@gmail.com>> wrote:
>
>     On 10/21/2010 12:08 AM, Shaz wrote:
>
>
>
>         On Thu, Oct 21, 2010 at 11:48 AM, Justin P. Mattock
>         <justinmattock at gmail.com <mailto:justinmattock@gmail.com>
>         <mailto:justinmattock@gmail.com
>         <mailto:justinmattock@gmail.com>>> wrote:
>          > On 10/20/2010 11:26 PM, Shaz wrote:
>          >>
>          >> On Thu, Oct 21, 2010 at 10:15 AM, Justin P. Mattock
>          >> <justinmattock at gmail.com <mailto:justinmattock@gmail.com>
>         <mailto:justinmattock@gmail.com
>         <mailto:justinmattock@gmail.com>>>  wrote:
>
>          >>>
>          >>> On 10/20/2010 07:44 PM, Serge E. Hallyn wrote:
>          >>>>
>          >>>> Quoting Justin P. Mattock (justinmattock at gmail.com
>         <mailto:justinmattock@gmail.com>
>         <mailto:justinmattock at gmail.com <mailto:justinmattock@gmail.com>>):
>
>          >>>>>
>          >>>>> o.k. finally connected the dots that I needed to create a
>         initrd.img
>          >>>>> in order for this to load(im a total newbie!!)
>          >>>>>
>          >>>>> Anyways the policy loads everything went in and am now in
>         full
>          >>>>> enforcement mode.. only real issue is with lxde
>          >>>>> same bug here:
>          >>>>> https://bugzilla.redhat.com/show_bug.cgi?id=552885
>          >>>>>
>          >>>>> seems lxde is in /usr/sbin reason probably for the wrong
>         filelabel..
>          >>>>
>          >>>> Cool, so does following the steps outlined in that bug make it
>          >>>> work for you?
>          >>>>
>          >>>
>          >>> What I normally have is /boot/System.map-* and vmlinuz-* to
>         load the
>          >>> kernel.. Seems sysvinit knows how to take things there and
>         load_policy()
>          >>>
>
>
>          >>> for upstart whatever it's doing(like what you said) needs
>         to go through
>          >>> initrd. Yesterday I though thats what I had done with:
>          >>> fakeroot make-kpkg --initrd --append-to-version=-custom
>         kernel_image
>          >>> kernel_headers
>          >>>
>          >>> but missed one last step:
>          >>> mkinitramfs -k -o initrd.img-2.6.36-rc8-custom-00022-g2b666ca
>          >>> then after doing this everything loaded as is..
>          >>>
>          >>> Note: guess this is whats being called to do all of this:
>          >>>
>         /usr/share/initramfs-tools/scripts/init-bottom/_load_selinux_policy
>          >>>
>          >>> As for the file labels in /var/run seems most of the files
>         in there are
>          >>> labeled with initrc_t (keep in mind I chose debian as the
>         distro in
>          >>> build.conf, so maybe this is why)..
>          >>>
>          >>> As for lxde, before using chcon I was getting a login
>         context of
>          >>> name:staff_r:netutils_t:s0 then after relabeling those files:
>          >>>
>          >>> (chcon to this context like the bug report had shown)
>          >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm
>          >>> system_u:object_r:xdm_exec_t:s0 /usr/sbin/lxdm-binary
>          >>> system_u:object_r:xdm_var_run_t:s0 lxdm.pid
>          >>>
>          >>> I login with the proper context that I chose:
>          >>> name:staff_r:staff_t:s0
>          >>>
>          >>> Right now I think everything is running o.k. on this
>         operating system..
>          >>> (nice,small, and functional..with a touch of SELinux on top...)
>          >>
>          >> Dear Justin,
>          >>
>          >> "initrd" helps to load selinux and label "init" so that
>         transitions
>          >> can take effect. Be it upstart or sysvinit!
>          >>
>          >> If this is not done then all your processes will be loaded with
>          >> unconfined_t. Rest of the details you are considering should not
>          >> matter and they might be confusing if you tried to load
>         selinux with
>          >> experimentation rather then proper bootstrap through initrd.
>          >>
>          >> Hope this helps.
>          >>
>          >
>          > well my other machines do not use an initrd image file in
>         /boot only
>          > System.map and vmlinuz(I guess doing make, make install for the
>         kernel is a
>          > bit outdated these days)..
>          >
>          > Anyways sysvinit always loaded the policy just fine and had
>         the processes
>          > correct, as for upstart seems I needed to do the whole
>          > make-kpkg,dpkg,mkinitramfs thing..(which is fine... but would
>         rather
>         keep it
>          > more simpler).
>
>         AFAIK without initrd your policy will not work properly as
>         labeling is
>         not handled and thus the whole security objective fails. If this is
>         possible without an initrd then it would be init handling it by
>         loading
>         selinux and restarting itself.
>
>
>     pretty much what I use over here..(make bisecting easier since I
>     dont have to deal with the hundreds of vmlinuz tags, just one that
>     gets written over)
>
>     Now the question(I guess)is, is how/why is upstart not _realizing_
>     this is a system without initrd lets go over here and get the system
>     started?
>     (id imagine the code might have if then/else or something..)
>
>
> Why do you expect Upstart or init to know if initrd was used or not?

well, I guess it's safe to say there are people in the world who dont 
make initrd images for their system(unless Im the only one..)

Is
> this a feature that upstart should handle?

would of been nice, this way I didn't have to wast my time tracking down 
why load_policy() is not loading..(but ended up being a good learning 
experience)

  I guess not because initrd is
> used for early drivers and configuration before the rootfs can be
> utilized properly.
>

sure.. and as well as not having initrd..(like what I have over here)

Justin P. Mattock

Re: [refpolicy] load_policy() with upstart on mint 9 fluxbox

[Russell Coker]

On Fri, 22 Oct 2010, Shaz <shazalive@gmail.com> wrote:
> Why do you expect Upstart or init to know if initrd was used or not? Is
> this a feature that upstart should handle? I guess not because initrd is
> used for early drivers and configuration before the rootfs can be utilized
> properly.

/sbin/init can easily determine whether policy was already loaded, whether an 
initrd/initramfs was used isn't the relevant issue.

It's easy to load policy from /sbin/init, and as Systemd will have to have SE 
Linux support (it can't do any of it's advanced features without it) it 
wouldn't make sense to have anything other than /sbin/init load policy on a 
Systemd system.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Main Blog
http://doc.coker.com.au/           My Documents Blog

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [refpolicy] load_policy() with upstart on mint 9 fluxbox

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 1147 bytes --]

On Mon, Oct 25, 2010 at 4:39 AM, Russell Coker <russell@coker.com.au> wrote:

> On Fri, 22 Oct 2010, Shaz <shazalive@gmail.com> wrote:
> > Why do you expect Upstart or init to know if initrd was used or not? Is
> > this a feature that upstart should handle? I guess not because initrd is
> > used for early drivers and configuration before the rootfs can be
> utilized
> > properly.
>
> /sbin/init can easily determine whether policy was already loaded, whether
> an
> initrd/initramfs was used isn't the relevant issue.
>
> It's easy to load policy from /sbin/init, and as Systemd will have to have
> SE
> Linux support (it can't do any of it's advanced features without it) it
> wouldn't make sense to have anything other than /sbin/init load policy on a
> Systemd system.
>
>
Dear Russel,

I would like to have a look at the Debian init solution for SELinux. Can you
attach or link to a sample inittab and substitute for what is done at
initrd?

Thanks.

-- 
Shahbaz Khan
Assist. R&D Engineer

http://shazkhan.wordpress.com/
http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49
http://imsciences.edu.pk/serg/
http://csrdu.org/
+92-91-332-9915828

[-- Attachment #2: Type: text/html, Size: 1893 bytes --]

Re: [refpolicy] load_policy() with upstart on mint 9 fluxbox

[Russell Coker]

On Mon, 25 Oct 2010, Shaz <shazalive@gmail.com> wrote:
> I would like to have a look at the Debian init solution for SELinux. Can
> you attach or link to a sample inittab and substitute for what is done at
> initrd?

In Debian sysvinit loads the policy, as everyone has done with sysvinit for 5+ 
years.  Upstart didn't, but I believe that there has been progress towards 
getting it to do so too.  There are quite a few Debian users who don't use an 
initrd and we want to support them.

There was never a need to change inittab.

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Main Blog
http://doc.coker.com.au/           My Documents Blog

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [refpolicy] load_policy() with upstart on mint 9 fluxbox

[Shaz]

[-- Attachment #1: Type: text/plain, Size: 1231 bytes --]

On Mon, Oct 25, 2010 at 5:16 PM, Russell Coker <russell@coker.com.au> wrote:

> On Mon, 25 Oct 2010, Shaz <shazalive@gmail.com> wrote:
> > I would like to have a look at the Debian init solution for SELinux. Can
> > you attach or link to a sample inittab and substitute for what is done at
> > initrd?
>
> In Debian sysvinit loads the policy, as everyone has done with sysvinit for
> 5+
> years.  Upstart didn't, but I believe that there has been progress towards
> getting it to do so too.  There are quite a few Debian users who don't use
> an
> initrd and we want to support them.
>

By init I meant including the sysvinit scripts. I might not be very accurate
with terminology here but what I actually wanted to analyze was the behavior
of how init is relabeled after selinux is initialized. And the rest of the
process is straight forward.

Thanks.


>
> There was never a need to change inittab.
>
> --
> russell@coker.com.au
> http://etbe.coker.com.au/          My Main Blog
> http://doc.coker.com.au/           My Documents Blog
>



-- 
Shahbaz Khan
Assist. R&D Engineer

http://shazkhan.wordpress.com/
http://pk.linkedin.com/pub/shahbaz-khan/20/116/b49
http://imsciences.edu.pk/serg/
http://csrdu.org/
+92-91-332-9915828

[-- Attachment #2: Type: text/html, Size: 2290 bytes --]