* Trying to update sysadm module in CLIP @ 2015-03-19 20:31 John Chludzinski 2015-03-19 21:54 ` Spencer Shimko 2015-03-19 22:38 ` John Chludzinski 0 siblings, 2 replies; 14+ messages in thread From: John Chludzinski @ 2015-03-19 20:31 UTC (permalink / raw) To: selinux First thing ... I'm a newbie to SELinux. I'm trying to update the sysadm module in a CLIP image. I downloaded the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. I modified the sysadm policy code and built (in ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: $ make modules APPS_MODS="sysadm" Then I tried to install in the CLIP image using: $ semodule -i /mnt/hdd/SELinix/sysadm.pp and got: "tried to link in a non-MLS module with an MLS base". (I assume this means the CLIP image I'm working with is MLS?) Next I built using: $ make modules APPS_MODS="sysadm" TYPE="mls" Tried to load/install the module and got: "sensitivy s10 not declared by base." Next I tried: $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 and !still! got "sensitivy s10 not declared by base". Any suggestions/thoughts? ---John ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-19 20:31 Trying to update sysadm module in CLIP John Chludzinski @ 2015-03-19 21:54 ` Spencer Shimko 2015-03-19 22:38 ` John Chludzinski 1 sibling, 0 replies; 14+ messages in thread From: Spencer Shimko @ 2015-03-19 21:54 UTC (permalink / raw) To: John Chludzinski; +Cc: selinux It is hard to tell at first glance but these questions are CLIP-specific. Thus, these questions are best suited for the CLIP mailing list: http://oss.tresys.com/mailman/listinfo/clip But my responses are in-line below. On Thu, Mar 19, 2015 at 4:31 PM, John Chludzinski <john.chludzinski@vivaldi.net> wrote: > First thing ... I'm a newbie to SELinux. > > I'm trying to update the sysadm module in a CLIP image. I downloaded the > SELinux policy code from: https://github.com/QuarkSecurity/CLIP. I modified > the sysadm policy code and built (in > ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: > > $ make modules APPS_MODS="sysadm" > > Then I tried to install in the CLIP image using: > > $ semodule -i /mnt/hdd/SELinix/sysadm.pp > > and got: "tried to link in a non-MLS module with an MLS base". (I assume > this means the CLIP image I'm working with is MLS?) > Next I built using: > > $ make modules APPS_MODS="sysadm" TYPE="mls" > The CLIP default is MCS but it also builds MLS policies. > Tried to load/install the module and got: "sensitivy s10 not declared by > base." > > Next I tried: > > $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 > > and !still! got "sensitivy s10 not declared by base". > > Any suggestions/thoughts? I'm not sure exactly which version of our repo you're using and things might have changed a bit but but I think these steps will work for you. You are building policy without actually rolling it up in an RPM. Much like Red Hat's spec file which CLIP's is based on, the RPM spec file in CLIP does a lot of configuration work via command-line arguments to make etc. The spec file is "packages/clip-selinux-policu/clip-selinux-policy.spec". As building a policy outside of an RPM will cause unkonwn changes in the policy tree, you might want to reset the tree and rebuild via an RPM. If you want to enable a module you can do it in: packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf. Alternatively, CLIP has support for enabling modules via tthe ENABLE_MODULES variable in "packages/clip-selinux-policy/Makefile" You have two choices here. The first, and highly recommeended way, is using mock. Go to the top-levedl of the CLIP tree and run "make clip-selinux-policy-rpm". The resulting policy RPMs can be found in repos/clip-repo/clip-selinux-policy*.rpm. Or you can build outside of mock by going into packages/clipselinux-policy and running "make rpm". The RPMs will end up in your current directory, packages/clip-selinux-policu/*.rpm. Thanks, --Spencer Spencer Shimko Quark Security, Inc quarksecurity.com > > ---John > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to > Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-19 20:31 Trying to update sysadm module in CLIP John Chludzinski 2015-03-19 21:54 ` Spencer Shimko @ 2015-03-19 22:38 ` John Chludzinski 2015-03-20 0:23 ` Brandon Whalen [not found] ` <CAGNxgPiBThm0SpAo-+1D2UsaFyVNY2AKpj56RFvt+8SrfxL-Jw@mail.gmail.com> 1 sibling, 2 replies; 14+ messages in thread From: John Chludzinski @ 2015-03-19 22:38 UTC (permalink / raw) To: selinux I ran (when under the role sysadm_r and type sysadm_t): $ id -Z and got: Xsysadm_u:sysadm_r:sysadm_t:s0 So now I'm assuming the CLIP image is at "s0" sensitivity level. Then I noticed that the build.conf file states: "The sensitivities will be s0 to s(MLS_SENS-1)". So I built using: $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 to get an "s0" sensitivity level. Tried to install and now I get: "duplicate declaration in module: type/attribute sysadm_userhelper_t". (A "Whac-A-Mole" game!) ---John On 2015-03-19 21:31, John Chludzinski wrote: > First thing ... I'm a newbie to SELinux. > > I'm trying to update the sysadm module in a CLIP image. I downloaded > the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. > I modified the sysadm policy code and built (in > ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: > > $ make modules APPS_MODS="sysadm" > > Then I tried to install in the CLIP image using: > > $ semodule -i /mnt/hdd/SELinix/sysadm.pp > > and got: "tried to link in a non-MLS module with an MLS base". (I > assume this means the CLIP image I'm working with is MLS?) > Next I built using: > > $ make modules APPS_MODS="sysadm" TYPE="mls" > > Tried to load/install the module and got: "sensitivy s10 not declared > by base." > > Next I tried: > > $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 > > and !still! got "sensitivy s10 not declared by base". > > Any suggestions/thoughts? > > ---John > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to > Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-19 22:38 ` John Chludzinski @ 2015-03-20 0:23 ` Brandon Whalen 2015-03-20 21:56 ` John Chludzinski [not found] ` <CAGNxgPiBThm0SpAo-+1D2UsaFyVNY2AKpj56RFvt+8SrfxL-Jw@mail.gmail.com> 1 sibling, 1 reply; 14+ messages in thread From: Brandon Whalen @ 2015-03-20 0:23 UTC (permalink / raw) To: John Chludzinski; +Cc: selinux@tycho.nsa.gov On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski <john.chludzinski@vivaldi.net> wrote: > I ran (when under the role sysadm_r and type sysadm_t): > > $ id -Z > > and got: Xsysadm_u:sysadm_r:sysadm_t:s0 > > So now I'm assuming the CLIP image is at "s0" sensitivity level. > > Then I noticed that the build.conf file states: "The sensitivities will be > s0 to s(MLS_SENS-1)". > > So I built using: > > $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 > > to get an "s0" sensitivity level. > > Tried to install and now I get: "duplicate declaration in module: > type/attribute sysadm_userhelper_t". It looks like sysadm_userhelper_t is declared in the policy already. Do you already have the sysadm module installed ' semodule -l' will tell you? If not, maybe the sysadm module was included in the base module. > (A "Whac-A-Mole" game!) > > ---John > > > > On 2015-03-19 21:31, John Chludzinski wrote: >> >> First thing ... I'm a newbie to SELinux. >> >> I'm trying to update the sysadm module in a CLIP image. I downloaded >> the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. >> I modified the sysadm policy code and built (in >> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >> >> $ make modules APPS_MODS="sysadm" >> >> Then I tried to install in the CLIP image using: >> >> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >> >> and got: "tried to link in a non-MLS module with an MLS base". (I >> assume this means the CLIP image I'm working with is MLS?) >> Next I built using: >> >> $ make modules APPS_MODS="sysadm" TYPE="mls" >> >> Tried to load/install the module and got: "sensitivy s10 not declared by >> base." >> >> Next I tried: >> >> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >> >> and !still! got "sensitivy s10 not declared by base". >> >> Any suggestions/thoughts? >> >> ---John >> _______________________________________________ >> Selinux mailing list >> Selinux@tycho.nsa.gov >> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >> To get help, send an email containing "help" to >> Selinux-request@tycho.nsa.gov. > > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to > Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-20 0:23 ` Brandon Whalen @ 2015-03-20 21:56 ` John Chludzinski 0 siblings, 0 replies; 14+ messages in thread From: John Chludzinski @ 2015-03-20 21:56 UTC (permalink / raw) To: Brandon Whalen; +Cc: selinux Nope, there is no sysadm module that shows up in the listing from "semodule -l". I assume it's rolled up in some other module? But which one? ---John On 2015-03-20 01:23, Brandon Whalen wrote: > On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski > <john.chludzinski@vivaldi.net> wrote: >> I ran (when under the role sysadm_r and type sysadm_t): >> >> $ id -Z >> >> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >> >> So now I'm assuming the CLIP image is at "s0" sensitivity level. >> >> Then I noticed that the build.conf file states: "The sensitivities >> will be >> s0 to s(MLS_SENS-1)". >> >> So I built using: >> >> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >> >> to get an "s0" sensitivity level. >> >> Tried to install and now I get: "duplicate declaration in module: >> type/attribute sysadm_userhelper_t". > > It looks like sysadm_userhelper_t is declared in the policy already. > Do you already have the sysadm module installed ' semodule -l' will > tell you? If not, maybe the sysadm module was included in the base > module. > >> (A "Whac-A-Mole" game!) >> >> ---John >> >> >> >> On 2015-03-19 21:31, John Chludzinski wrote: >>> >>> First thing ... I'm a newbie to SELinux. >>> >>> I'm trying to update the sysadm module in a CLIP image. I downloaded >>> the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. >>> I modified the sysadm policy code and built (in >>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>> >>> $ make modules APPS_MODS="sysadm" >>> >>> Then I tried to install in the CLIP image using: >>> >>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>> >>> and got: "tried to link in a non-MLS module with an MLS base". (I >>> assume this means the CLIP image I'm working with is MLS?) >>> Next I built using: >>> >>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>> >>> Tried to load/install the module and got: "sensitivy s10 not declared >>> by >>> base." >>> >>> Next I tried: >>> >>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >>> >>> and !still! got "sensitivy s10 not declared by base". >>> >>> Any suggestions/thoughts? >>> >>> ---John >>> _______________________________________________ >>> Selinux mailing list >>> Selinux@tycho.nsa.gov >>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>> To get help, send an email containing "help" to >>> Selinux-request@tycho.nsa.gov. >> >> >> _______________________________________________ >> Selinux mailing list >> Selinux@tycho.nsa.gov >> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >> To get help, send an email containing "help" to >> Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
[parent not found: <CAGNxgPiBThm0SpAo-+1D2UsaFyVNY2AKpj56RFvt+8SrfxL-Jw@mail.gmail.com>]
* Re: Trying to update sysadm module in CLIP [not found] ` <CAGNxgPiBThm0SpAo-+1D2UsaFyVNY2AKpj56RFvt+8SrfxL-Jw@mail.gmail.com> @ 2015-03-20 22:14 ` John Chludzinski 2015-03-21 13:57 ` Brandon Whalen [not found] ` <55d4ced56b5ade45f9635caa3bd622b9@vivaldi.net> 1 sibling, 1 reply; 14+ messages in thread From: John Chludzinski @ 2015-03-20 22:14 UTC (permalink / raw) To: Spencer Shimko; +Cc: selinux 1) I noticed packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf defines the the modules that are built into a base.pp: packages/clip-selinux-policy/clip-selinux-policy/ > make base TYPE="mls" MLS_SENS=1 which includes sysadm. Is this something of any interest? 2) Reading the output from: packages/clip-selinux-policy/ > make rpm I noticed it contains: "Compiling clip base module", which compiles all the *.te files. which, of course, includes sysadm. The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, clip-selinux-policy-6.2.0-1.src.rpm, clip-selinux-policy-6.2.0.tar.gz. Should install clip-selinux-policy-6.2.0-1.noarch.rpm? 3) If I'm making small modifications to one of the canonical CLIP modules (system, role, etc.) is there something less that replacing the policy tree? That's why I build the sysadm.pp. 4) If I'm creating policies unique to this project, should I create a directory under policy/modules/<project> and run: make conf? Use LOCAL_ROOT to point to a policy source tree hanging off the project root? Just trying to come up with some process/strategy that's flexible and defensible. Of course LOCAL_ROOT is defined in the Makefile in packages/clip-selinux-policy/clip-selinux-policy and I'd be building *.pp files? Maybe this is OK for new policy code? ---John Been inspecting the "other" make (in packages/clip-selinux-policy v. packages/clip-selinux-policy/clip-selinux-policy). On 2015-03-20 00:33, Spencer Shimko wrote: > Trimmed SELinux mailing list form CCs. > > Did you try the the suggestions in my on-list response a little while > ago? > > On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski > <john.chludzinski@vivaldi.net> wrote: >> I ran (when under the role sysadm_r and type sysadm_t): >> >> $ id -Z >> >> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >> >> So now I'm assuming the CLIP image is at "s0" sensitivity level. >> >> Then I noticed that the build.conf file states: "The sensitivities >> will be >> s0 to s(MLS_SENS-1)". >> >> So I built using: >> >> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >> >> to get an "s0" sensitivity level. >> >> Tried to install and now I get: "duplicate declaration in module: >> type/attribute sysadm_userhelper_t". >> (A "Whac-A-Mole" game!) >> >> ---John >> >> >> On 2015-03-19 21:31, John Chludzinski wrote: >>> >>> First thing ... I'm a newbie to SELinux. >>> >>> I'm trying to update the sysadm module in a CLIP image. I downloaded >>> the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. >>> I modified the sysadm policy code and built (in >>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>> >>> $ make modules APPS_MODS="sysadm" >>> >>> Then I tried to install in the CLIP image using: >>> >>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>> >>> and got: "tried to link in a non-MLS module with an MLS base". (I >>> assume this means the CLIP image I'm working with is MLS?) >>> Next I built using: >>> >>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>> >>> Tried to load/install the module and got: "sensitivy s10 not declared >>> by >>> base." >>> >>> Next I tried: >>> >>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >>> >>> and !still! got "sensitivy s10 not declared by base". >>> >>> Any suggestions/thoughts? >>> >>> ---John >>> _______________________________________________ >>> Selinux mailing list >>> Selinux@tycho.nsa.gov >>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>> To get help, send an email containing "help" to >>> Selinux-request@tycho.nsa.gov. >> >> >> _______________________________________________ >> Selinux mailing list >> Selinux@tycho.nsa.gov >> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >> To get help, send an email containing "help" to >> Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-20 22:14 ` John Chludzinski @ 2015-03-21 13:57 ` Brandon Whalen 2015-03-21 17:36 ` Thomas Hurd 0 siblings, 1 reply; 14+ messages in thread From: Brandon Whalen @ 2015-03-21 13:57 UTC (permalink / raw) To: John Chludzinski; +Cc: selinux@tycho.nsa.gov On Fri, Mar 20, 2015 at 6:14 PM, John Chludzinski <john.chludzinski@vivaldi.net> wrote: > 1) I noticed > packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf defines > the the modules that are built into a base.pp: > > packages/clip-selinux-policy/clip-selinux-policy/ > make base TYPE="mls" > MLS_SENS=1 > > which includes sysadm. Is this something of any interest? > > 2) Reading the output from: > > packages/clip-selinux-policy/ > make rpm > > I noticed it contains: "Compiling clip base module", which compiles all the > *.te files. > > which, of course, includes sysadm. > > The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, > clip-selinux-policy-6.2.0-1.src.rpm, clip-selinux-policy-6.2.0.tar.gz. > > Should install clip-selinux-policy-6.2.0-1.noarch.rpm? In your modules.conf is sysadm listed as base? Looking at [1] it looks like by default CLIP puts sysadm in base. If that was the case when you first built and installed, you could just rebuild it into base and replace the base module. [1] https://github.com/QuarkSecurity/CLIP/blob/master/packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf > > 3) If I'm making small modifications to one of the canonical CLIP modules > (system, role, etc.) is there something less that replacing the policy tree? > That's why I build the sysadm.pp. Yes, you can do this, but the problem is that I believe you started with sysadm in the base module. Another option, that I _think_ will work is to make sysadm a module by updating modules.conf, rebuild the modules, and then reinstall the base.pp and the sysadm.pp. This will remove the sysadm declarations from base and let you just update the sysadm.pp instead. > > 4) If I'm creating policies unique to this project, should I create a > directory under policy/modules/<project> and run: make conf? Use LOCAL_ROOT > to point to a policy source tree hanging off the project root? Just trying > to come up with some process/strategy that's flexible and defensible. Of > course LOCAL_ROOT is defined in the Makefile in > packages/clip-selinux-policy/clip-selinux-policy and I'd be building *.pp > files? Maybe this is OK for new policy code? This is something we do fairly often and it really just depends on what you'd like to do. When working on large scale projects that have a lot of their own components I often create a custom layer just for the project I'm working on. I've found that even when I do that I often have to modify other parts of the policy to make things work. If you are only adding a couple things it's probably not worth it though. I'd just put the modules into the appropriate layers. This [2] shows how to add a layer in to reference policy which is what you're talking about doing. Then you have to update modules.conf to add in the new modules for that layer. By default as long as you have not listed a module as off in the modules.conf file CLIP should put that module in the RPM that gets installed. [2] http://www.freetechbooks.com/efiles/selinuxnotebook/The_SELinux_Notebook_The_Foundations_3rd_Edition.pdf > > > ---John > > > > Been inspecting the "other" make (in packages/clip-selinux-policy v. > packages/clip-selinux-policy/clip-selinux-policy). > > On 2015-03-20 00:33, Spencer Shimko wrote: >> >> Trimmed SELinux mailing list form CCs. >> >> Did you try the the suggestions in my on-list response a little while ago? >> >> On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski >> <john.chludzinski@vivaldi.net> wrote: >>> >>> I ran (when under the role sysadm_r and type sysadm_t): >>> >>> $ id -Z >>> >>> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >>> >>> So now I'm assuming the CLIP image is at "s0" sensitivity level. >>> >>> Then I noticed that the build.conf file states: "The sensitivities will >>> be >>> s0 to s(MLS_SENS-1)". >>> >>> So I built using: >>> >>> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >>> >>> to get an "s0" sensitivity level. >>> >>> Tried to install and now I get: "duplicate declaration in module: >>> type/attribute sysadm_userhelper_t". >>> (A "Whac-A-Mole" game!) >>> >>> ---John >>> >>> >>> On 2015-03-19 21:31, John Chludzinski wrote: >>>> >>>> >>>> First thing ... I'm a newbie to SELinux. >>>> >>>> I'm trying to update the sysadm module in a CLIP image. I downloaded >>>> the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. >>>> I modified the sysadm policy code and built (in >>>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>>> >>>> $ make modules APPS_MODS="sysadm" >>>> >>>> Then I tried to install in the CLIP image using: >>>> >>>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>>> >>>> and got: "tried to link in a non-MLS module with an MLS base". (I >>>> assume this means the CLIP image I'm working with is MLS?) >>>> Next I built using: >>>> >>>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>>> >>>> Tried to load/install the module and got: "sensitivy s10 not declared by >>>> base." >>>> >>>> Next I tried: >>>> >>>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >>>> >>>> and !still! got "sensitivy s10 not declared by base". >>>> >>>> Any suggestions/thoughts? >>>> >>>> ---John >>>> _______________________________________________ >>>> Selinux mailing list >>>> Selinux@tycho.nsa.gov >>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>> To get help, send an email containing "help" to >>>> Selinux-request@tycho.nsa.gov. >>> >>> >>> >>> _______________________________________________ >>> Selinux mailing list >>> Selinux@tycho.nsa.gov >>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>> To get help, send an email containing "help" to >>> Selinux-request@tycho.nsa.gov. > > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to > Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-21 13:57 ` Brandon Whalen @ 2015-03-21 17:36 ` Thomas Hurd 0 siblings, 0 replies; 14+ messages in thread From: Thomas Hurd @ 2015-03-21 17:36 UTC (permalink / raw) To: Brandon Whalen, John Chludzinski; +Cc: clip, selinux@tycho.nsa.gov Adding the CLIP mailing list to the CC. Additional replies in line On 03/21/2015 09:57 AM, Brandon Whalen wrote: > On Fri, Mar 20, 2015 at 6:14 PM, John Chludzinski > <john.chludzinski@vivaldi.net> wrote: >> 1) I noticed >> packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf defines >> the the modules that are built into a base.pp: >> >> packages/clip-selinux-policy/clip-selinux-policy/ > make base TYPE="mls" >> MLS_SENS=1 >> >> which includes sysadm. Is this something of any interest? >> >> 2) Reading the output from: >> >> packages/clip-selinux-policy/ > make rpm >> >> I noticed it contains: "Compiling clip base module", which compiles all the >> *.te files. >> >> which, of course, includes sysadm. >> >> The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, >> clip-selinux-policy-6.2.0-1.src.rpm, clip-selinux-policy-6.2.0.tar.gz. >> >> Should install clip-selinux-policy-6.2.0-1.noarch.rpm? If you choose to update your policy via updating the RPM, you should also install clip-selinux-policy-clip-6.2.0-1.noarch.rpm If you're updating te, if, and fc files, the clip-selinux-policy-clip package is the one that will contain those changes. > In your modules.conf is sysadm listed as base? Looking at [1] it looks > like by default CLIP puts sysadm in base. If that was the case when > you first built and installed, you could just rebuild it into base and > replace the base module. > > [1] https://github.com/QuarkSecurity/CLIP/blob/master/packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf > >> 3) If I'm making small modifications to one of the canonical CLIP modules >> (system, role, etc.) is there something less that replacing the policy tree? >> That's why I build the sysadm.pp. > Yes, you can do this, but the problem is that I believe you started > with sysadm in the base module. Another option, that I _think_ will > work is to make sysadm a module by updating modules.conf, rebuild the > modules, and then reinstall the base.pp and the sysadm.pp. This will > remove the sysadm declarations from base and let you just update the > sysadm.pp instead. If you change sysadm = module, then rebuild you'll get an error because init is still in base and there's a scoping issue. If you put init = module, you'll get the same error for the apm module. If you keep resolving all them, you'll run into the problem in libsepol[1] that I emailed the SELinux list earlier in the week when semodule_expand runs. So I wouldn't recommend this method unless you also want to start turning modules on that aren't currently (virt, qemu, etc.) trying to get the policy to build. [1] http://marc.info/?l=selinux&m=142679362923202&w=2 > >> 4) If I'm creating policies unique to this project, should I create a >> directory under policy/modules/<project> and run: make conf? Use LOCAL_ROOT >> to point to a policy source tree hanging off the project root? Just trying >> to come up with some process/strategy that's flexible and defensible. Of >> course LOCAL_ROOT is defined in the Makefile in >> packages/clip-selinux-policy/clip-selinux-policy and I'd be building *.pp >> files? Maybe this is OK for new policy code? > This is something we do fairly often and it really just depends on > what you'd like to do. When working on large scale projects that have > a lot of their own components I often create a custom layer just for > the project I'm working on. I've found that even when I do that I > often have to modify other parts of the policy to make things work. If > you are only adding a couple things it's probably not worth it though. > I'd just put the modules into the appropriate layers. This [2] shows > how to add a layer in to reference policy which is what you're talking > about doing. Then you have to update modules.conf to add in the new > modules for that layer. By default as long as you have not listed a > module as off in the modules.conf file CLIP should put that module in > the RPM that gets installed. > > [2] http://www.freetechbooks.com/efiles/selinuxnotebook/The_SELinux_Notebook_The_Foundations_3rd_Edition.pdf Another resource is the Reference Policy Getting Started page: https://github.com/TresysTechnology/refpolicy/wiki/GettingStarted > >> >> ---John >> >> >> >> Been inspecting the "other" make (in packages/clip-selinux-policy v. >> packages/clip-selinux-policy/clip-selinux-policy). >> >> On 2015-03-20 00:33, Spencer Shimko wrote: >>> Trimmed SELinux mailing list form CCs. >>> >>> Did you try the the suggestions in my on-list response a little while ago? >>> >>> On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski >>> <john.chludzinski@vivaldi.net> wrote: >>>> I ran (when under the role sysadm_r and type sysadm_t): >>>> >>>> $ id -Z >>>> >>>> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >>>> >>>> So now I'm assuming the CLIP image is at "s0" sensitivity level. >>>> >>>> Then I noticed that the build.conf file states: "The sensitivities will >>>> be >>>> s0 to s(MLS_SENS-1)". >>>> >>>> So I built using: >>>> >>>> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >>>> >>>> to get an "s0" sensitivity level. >>>> >>>> Tried to install and now I get: "duplicate declaration in module: >>>> type/attribute sysadm_userhelper_t". >>>> (A "Whac-A-Mole" game!) >>>> >>>> ---John >>>> >>>> >>>> On 2015-03-19 21:31, John Chludzinski wrote: >>>>> >>>>> First thing ... I'm a newbie to SELinux. >>>>> >>>>> I'm trying to update the sysadm module in a CLIP image. I downloaded >>>>> the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. >>>>> I modified the sysadm policy code and built (in >>>>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>>>> >>>>> $ make modules APPS_MODS="sysadm" >>>>> >>>>> Then I tried to install in the CLIP image using: >>>>> >>>>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>>>> >>>>> and got: "tried to link in a non-MLS module with an MLS base". (I >>>>> assume this means the CLIP image I'm working with is MLS?) >>>>> Next I built using: >>>>> >>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>>>> >>>>> Tried to load/install the module and got: "sensitivy s10 not declared by >>>>> base." >>>>> >>>>> Next I tried: >>>>> >>>>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >>>>> >>>>> and !still! got "sensitivy s10 not declared by base". >>>>> >>>>> Any suggestions/thoughts? >>>>> >>>>> ---John >>>>> _______________________________________________ >>>>> Selinux mailing list >>>>> Selinux@tycho.nsa.gov >>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>> To get help, send an email containing "help" to >>>>> Selinux-request@tycho.nsa.gov. >>>> >>>> >>>> _______________________________________________ >>>> Selinux mailing list >>>> Selinux@tycho.nsa.gov >>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>> To get help, send an email containing "help" to >>>> Selinux-request@tycho.nsa.gov. >> >> _______________________________________________ >> Selinux mailing list >> Selinux@tycho.nsa.gov >> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >> To get help, send an email containing "help" to >> Selinux-request@tycho.nsa.gov. > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
[parent not found: <55d4ced56b5ade45f9635caa3bd622b9@vivaldi.net>]
[parent not found: <CAGNxgPh1Tq+ipErajh4F7VSW57cMTiNC7ZWJOa+jpWYsyw_HOA@mail.gmail.com>]
* Re: Trying to update sysadm module in CLIP [not found] ` <CAGNxgPh1Tq+ipErajh4F7VSW57cMTiNC7ZWJOa+jpWYsyw_HOA@mail.gmail.com> @ 2015-03-23 15:16 ` John Chludzinski 2015-03-23 16:01 ` Brandon Whalen 0 siblings, 1 reply; 14+ messages in thread From: John Chludzinski @ 2015-03-23 15:16 UTC (permalink / raw) To: Spencer Shimko; +Cc: Selinux I took the liberty of examining the contents of clip-selinux-policy-6.2.0-1.noarch.rpm: $ rpm -qpl clip-selinux-policy-6.2.0-1.noarch.rpm $ rpm2cpio clip-selinux-policy-6.2.0-1.noarch.rpm | cpio -idmv and found the RPM contains nothing but *.if files for the modules + gzipped man pages + a Makefile. It contains NO *.pp files nor does it include any *.te and *.fc to build *.pp files from. So installing clip-selinux-policy-6.2.0-1.noarch.rpm is for what? ---John On 2015-03-20 23:07, Spencer Shimko wrote: > On Fri, Mar 20, 2015 at 5:43 PM, John Chludzinski > <john.chludzinski@vivaldi.net> wrote: >> 1) I noticed >> packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf >> defines >> the the modules that are built into a base.pp: >> >> packages/clip-selinux-policy/clip-selinux-policy/ > make base >> TYPE="mls" >> MLS_SENS=1 >> >> which includes sysadm. Is this something of any interest? > > As long as modules.conf declares something as base, it will be in > base. This is interesting because you have made made me think about a > circumstance that will break something in my tree pending merge into > our QSI tree (my #next branch in sshimko on github). Neither here nor > there, yes, it will be in base if it is defined as base in > modules.conf. >> >> 2) Reading the output from: >> >> packages/clip-selinux-policy/ > make rpm >> >> I noticed it contains: "Compiling clip base module", which compiles >> all the >> *.te files. > > Only the .te files corresponding to those set to "base" in > modules.conf. Those listed as "module" will be built at a later step > and will not be present in base.pp. >> >> which, of course, includes sysadm. >> >> The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, >> clip-selinux-policy-6.2.0-1.src.rpm, clip-selinux-policy-6.2.0.tar.gz. >> >> Should install clip-selinux-policy-6.2.0-1.noarch.rpm? > > Yes the tarball is a side-effect of how things are built. The RPM is > the one you want. But there should be several files ending in .rpm. > Is that not the case? >> >> 3) If I'm making small modifications to one of the canonical CLIP >> modules >> (system, role, etc.) is there something less that replacing the policy >> tree? >> That's why I build the sysadm.pp. > > Honestly the easiest way is to just roll the updated RPMs and install > them on your system/. Thus, you will get an updated sysadm policy as > well. > > Are you just trying to build a policy for a single, > previously-deployed system? If so, there are other ways. But if > you're trying to do reproducible builds for inclusion in a bigger > environment using RPMs for updating policies is reommended. > > >> >> 4) If I'm creating policies unique to this project, should I create a >> directory under policy/modules/<project> and run: make conf? Use >> LOCAL_ROOT >> to point to a policy source tree hanging off the project root? Just >> trying >> to come up with some process/strategy that's flexible and defensible. >> Of >> course LOCAL_ROOT is defined in the Makefile in >> packages/clip-selinux-policy/clip-selinux-policy and I'd be building >> *.pp >> files? Maybe this is OK for new policy code? >> > > Gotcha. So yes you're taking the right approach by introducing a new > policy/modules/<project> directory and adding a metadata.xml file in > there to describe that project. Then run make conf to have that > project added to the correct configuration files. > > Aside from make conf, I wouldn't use any other make commands in the > policy directory as it will lead to problems. LOCAL_ROOT is a decent > option if you're trying to build out of tree policies for, say, a > single system. Actually I think I implemented that feature years > ago.... > > Basically, I would add your project folder, run make conf, then start > modifying all of the policy components you need to modify. For > testing and deployment I would suggest replacing the entire set of > RPMs by rebuilding the RPMs with make rpm, and reinstalling them (with > --force if you didn't bump the release number). > > I have some changes in my github tree #next branch that haven't been > merged into our main tree yet. Specifically, we can now roll RPMs for > individual policy packages via a SEPRATE_PKGS variable in the > Makefile. This might be useful for you because you can rebuild the > RPMs and, by specifying sysadm as a SEPARATE_PKG, you will get that > package as a separate, isolated RPM. But these changes are in QA now > and haven't been merged into our main repo so take those with a grain > of salt. > > Thanks, > --Spencer >> >> ---John >> >> >> >> Been inspecting the "other" make (in packages/clip-selinux-policy v. >> packages/clip-selinux-policy/clip-selinux-policy). >> >> On 2015-03-20 00:33, Spencer Shimko wrote: >>> >>> Trimmed SELinux mailing list form CCs. >>> >>> Did you try the the suggestions in my on-list response a little while >>> ago? >>> >>> On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski >>> <john.chludzinski@vivaldi.net> wrote: >>>> >>>> I ran (when under the role sysadm_r and type sysadm_t): >>>> >>>> $ id -Z >>>> >>>> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >>>> >>>> So now I'm assuming the CLIP image is at "s0" sensitivity level. >>>> >>>> Then I noticed that the build.conf file states: "The sensitivities >>>> will >>>> be >>>> s0 to s(MLS_SENS-1)". >>>> >>>> So I built using: >>>> >>>> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >>>> >>>> to get an "s0" sensitivity level. >>>> >>>> Tried to install and now I get: "duplicate declaration in module: >>>> type/attribute sysadm_userhelper_t". >>>> (A "Whac-A-Mole" game!) >>>> >>>> ---John >>>> >>>> >>>> On 2015-03-19 21:31, John Chludzinski wrote: >>>>> >>>>> >>>>> First thing ... I'm a newbie to SELinux. >>>>> >>>>> I'm trying to update the sysadm module in a CLIP image. I >>>>> downloaded >>>>> the SELinux policy code from: >>>>> https://github.com/QuarkSecurity/CLIP. >>>>> I modified the sysadm policy code and built (in >>>>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>>>> >>>>> $ make modules APPS_MODS="sysadm" >>>>> >>>>> Then I tried to install in the CLIP image using: >>>>> >>>>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>>>> >>>>> and got: "tried to link in a non-MLS module with an MLS base". (I >>>>> assume this means the CLIP image I'm working with is MLS?) >>>>> Next I built using: >>>>> >>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>>>> >>>>> Tried to load/install the module and got: "sensitivy s10 not >>>>> declared by >>>>> base." >>>>> >>>>> Next I tried: >>>>> >>>>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >>>>> >>>>> and !still! got "sensitivy s10 not declared by base". >>>>> >>>>> Any suggestions/thoughts? >>>>> >>>>> ---John >>>>> _______________________________________________ >>>>> Selinux mailing list >>>>> Selinux@tycho.nsa.gov >>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>> To get help, send an email containing "help" to >>>>> Selinux-request@tycho.nsa.gov. >>>> >>>> >>>> >>>> _______________________________________________ >>>> Selinux mailing list >>>> Selinux@tycho.nsa.gov >>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>> To get help, send an email containing "help" to >>>> Selinux-request@tycho.nsa.gov. >> >> ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-23 15:16 ` John Chludzinski @ 2015-03-23 16:01 ` Brandon Whalen 2015-03-23 17:36 ` John Chludzinski 0 siblings, 1 reply; 14+ messages in thread From: Brandon Whalen @ 2015-03-23 16:01 UTC (permalink / raw) To: John Chludzinski; +Cc: Selinux On Mon, Mar 23, 2015 at 11:16 AM, John Chludzinski <john.chludzinski@vivaldi.net> wrote: > I took the liberty of examining the contents of > clip-selinux-policy-6.2.0-1.noarch.rpm: > > $ rpm -qpl clip-selinux-policy-6.2.0-1.noarch.rpm > > $ rpm2cpio clip-selinux-policy-6.2.0-1.noarch.rpm | cpio -idmv > > and found the RPM contains nothing but *.if files for the modules + gzipped > man pages + a Makefile. > > It contains NO *.pp files nor does it include any *.te and *.fc to build > *.pp files from. > > So installing clip-selinux-policy-6.2.0-1.noarch.rpm is for what? It's basically an RPM that installs header files and man pages. The .if file declares interfaces to other modules, so its very much like header information for SELinux policy. The one with the .pp files should be named clip-selinux-policy-6.2.0-1-mls.noarch.rpm. If you were building mcs it would clip-selinux-policy-6.2.0-1-mcs.noarch.rpm. > > ---John > > On 2015-03-20 23:07, Spencer Shimko wrote: >> >> On Fri, Mar 20, 2015 at 5:43 PM, John Chludzinski >> <john.chludzinski@vivaldi.net> wrote: >>> >>> 1) I noticed >>> packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf >>> defines >>> the the modules that are built into a base.pp: >>> >>> packages/clip-selinux-policy/clip-selinux-policy/ > make base TYPE="mls" >>> MLS_SENS=1 >>> >>> which includes sysadm. Is this something of any interest? >> >> >> As long as modules.conf declares something as base, it will be in >> base. This is interesting because you have made made me think about a >> circumstance that will break something in my tree pending merge into >> our QSI tree (my #next branch in sshimko on github). Neither here nor >> there, yes, it will be in base if it is defined as base in >> modules.conf. >>> >>> >>> 2) Reading the output from: >>> >>> packages/clip-selinux-policy/ > make rpm >>> >>> I noticed it contains: "Compiling clip base module", which compiles all >>> the >>> *.te files. >> >> >> Only the .te files corresponding to those set to "base" in >> modules.conf. Those listed as "module" will be built at a later step >> and will not be present in base.pp. >>> >>> >>> which, of course, includes sysadm. >>> >>> The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, >>> clip-selinux-policy-6.2.0-1.src.rpm, clip-selinux-policy-6.2.0.tar.gz. >>> >>> Should install clip-selinux-policy-6.2.0-1.noarch.rpm? >> >> >> Yes the tarball is a side-effect of how things are built. The RPM is >> the one you want. But there should be several files ending in .rpm. >> Is that not the case? >>> >>> >>> 3) If I'm making small modifications to one of the canonical CLIP modules >>> (system, role, etc.) is there something less that replacing the policy >>> tree? >>> That's why I build the sysadm.pp. >> >> >> Honestly the easiest way is to just roll the updated RPMs and install >> them on your system/. Thus, you will get an updated sysadm policy as >> well. >> >> Are you just trying to build a policy for a single, >> previously-deployed system? If so, there are other ways. But if >> you're trying to do reproducible builds for inclusion in a bigger >> environment using RPMs for updating policies is reommended. >> >> >>> >>> 4) If I'm creating policies unique to this project, should I create a >>> directory under policy/modules/<project> and run: make conf? Use >>> LOCAL_ROOT >>> to point to a policy source tree hanging off the project root? Just >>> trying >>> to come up with some process/strategy that's flexible and defensible. Of >>> course LOCAL_ROOT is defined in the Makefile in >>> packages/clip-selinux-policy/clip-selinux-policy and I'd be building *.pp >>> files? Maybe this is OK for new policy code? >>> >> >> Gotcha. So yes you're taking the right approach by introducing a new >> policy/modules/<project> directory and adding a metadata.xml file in >> there to describe that project. Then run make conf to have that >> project added to the correct configuration files. >> >> Aside from make conf, I wouldn't use any other make commands in the >> policy directory as it will lead to problems. LOCAL_ROOT is a decent >> option if you're trying to build out of tree policies for, say, a >> single system. Actually I think I implemented that feature years >> ago.... >> >> Basically, I would add your project folder, run make conf, then start >> modifying all of the policy components you need to modify. For >> testing and deployment I would suggest replacing the entire set of >> RPMs by rebuilding the RPMs with make rpm, and reinstalling them (with >> --force if you didn't bump the release number). >> >> I have some changes in my github tree #next branch that haven't been >> merged into our main tree yet. Specifically, we can now roll RPMs for >> individual policy packages via a SEPRATE_PKGS variable in the >> Makefile. This might be useful for you because you can rebuild the >> RPMs and, by specifying sysadm as a SEPARATE_PKG, you will get that >> package as a separate, isolated RPM. But these changes are in QA now >> and haven't been merged into our main repo so take those with a grain >> of salt. >> >> Thanks, >> --Spencer >>> >>> >>> ---John >>> >>> >>> >>> Been inspecting the "other" make (in packages/clip-selinux-policy v. >>> packages/clip-selinux-policy/clip-selinux-policy). >>> >>> On 2015-03-20 00:33, Spencer Shimko wrote: >>>> >>>> >>>> Trimmed SELinux mailing list form CCs. >>>> >>>> Did you try the the suggestions in my on-list response a little while >>>> ago? >>>> >>>> On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski >>>> <john.chludzinski@vivaldi.net> wrote: >>>>> >>>>> >>>>> I ran (when under the role sysadm_r and type sysadm_t): >>>>> >>>>> $ id -Z >>>>> >>>>> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >>>>> >>>>> So now I'm assuming the CLIP image is at "s0" sensitivity level. >>>>> >>>>> Then I noticed that the build.conf file states: "The sensitivities will >>>>> be >>>>> s0 to s(MLS_SENS-1)". >>>>> >>>>> So I built using: >>>>> >>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >>>>> >>>>> to get an "s0" sensitivity level. >>>>> >>>>> Tried to install and now I get: "duplicate declaration in module: >>>>> type/attribute sysadm_userhelper_t". >>>>> (A "Whac-A-Mole" game!) >>>>> >>>>> ---John >>>>> >>>>> >>>>> On 2015-03-19 21:31, John Chludzinski wrote: >>>>>> >>>>>> >>>>>> >>>>>> First thing ... I'm a newbie to SELinux. >>>>>> >>>>>> I'm trying to update the sysadm module in a CLIP image. I downloaded >>>>>> the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. >>>>>> I modified the sysadm policy code and built (in >>>>>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>>>>> >>>>>> $ make modules APPS_MODS="sysadm" >>>>>> >>>>>> Then I tried to install in the CLIP image using: >>>>>> >>>>>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>>>>> >>>>>> and got: "tried to link in a non-MLS module with an MLS base". (I >>>>>> assume this means the CLIP image I'm working with is MLS?) >>>>>> Next I built using: >>>>>> >>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>>>>> >>>>>> Tried to load/install the module and got: "sensitivy s10 not declared >>>>>> by >>>>>> base." >>>>>> >>>>>> Next I tried: >>>>>> >>>>>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >>>>>> >>>>>> and !still! got "sensitivy s10 not declared by base". >>>>>> >>>>>> Any suggestions/thoughts? >>>>>> >>>>>> ---John >>>>>> _______________________________________________ >>>>>> Selinux mailing list >>>>>> Selinux@tycho.nsa.gov >>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>>> To get help, send an email containing "help" to >>>>>> Selinux-request@tycho.nsa.gov. >>>>> >>>>> >>>>> >>>>> >>>>> _______________________________________________ >>>>> Selinux mailing list >>>>> Selinux@tycho.nsa.gov >>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>> To get help, send an email containing "help" to >>>>> Selinux-request@tycho.nsa.gov. >>> >>> >>> > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to > Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-23 16:01 ` Brandon Whalen @ 2015-03-23 17:36 ` John Chludzinski 2015-03-23 18:12 ` Mike Palmiotto 2015-03-23 18:22 ` Brandon Whalen 0 siblings, 2 replies; 14+ messages in thread From: John Chludzinski @ 2015-03-23 17:36 UTC (permalink / raw) To: Brandon Whalen; +Cc: Selinux 1st, I don't see an MCS build option in packages/clip-selinux-policy/Makefile. How would I build this? 2nd, when last I tried to load/install a non-MLS module (e.g., sysadm.pp) into CLIP, it refused saying "trying to load non-MLS module into MLS base". ---John On 2015-03-23 17:01, Brandon Whalen wrote: > On Mon, Mar 23, 2015 at 11:16 AM, John Chludzinski > <john.chludzinski@vivaldi.net> wrote: >> I took the liberty of examining the contents of >> clip-selinux-policy-6.2.0-1.noarch.rpm: >> >> $ rpm -qpl clip-selinux-policy-6.2.0-1.noarch.rpm >> >> $ rpm2cpio clip-selinux-policy-6.2.0-1.noarch.rpm | cpio -idmv >> >> and found the RPM contains nothing but *.if files for the modules + >> gzipped >> man pages + a Makefile. >> >> It contains NO *.pp files nor does it include any *.te and *.fc to >> build >> *.pp files from. >> >> So installing clip-selinux-policy-6.2.0-1.noarch.rpm is for what? > > It's basically an RPM that installs header files and man pages. The > .if file declares interfaces to other modules, so its very much like > header information for SELinux policy. The one with the .pp files > should be named clip-selinux-policy-6.2.0-1-mls.noarch.rpm. If you > were building mcs it would clip-selinux-policy-6.2.0-1-mcs.noarch.rpm. > >> >> ---John >> >> On 2015-03-20 23:07, Spencer Shimko wrote: >>> >>> On Fri, Mar 20, 2015 at 5:43 PM, John Chludzinski >>> <john.chludzinski@vivaldi.net> wrote: >>>> >>>> 1) I noticed >>>> packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf >>>> defines >>>> the the modules that are built into a base.pp: >>>> >>>> packages/clip-selinux-policy/clip-selinux-policy/ > make base >>>> TYPE="mls" >>>> MLS_SENS=1 >>>> >>>> which includes sysadm. Is this something of any interest? >>> >>> >>> As long as modules.conf declares something as base, it will be in >>> base. This is interesting because you have made made me think about >>> a >>> circumstance that will break something in my tree pending merge into >>> our QSI tree (my #next branch in sshimko on github). Neither here >>> nor >>> there, yes, it will be in base if it is defined as base in >>> modules.conf. >>>> >>>> >>>> 2) Reading the output from: >>>> >>>> packages/clip-selinux-policy/ > make rpm >>>> >>>> I noticed it contains: "Compiling clip base module", which compiles >>>> all >>>> the >>>> *.te files. >>> >>> >>> Only the .te files corresponding to those set to "base" in >>> modules.conf. Those listed as "module" will be built at a later step >>> and will not be present in base.pp. >>>> >>>> >>>> which, of course, includes sysadm. >>>> >>>> The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, >>>> clip-selinux-policy-6.2.0-1.src.rpm, >>>> clip-selinux-policy-6.2.0.tar.gz. >>>> >>>> Should install clip-selinux-policy-6.2.0-1.noarch.rpm? >>> >>> >>> Yes the tarball is a side-effect of how things are built. The RPM is >>> the one you want. But there should be several files ending in .rpm. >>> Is that not the case? >>>> >>>> >>>> 3) If I'm making small modifications to one of the canonical CLIP >>>> modules >>>> (system, role, etc.) is there something less that replacing the >>>> policy >>>> tree? >>>> That's why I build the sysadm.pp. >>> >>> >>> Honestly the easiest way is to just roll the updated RPMs and install >>> them on your system/. Thus, you will get an updated sysadm policy as >>> well. >>> >>> Are you just trying to build a policy for a single, >>> previously-deployed system? If so, there are other ways. But if >>> you're trying to do reproducible builds for inclusion in a bigger >>> environment using RPMs for updating policies is reommended. >>> >>> >>>> >>>> 4) If I'm creating policies unique to this project, should I create >>>> a >>>> directory under policy/modules/<project> and run: make conf? Use >>>> LOCAL_ROOT >>>> to point to a policy source tree hanging off the project root? Just >>>> trying >>>> to come up with some process/strategy that's flexible and >>>> defensible. Of >>>> course LOCAL_ROOT is defined in the Makefile in >>>> packages/clip-selinux-policy/clip-selinux-policy and I'd be building >>>> *.pp >>>> files? Maybe this is OK for new policy code? >>>> >>> >>> Gotcha. So yes you're taking the right approach by introducing a new >>> policy/modules/<project> directory and adding a metadata.xml file in >>> there to describe that project. Then run make conf to have that >>> project added to the correct configuration files. >>> >>> Aside from make conf, I wouldn't use any other make commands in the >>> policy directory as it will lead to problems. LOCAL_ROOT is a decent >>> option if you're trying to build out of tree policies for, say, a >>> single system. Actually I think I implemented that feature years >>> ago.... >>> >>> Basically, I would add your project folder, run make conf, then start >>> modifying all of the policy components you need to modify. For >>> testing and deployment I would suggest replacing the entire set of >>> RPMs by rebuilding the RPMs with make rpm, and reinstalling them >>> (with >>> --force if you didn't bump the release number). >>> >>> I have some changes in my github tree #next branch that haven't been >>> merged into our main tree yet. Specifically, we can now roll RPMs >>> for >>> individual policy packages via a SEPRATE_PKGS variable in the >>> Makefile. This might be useful for you because you can rebuild the >>> RPMs and, by specifying sysadm as a SEPARATE_PKG, you will get that >>> package as a separate, isolated RPM. But these changes are in QA now >>> and haven't been merged into our main repo so take those with a grain >>> of salt. >>> >>> Thanks, >>> --Spencer >>>> >>>> >>>> ---John >>>> >>>> >>>> >>>> Been inspecting the "other" make (in packages/clip-selinux-policy v. >>>> packages/clip-selinux-policy/clip-selinux-policy). >>>> >>>> On 2015-03-20 00:33, Spencer Shimko wrote: >>>>> >>>>> >>>>> Trimmed SELinux mailing list form CCs. >>>>> >>>>> Did you try the the suggestions in my on-list response a little >>>>> while >>>>> ago? >>>>> >>>>> On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski >>>>> <john.chludzinski@vivaldi.net> wrote: >>>>>> >>>>>> >>>>>> I ran (when under the role sysadm_r and type sysadm_t): >>>>>> >>>>>> $ id -Z >>>>>> >>>>>> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >>>>>> >>>>>> So now I'm assuming the CLIP image is at "s0" sensitivity level. >>>>>> >>>>>> Then I noticed that the build.conf file states: "The sensitivities >>>>>> will >>>>>> be >>>>>> s0 to s(MLS_SENS-1)". >>>>>> >>>>>> So I built using: >>>>>> >>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >>>>>> >>>>>> to get an "s0" sensitivity level. >>>>>> >>>>>> Tried to install and now I get: "duplicate declaration in module: >>>>>> type/attribute sysadm_userhelper_t". >>>>>> (A "Whac-A-Mole" game!) >>>>>> >>>>>> ---John >>>>>> >>>>>> >>>>>> On 2015-03-19 21:31, John Chludzinski wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> First thing ... I'm a newbie to SELinux. >>>>>>> >>>>>>> I'm trying to update the sysadm module in a CLIP image. I >>>>>>> downloaded >>>>>>> the SELinux policy code from: >>>>>>> https://github.com/QuarkSecurity/CLIP. >>>>>>> I modified the sysadm policy code and built (in >>>>>>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>>>>>> >>>>>>> $ make modules APPS_MODS="sysadm" >>>>>>> >>>>>>> Then I tried to install in the CLIP image using: >>>>>>> >>>>>>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>>>>>> >>>>>>> and got: "tried to link in a non-MLS module with an MLS base". (I >>>>>>> assume this means the CLIP image I'm working with is MLS?) >>>>>>> Next I built using: >>>>>>> >>>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>>>>>> >>>>>>> Tried to load/install the module and got: "sensitivy s10 not >>>>>>> declared >>>>>>> by >>>>>>> base." >>>>>>> >>>>>>> Next I tried: >>>>>>> >>>>>>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >>>>>>> >>>>>>> and !still! got "sensitivy s10 not declared by base". >>>>>>> >>>>>>> Any suggestions/thoughts? >>>>>>> >>>>>>> ---John >>>>>>> _______________________________________________ >>>>>>> Selinux mailing list >>>>>>> Selinux@tycho.nsa.gov >>>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>>>> To get help, send an email containing "help" to >>>>>>> Selinux-request@tycho.nsa.gov. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> Selinux mailing list >>>>>> Selinux@tycho.nsa.gov >>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>>> To get help, send an email containing "help" to >>>>>> Selinux-request@tycho.nsa.gov. >>>> >>>> >>>> >> >> _______________________________________________ >> Selinux mailing list >> Selinux@tycho.nsa.gov >> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >> To get help, send an email containing "help" to >> Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-23 17:36 ` John Chludzinski @ 2015-03-23 18:12 ` Mike Palmiotto 2015-03-23 18:22 ` Brandon Whalen 1 sibling, 0 replies; 14+ messages in thread From: Mike Palmiotto @ 2015-03-23 18:12 UTC (permalink / raw) To: John Chludzinski; +Cc: clip, Selinux Linking the CLIP mailing list back in. Responses in-line below. On Mon, 23 Mar 2015 18:36:44 +0100 John Chludzinski <john.chludzinski@vivaldi.net> wrote: > 1st, I don't see an MCS build option in > packages/clip-selinux-policy/Makefile. How would I build this? > > 2nd, when last I tried to load/install a non-MLS module (e.g., > sysadm.pp) into CLIP, it refused saying "trying to load non-MLS > module into MLS base". Take a look at the "TYPE" build flag. It is referenced in packages/clip-selinux-policy/Makefile, but I'm not entirely sure that you need to do anything with this. The installCmds macro is used to build both mls and mcs policies. If you look at packages/clip-selinux-policy/clip-selinux-policy.spec, the mcs policy goes by the name clip-selinux-policy-clip, as referenced by Tom Hurd earlier in the chain. I would recommend keeping sysadm = base in your modules.conf and installing the mcs policy clip-selinux-policy-clip-6.2.0-1.noarch.rpm. --Mike > > > ---John > > > On 2015-03-23 17:01, Brandon Whalen wrote: > > On Mon, Mar 23, 2015 at 11:16 AM, John Chludzinski > > <john.chludzinski@vivaldi.net> wrote: > >> I took the liberty of examining the contents of > >> clip-selinux-policy-6.2.0-1.noarch.rpm: > >> > >> $ rpm -qpl clip-selinux-policy-6.2.0-1.noarch.rpm > >> > >> $ rpm2cpio clip-selinux-policy-6.2.0-1.noarch.rpm | cpio -idmv > >> > >> and found the RPM contains nothing but *.if files for the modules > >> + gzipped > >> man pages + a Makefile. > >> > >> It contains NO *.pp files nor does it include any *.te and *.fc to > >> build > >> *.pp files from. > >> > >> So installing clip-selinux-policy-6.2.0-1.noarch.rpm is for what? > > > > It's basically an RPM that installs header files and man pages. The > > .if file declares interfaces to other modules, so its very much like > > header information for SELinux policy. The one with the .pp files > > should be named clip-selinux-policy-6.2.0-1-mls.noarch.rpm. If you > > were building mcs it would > > clip-selinux-policy-6.2.0-1-mcs.noarch.rpm. > > > >> > >> ---John > >> > >> On 2015-03-20 23:07, Spencer Shimko wrote: > >>> > >>> On Fri, Mar 20, 2015 at 5:43 PM, John Chludzinski > >>> <john.chludzinski@vivaldi.net> wrote: > >>>> > >>>> 1) I noticed > >>>> packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf > >>>> defines > >>>> the the modules that are built into a base.pp: > >>>> > >>>> packages/clip-selinux-policy/clip-selinux-policy/ > make base > >>>> TYPE="mls" > >>>> MLS_SENS=1 > >>>> > >>>> which includes sysadm. Is this something of any interest? > >>> > >>> > >>> As long as modules.conf declares something as base, it will be in > >>> base. This is interesting because you have made made me think > >>> about a > >>> circumstance that will break something in my tree pending merge > >>> into our QSI tree (my #next branch in sshimko on github). > >>> Neither here nor > >>> there, yes, it will be in base if it is defined as base in > >>> modules.conf. > >>>> > >>>> > >>>> 2) Reading the output from: > >>>> > >>>> packages/clip-selinux-policy/ > make rpm > >>>> > >>>> I noticed it contains: "Compiling clip base module", which > >>>> compiles all > >>>> the > >>>> *.te files. > >>> > >>> > >>> Only the .te files corresponding to those set to "base" in > >>> modules.conf. Those listed as "module" will be built at a later > >>> step and will not be present in base.pp. > >>>> > >>>> > >>>> which, of course, includes sysadm. > >>>> > >>>> The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, > >>>> clip-selinux-policy-6.2.0-1.src.rpm, > >>>> clip-selinux-policy-6.2.0.tar.gz. > >>>> > >>>> Should install clip-selinux-policy-6.2.0-1.noarch.rpm? > >>> > >>> > >>> Yes the tarball is a side-effect of how things are built. The > >>> RPM is the one you want. But there should be several files > >>> ending in .rpm. Is that not the case? > >>>> > >>>> > >>>> 3) If I'm making small modifications to one of the canonical > >>>> CLIP modules > >>>> (system, role, etc.) is there something less that replacing the > >>>> policy > >>>> tree? > >>>> That's why I build the sysadm.pp. > >>> > >>> > >>> Honestly the easiest way is to just roll the updated RPMs and > >>> install them on your system/. Thus, you will get an updated > >>> sysadm policy as well. > >>> > >>> Are you just trying to build a policy for a single, > >>> previously-deployed system? If so, there are other ways. But if > >>> you're trying to do reproducible builds for inclusion in a bigger > >>> environment using RPMs for updating policies is reommended. > >>> > >>> > >>>> > >>>> 4) If I'm creating policies unique to this project, should I > >>>> create a > >>>> directory under policy/modules/<project> and run: make conf? Use > >>>> LOCAL_ROOT > >>>> to point to a policy source tree hanging off the project root? > >>>> Just trying > >>>> to come up with some process/strategy that's flexible and > >>>> defensible. Of > >>>> course LOCAL_ROOT is defined in the Makefile in > >>>> packages/clip-selinux-policy/clip-selinux-policy and I'd be > >>>> building *.pp > >>>> files? Maybe this is OK for new policy code? > >>>> > >>> > >>> Gotcha. So yes you're taking the right approach by introducing a > >>> new policy/modules/<project> directory and adding a metadata.xml > >>> file in there to describe that project. Then run make conf to > >>> have that project added to the correct configuration files. > >>> > >>> Aside from make conf, I wouldn't use any other make commands in > >>> the policy directory as it will lead to problems. LOCAL_ROOT is > >>> a decent option if you're trying to build out of tree policies > >>> for, say, a single system. Actually I think I implemented that > >>> feature years ago.... > >>> > >>> Basically, I would add your project folder, run make conf, then > >>> start modifying all of the policy components you need to modify. > >>> For testing and deployment I would suggest replacing the entire > >>> set of RPMs by rebuilding the RPMs with make rpm, and > >>> reinstalling them (with > >>> --force if you didn't bump the release number). > >>> > >>> I have some changes in my github tree #next branch that haven't > >>> been merged into our main tree yet. Specifically, we can now > >>> roll RPMs for > >>> individual policy packages via a SEPRATE_PKGS variable in the > >>> Makefile. This might be useful for you because you can rebuild > >>> the RPMs and, by specifying sysadm as a SEPARATE_PKG, you will > >>> get that package as a separate, isolated RPM. But these changes > >>> are in QA now and haven't been merged into our main repo so take > >>> those with a grain of salt. > >>> > >>> Thanks, > >>> --Spencer > >>>> > >>>> > >>>> ---John > >>>> > >>>> > >>>> > >>>> Been inspecting the "other" make (in > >>>> packages/clip-selinux-policy v. > >>>> packages/clip-selinux-policy/clip-selinux-policy). > >>>> > >>>> On 2015-03-20 00:33, Spencer Shimko wrote: > >>>>> > >>>>> > >>>>> Trimmed SELinux mailing list form CCs. > >>>>> > >>>>> Did you try the the suggestions in my on-list response a little > >>>>> while > >>>>> ago? > >>>>> > >>>>> On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski > >>>>> <john.chludzinski@vivaldi.net> wrote: > >>>>>> > >>>>>> > >>>>>> I ran (when under the role sysadm_r and type sysadm_t): > >>>>>> > >>>>>> $ id -Z > >>>>>> > >>>>>> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 > >>>>>> > >>>>>> So now I'm assuming the CLIP image is at "s0" sensitivity > >>>>>> level. > >>>>>> > >>>>>> Then I noticed that the build.conf file states: "The > >>>>>> sensitivities will > >>>>>> be > >>>>>> s0 to s(MLS_SENS-1)". > >>>>>> > >>>>>> So I built using: > >>>>>> > >>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 > >>>>>> > >>>>>> to get an "s0" sensitivity level. > >>>>>> > >>>>>> Tried to install and now I get: "duplicate declaration in > >>>>>> module: type/attribute sysadm_userhelper_t". > >>>>>> (A "Whac-A-Mole" game!) > >>>>>> > >>>>>> ---John > >>>>>> > >>>>>> > >>>>>> On 2015-03-19 21:31, John Chludzinski wrote: > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> First thing ... I'm a newbie to SELinux. > >>>>>>> > >>>>>>> I'm trying to update the sysadm module in a CLIP image. I > >>>>>>> downloaded > >>>>>>> the SELinux policy code from: > >>>>>>> https://github.com/QuarkSecurity/CLIP. > >>>>>>> I modified the sysadm policy code and built (in > >>>>>>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) > >>>>>>> using: > >>>>>>> > >>>>>>> $ make modules APPS_MODS="sysadm" > >>>>>>> > >>>>>>> Then I tried to install in the CLIP image using: > >>>>>>> > >>>>>>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp > >>>>>>> > >>>>>>> and got: "tried to link in a non-MLS module with an MLS > >>>>>>> base". (I assume this means the CLIP image I'm working with > >>>>>>> is MLS?) Next I built using: > >>>>>>> > >>>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" > >>>>>>> > >>>>>>> Tried to load/install the module and got: "sensitivy s10 not > >>>>>>> declared > >>>>>>> by > >>>>>>> base." > >>>>>>> > >>>>>>> Next I tried: > >>>>>>> > >>>>>>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" > >>>>>>> MLS_SENS=15 > >>>>>>> > >>>>>>> and !still! got "sensitivy s10 not declared by base". > >>>>>>> > >>>>>>> Any suggestions/thoughts? > >>>>>>> > >>>>>>> ---John > >>>>>>> _______________________________________________ > >>>>>>> Selinux mailing list > >>>>>>> Selinux@tycho.nsa.gov > >>>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > >>>>>>> To get help, send an email containing "help" to > >>>>>>> Selinux-request@tycho.nsa.gov. > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> _______________________________________________ > >>>>>> Selinux mailing list > >>>>>> Selinux@tycho.nsa.gov > >>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > >>>>>> To get help, send an email containing "help" to > >>>>>> Selinux-request@tycho.nsa.gov. > >>>> > >>>> > >>>> > >> > >> _______________________________________________ > >> Selinux mailing list > >> Selinux@tycho.nsa.gov > >> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > >> To get help, send an email containing "help" to > >> Selinux-request@tycho.nsa.gov. > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to > Selinux-request@tycho.nsa.gov. ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-23 17:36 ` John Chludzinski 2015-03-23 18:12 ` Mike Palmiotto @ 2015-03-23 18:22 ` Brandon Whalen 2015-03-23 19:01 ` John Chludzinski 1 sibling, 1 reply; 14+ messages in thread From: Brandon Whalen @ 2015-03-23 18:22 UTC (permalink / raw) To: John Chludzinski; +Cc: Selinux On Mon, Mar 23, 2015 at 1:36 PM, John Chludzinski <john.chludzinski@vivaldi.net> wrote: > 1st, I don't see an MCS build option in > packages/clip-selinux-policy/Makefile. How would I build this? > I'm sorry I'm confusing you. Since you are building the mls version you could use clip-selinux-policy-mls-6.2.0-1.noarch.rpm. When I look at what is in that file I see the pp files. clip-selinux-policy-mls /usr/share/selinux/mls clip-selinux-policy-mls /usr/share/selinux/mls/aide.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/base.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/consoletype.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/cron.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/firstboot.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/gpg.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/hal.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/java.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/logrotate.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/logwatch.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/modules.lst clip-selinux-policy-mls /usr/share/selinux/mls/mta.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/ntp.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/oscap.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/plymouthd.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/policykit.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/postfix.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/rpm.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/samhain.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/secstate.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/sendmail.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/seunshare.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/ssh.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/toor.pp.bz2 clip-selinux-policy-mls /usr/share/selinux/mls/tripwire.pp.bz2 If you want to replace the entire policy, you would just make sure sysadm is listed as base in modules.conf, run 'make clip-selinux-policy-rpm' and re-install the policy. You probably want to bump the policy version as well since you made a change. If this is just for development/testing than I'd suggest you make sure sysadm is listed as base in modules.conf, go to 'packages/clip-selinux-policy/clip-selinux-policy/' and build the modules using 'make' then copy over and reload the base.pp module. Reinstalling the RPM is overkill to replace one module during testing IMHO. > 2nd, when last I tried to load/install a non-MLS module (e.g., sysadm.pp) > into CLIP, it refused saying "trying to load non-MLS module into MLS base". > > > ---John > > > > On 2015-03-23 17:01, Brandon Whalen wrote: >> >> On Mon, Mar 23, 2015 at 11:16 AM, John Chludzinski >> <john.chludzinski@vivaldi.net> wrote: >>> >>> I took the liberty of examining the contents of >>> clip-selinux-policy-6.2.0-1.noarch.rpm: >>> >>> $ rpm -qpl clip-selinux-policy-6.2.0-1.noarch.rpm >>> >>> $ rpm2cpio clip-selinux-policy-6.2.0-1.noarch.rpm | cpio -idmv >>> >>> and found the RPM contains nothing but *.if files for the modules + >>> gzipped >>> man pages + a Makefile. >>> >>> It contains NO *.pp files nor does it include any *.te and *.fc to build >>> *.pp files from. >>> >>> So installing clip-selinux-policy-6.2.0-1.noarch.rpm is for what? >> >> >> It's basically an RPM that installs header files and man pages. The >> .if file declares interfaces to other modules, so its very much like >> header information for SELinux policy. The one with the .pp files >> should be named clip-selinux-policy-6.2.0-1-mls.noarch.rpm. If you >> were building mcs it would clip-selinux-policy-6.2.0-1-mcs.noarch.rpm. >> >>> >>> ---John >>> >>> On 2015-03-20 23:07, Spencer Shimko wrote: >>>> >>>> >>>> On Fri, Mar 20, 2015 at 5:43 PM, John Chludzinski >>>> <john.chludzinski@vivaldi.net> wrote: >>>>> >>>>> >>>>> 1) I noticed >>>>> packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf >>>>> defines >>>>> the the modules that are built into a base.pp: >>>>> >>>>> packages/clip-selinux-policy/clip-selinux-policy/ > make base >>>>> TYPE="mls" >>>>> MLS_SENS=1 >>>>> >>>>> which includes sysadm. Is this something of any interest? >>>> >>>> >>>> >>>> As long as modules.conf declares something as base, it will be in >>>> base. This is interesting because you have made made me think about a >>>> circumstance that will break something in my tree pending merge into >>>> our QSI tree (my #next branch in sshimko on github). Neither here nor >>>> there, yes, it will be in base if it is defined as base in >>>> modules.conf. >>>>> >>>>> >>>>> >>>>> 2) Reading the output from: >>>>> >>>>> packages/clip-selinux-policy/ > make rpm >>>>> >>>>> I noticed it contains: "Compiling clip base module", which compiles all >>>>> the >>>>> *.te files. >>>> >>>> >>>> >>>> Only the .te files corresponding to those set to "base" in >>>> modules.conf. Those listed as "module" will be built at a later step >>>> and will not be present in base.pp. >>>>> >>>>> >>>>> >>>>> which, of course, includes sysadm. >>>>> >>>>> The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, >>>>> clip-selinux-policy-6.2.0-1.src.rpm, clip-selinux-policy-6.2.0.tar.gz. >>>>> >>>>> Should install clip-selinux-policy-6.2.0-1.noarch.rpm? >>>> >>>> >>>> >>>> Yes the tarball is a side-effect of how things are built. The RPM is >>>> the one you want. But there should be several files ending in .rpm. >>>> Is that not the case? >>>>> >>>>> >>>>> >>>>> 3) If I'm making small modifications to one of the canonical CLIP >>>>> modules >>>>> (system, role, etc.) is there something less that replacing the policy >>>>> tree? >>>>> That's why I build the sysadm.pp. >>>> >>>> >>>> >>>> Honestly the easiest way is to just roll the updated RPMs and install >>>> them on your system/. Thus, you will get an updated sysadm policy as >>>> well. >>>> >>>> Are you just trying to build a policy for a single, >>>> previously-deployed system? If so, there are other ways. But if >>>> you're trying to do reproducible builds for inclusion in a bigger >>>> environment using RPMs for updating policies is reommended. >>>> >>>> >>>>> >>>>> 4) If I'm creating policies unique to this project, should I create a >>>>> directory under policy/modules/<project> and run: make conf? Use >>>>> LOCAL_ROOT >>>>> to point to a policy source tree hanging off the project root? Just >>>>> trying >>>>> to come up with some process/strategy that's flexible and defensible. >>>>> Of >>>>> course LOCAL_ROOT is defined in the Makefile in >>>>> packages/clip-selinux-policy/clip-selinux-policy and I'd be building >>>>> *.pp >>>>> files? Maybe this is OK for new policy code? >>>>> >>>> >>>> Gotcha. So yes you're taking the right approach by introducing a new >>>> policy/modules/<project> directory and adding a metadata.xml file in >>>> there to describe that project. Then run make conf to have that >>>> project added to the correct configuration files. >>>> >>>> Aside from make conf, I wouldn't use any other make commands in the >>>> policy directory as it will lead to problems. LOCAL_ROOT is a decent >>>> option if you're trying to build out of tree policies for, say, a >>>> single system. Actually I think I implemented that feature years >>>> ago.... >>>> >>>> Basically, I would add your project folder, run make conf, then start >>>> modifying all of the policy components you need to modify. For >>>> testing and deployment I would suggest replacing the entire set of >>>> RPMs by rebuilding the RPMs with make rpm, and reinstalling them (with >>>> --force if you didn't bump the release number). >>>> >>>> I have some changes in my github tree #next branch that haven't been >>>> merged into our main tree yet. Specifically, we can now roll RPMs for >>>> individual policy packages via a SEPRATE_PKGS variable in the >>>> Makefile. This might be useful for you because you can rebuild the >>>> RPMs and, by specifying sysadm as a SEPARATE_PKG, you will get that >>>> package as a separate, isolated RPM. But these changes are in QA now >>>> and haven't been merged into our main repo so take those with a grain >>>> of salt. >>>> >>>> Thanks, >>>> --Spencer >>>>> >>>>> >>>>> >>>>> ---John >>>>> >>>>> >>>>> >>>>> Been inspecting the "other" make (in packages/clip-selinux-policy v. >>>>> packages/clip-selinux-policy/clip-selinux-policy). >>>>> >>>>> On 2015-03-20 00:33, Spencer Shimko wrote: >>>>>> >>>>>> >>>>>> >>>>>> Trimmed SELinux mailing list form CCs. >>>>>> >>>>>> Did you try the the suggestions in my on-list response a little while >>>>>> ago? >>>>>> >>>>>> On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski >>>>>> <john.chludzinski@vivaldi.net> wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> I ran (when under the role sysadm_r and type sysadm_t): >>>>>>> >>>>>>> $ id -Z >>>>>>> >>>>>>> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >>>>>>> >>>>>>> So now I'm assuming the CLIP image is at "s0" sensitivity level. >>>>>>> >>>>>>> Then I noticed that the build.conf file states: "The sensitivities >>>>>>> will >>>>>>> be >>>>>>> s0 to s(MLS_SENS-1)". >>>>>>> >>>>>>> So I built using: >>>>>>> >>>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >>>>>>> >>>>>>> to get an "s0" sensitivity level. >>>>>>> >>>>>>> Tried to install and now I get: "duplicate declaration in module: >>>>>>> type/attribute sysadm_userhelper_t". >>>>>>> (A "Whac-A-Mole" game!) >>>>>>> >>>>>>> ---John >>>>>>> >>>>>>> >>>>>>> On 2015-03-19 21:31, John Chludzinski wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> First thing ... I'm a newbie to SELinux. >>>>>>>> >>>>>>>> I'm trying to update the sysadm module in a CLIP image. I downloaded >>>>>>>> the SELinux policy code from: https://github.com/QuarkSecurity/CLIP. >>>>>>>> I modified the sysadm policy code and built (in >>>>>>>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>>>>>>> >>>>>>>> $ make modules APPS_MODS="sysadm" >>>>>>>> >>>>>>>> Then I tried to install in the CLIP image using: >>>>>>>> >>>>>>>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>>>>>>> >>>>>>>> and got: "tried to link in a non-MLS module with an MLS base". (I >>>>>>>> assume this means the CLIP image I'm working with is MLS?) >>>>>>>> Next I built using: >>>>>>>> >>>>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>>>>>>> >>>>>>>> Tried to load/install the module and got: "sensitivy s10 not >>>>>>>> declared >>>>>>>> by >>>>>>>> base." >>>>>>>> >>>>>>>> Next I tried: >>>>>>>> >>>>>>>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" MLS_SENS=15 >>>>>>>> >>>>>>>> and !still! got "sensitivy s10 not declared by base". >>>>>>>> >>>>>>>> Any suggestions/thoughts? >>>>>>>> >>>>>>>> ---John >>>>>>>> _______________________________________________ >>>>>>>> Selinux mailing list >>>>>>>> Selinux@tycho.nsa.gov >>>>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>>>>> To get help, send an email containing "help" to >>>>>>>> Selinux-request@tycho.nsa.gov. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> _______________________________________________ >>>>>>> Selinux mailing list >>>>>>> Selinux@tycho.nsa.gov >>>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>>>> To get help, send an email containing "help" to >>>>>>> Selinux-request@tycho.nsa.gov. >>>>> >>>>> >>>>> >>>>> >>> >>> _______________________________________________ >>> Selinux mailing list >>> Selinux@tycho.nsa.gov >>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>> To get help, send an email containing "help" to >>> Selinux-request@tycho.nsa.gov. > > ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: Trying to update sysadm module in CLIP 2015-03-23 18:22 ` Brandon Whalen @ 2015-03-23 19:01 ` John Chludzinski 0 siblings, 0 replies; 14+ messages in thread From: John Chludzinski @ 2015-03-23 19:01 UTC (permalink / raw) To: Brandon Whalen; +Cc: Selinux Before you sent this I was trying out: $ make clip-selinux-policy-rpm I noticed from the output that it was creating RPM files in: tmp/src/redhat/RPMS/noarch/ which contains: clip-selinux-policy-mls-6.2.0-1.noarch.rpm clip-selinux-policy-clip-6.2.0-1.noarch.rpm clip-selinux-policy-doc-6.2.0-1.noarch.rpm And clip-selinux-policy-clip-6.2.0-1.noarch.rpm contains: /usr/share/selinux/clip/aide.pp.bz2 /usr/share/selinux/clip/base.pp.bz2 /usr/share/selinux/clip/consoletype.pp.bz2 /usr/share/selinux/clip/cron.pp.bz2 /usr/share/selinux/clip/firstboot.pp.bz2 /usr/share/selinux/clip/gpg.pp.bz2 /usr/share/selinux/clip/hal.pp.bz2 /usr/share/selinux/clip/java.pp.bz2 /usr/share/selinux/clip/logrotate.pp.bz2 /usr/share/selinux/clip/logwatch.pp.bz2 /usr/share/selinux/clip/modules.lst /usr/share/selinux/clip/mta.pp.bz2 /usr/share/selinux/clip/ntp.pp.bz2 /usr/share/selinux/clip/oscap.pp.bz2 /usr/share/selinux/clip/plymouthd.pp.bz2 /usr/share/selinux/clip/policykit.pp.bz2 /usr/share/selinux/clip/postfix.pp.bz2 /usr/share/selinux/clip/rpm.pp.bz2 /usr/share/selinux/clip/samhain.pp.bz2 /usr/share/selinux/clip/secstate.pp.bz2 /usr/share/selinux/clip/sendmail.pp.bz2 /usr/share/selinux/clip/seunshare.pp.bz2 /usr/share/selinux/clip/ssh.pp.bz2 /usr/share/selinux/clip/toor.pp.bz2 /usr/share/selinux/clip/tripwire.pp.bz2 So I assume that I should install clip-selinux-policy-clip-6.2.0-1.noarch.rpm and then "semodule -i" these *.pp files into CLIP? Once I have added my changes, of course. ---John On 2015-03-23 19:22, Brandon Whalen wrote: > On Mon, Mar 23, 2015 at 1:36 PM, John Chludzinski > <john.chludzinski@vivaldi.net> wrote: >> 1st, I don't see an MCS build option in >> packages/clip-selinux-policy/Makefile. How would I build this? >> > > I'm sorry I'm confusing you. Since you are building the mls version > you could use clip-selinux-policy-mls-6.2.0-1.noarch.rpm. When I look > at what is in that file I see the pp files. > > clip-selinux-policy-mls /usr/share/selinux/mls > clip-selinux-policy-mls /usr/share/selinux/mls/aide.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/base.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/consoletype.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/cron.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/firstboot.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/gpg.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/hal.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/java.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/logrotate.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/logwatch.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/modules.lst > clip-selinux-policy-mls /usr/share/selinux/mls/mta.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/ntp.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/oscap.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/plymouthd.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/policykit.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/postfix.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/rpm.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/samhain.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/secstate.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/sendmail.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/seunshare.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/ssh.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/toor.pp.bz2 > clip-selinux-policy-mls /usr/share/selinux/mls/tripwire.pp.bz2 > > If you want to replace the entire policy, you would just make sure > sysadm is listed as base in modules.conf, run 'make > clip-selinux-policy-rpm' and re-install the policy. You probably want > to bump the policy version as well since you made a change. > > If this is just for development/testing than I'd suggest you make sure > sysadm is listed as base in modules.conf, go to > 'packages/clip-selinux-policy/clip-selinux-policy/' and build the > modules using 'make' then copy over and reload the base.pp module. > Reinstalling the RPM is overkill to replace one module during testing > IMHO. > >> 2nd, when last I tried to load/install a non-MLS module (e.g., >> sysadm.pp) >> into CLIP, it refused saying "trying to load non-MLS module into MLS >> base". >> >> >> ---John >> >> >> >> On 2015-03-23 17:01, Brandon Whalen wrote: >>> >>> On Mon, Mar 23, 2015 at 11:16 AM, John Chludzinski >>> <john.chludzinski@vivaldi.net> wrote: >>>> >>>> I took the liberty of examining the contents of >>>> clip-selinux-policy-6.2.0-1.noarch.rpm: >>>> >>>> $ rpm -qpl clip-selinux-policy-6.2.0-1.noarch.rpm >>>> >>>> $ rpm2cpio clip-selinux-policy-6.2.0-1.noarch.rpm | cpio -idmv >>>> >>>> and found the RPM contains nothing but *.if files for the modules + >>>> gzipped >>>> man pages + a Makefile. >>>> >>>> It contains NO *.pp files nor does it include any *.te and *.fc to >>>> build >>>> *.pp files from. >>>> >>>> So installing clip-selinux-policy-6.2.0-1.noarch.rpm is for what? >>> >>> >>> It's basically an RPM that installs header files and man pages. The >>> .if file declares interfaces to other modules, so its very much like >>> header information for SELinux policy. The one with the .pp files >>> should be named clip-selinux-policy-6.2.0-1-mls.noarch.rpm. If you >>> were building mcs it would >>> clip-selinux-policy-6.2.0-1-mcs.noarch.rpm. >>> >>>> >>>> ---John >>>> >>>> On 2015-03-20 23:07, Spencer Shimko wrote: >>>>> >>>>> >>>>> On Fri, Mar 20, 2015 at 5:43 PM, John Chludzinski >>>>> <john.chludzinski@vivaldi.net> wrote: >>>>>> >>>>>> >>>>>> 1) I noticed >>>>>> packages/clip-selinux-policy/clip-selinux-policy/policy/modules.conf >>>>>> defines >>>>>> the the modules that are built into a base.pp: >>>>>> >>>>>> packages/clip-selinux-policy/clip-selinux-policy/ > make base >>>>>> TYPE="mls" >>>>>> MLS_SENS=1 >>>>>> >>>>>> which includes sysadm. Is this something of any interest? >>>>> >>>>> >>>>> >>>>> As long as modules.conf declares something as base, it will be in >>>>> base. This is interesting because you have made made me think >>>>> about a >>>>> circumstance that will break something in my tree pending merge >>>>> into >>>>> our QSI tree (my #next branch in sshimko on github). Neither here >>>>> nor >>>>> there, yes, it will be in base if it is defined as base in >>>>> modules.conf. >>>>>> >>>>>> >>>>>> >>>>>> 2) Reading the output from: >>>>>> >>>>>> packages/clip-selinux-policy/ > make rpm >>>>>> >>>>>> I noticed it contains: "Compiling clip base module", which >>>>>> compiles all >>>>>> the >>>>>> *.te files. >>>>> >>>>> >>>>> >>>>> Only the .te files corresponding to those set to "base" in >>>>> modules.conf. Those listed as "module" will be built at a later >>>>> step >>>>> and will not be present in base.pp. >>>>>> >>>>>> >>>>>> >>>>>> which, of course, includes sysadm. >>>>>> >>>>>> The files created are: clip-selinux-policy-6.2.0-1.noarch.rpm, >>>>>> clip-selinux-policy-6.2.0-1.src.rpm, >>>>>> clip-selinux-policy-6.2.0.tar.gz. >>>>>> >>>>>> Should install clip-selinux-policy-6.2.0-1.noarch.rpm? >>>>> >>>>> >>>>> >>>>> Yes the tarball is a side-effect of how things are built. The RPM >>>>> is >>>>> the one you want. But there should be several files ending in >>>>> .rpm. >>>>> Is that not the case? >>>>>> >>>>>> >>>>>> >>>>>> 3) If I'm making small modifications to one of the canonical CLIP >>>>>> modules >>>>>> (system, role, etc.) is there something less that replacing the >>>>>> policy >>>>>> tree? >>>>>> That's why I build the sysadm.pp. >>>>> >>>>> >>>>> >>>>> Honestly the easiest way is to just roll the updated RPMs and >>>>> install >>>>> them on your system/. Thus, you will get an updated sysadm policy >>>>> as >>>>> well. >>>>> >>>>> Are you just trying to build a policy for a single, >>>>> previously-deployed system? If so, there are other ways. But if >>>>> you're trying to do reproducible builds for inclusion in a bigger >>>>> environment using RPMs for updating policies is reommended. >>>>> >>>>> >>>>>> >>>>>> 4) If I'm creating policies unique to this project, should I >>>>>> create a >>>>>> directory under policy/modules/<project> and run: make conf? Use >>>>>> LOCAL_ROOT >>>>>> to point to a policy source tree hanging off the project root? >>>>>> Just >>>>>> trying >>>>>> to come up with some process/strategy that's flexible and >>>>>> defensible. >>>>>> Of >>>>>> course LOCAL_ROOT is defined in the Makefile in >>>>>> packages/clip-selinux-policy/clip-selinux-policy and I'd be >>>>>> building >>>>>> *.pp >>>>>> files? Maybe this is OK for new policy code? >>>>>> >>>>> >>>>> Gotcha. So yes you're taking the right approach by introducing a >>>>> new >>>>> policy/modules/<project> directory and adding a metadata.xml file >>>>> in >>>>> there to describe that project. Then run make conf to have that >>>>> project added to the correct configuration files. >>>>> >>>>> Aside from make conf, I wouldn't use any other make commands in the >>>>> policy directory as it will lead to problems. LOCAL_ROOT is a >>>>> decent >>>>> option if you're trying to build out of tree policies for, say, a >>>>> single system. Actually I think I implemented that feature years >>>>> ago.... >>>>> >>>>> Basically, I would add your project folder, run make conf, then >>>>> start >>>>> modifying all of the policy components you need to modify. For >>>>> testing and deployment I would suggest replacing the entire set of >>>>> RPMs by rebuilding the RPMs with make rpm, and reinstalling them >>>>> (with >>>>> --force if you didn't bump the release number). >>>>> >>>>> I have some changes in my github tree #next branch that haven't >>>>> been >>>>> merged into our main tree yet. Specifically, we can now roll RPMs >>>>> for >>>>> individual policy packages via a SEPRATE_PKGS variable in the >>>>> Makefile. This might be useful for you because you can rebuild the >>>>> RPMs and, by specifying sysadm as a SEPARATE_PKG, you will get that >>>>> package as a separate, isolated RPM. But these changes are in QA >>>>> now >>>>> and haven't been merged into our main repo so take those with a >>>>> grain >>>>> of salt. >>>>> >>>>> Thanks, >>>>> --Spencer >>>>>> >>>>>> >>>>>> >>>>>> ---John >>>>>> >>>>>> >>>>>> >>>>>> Been inspecting the "other" make (in packages/clip-selinux-policy >>>>>> v. >>>>>> packages/clip-selinux-policy/clip-selinux-policy). >>>>>> >>>>>> On 2015-03-20 00:33, Spencer Shimko wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>> Trimmed SELinux mailing list form CCs. >>>>>>> >>>>>>> Did you try the the suggestions in my on-list response a little >>>>>>> while >>>>>>> ago? >>>>>>> >>>>>>> On Thu, Mar 19, 2015 at 6:38 PM, John Chludzinski >>>>>>> <john.chludzinski@vivaldi.net> wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> I ran (when under the role sysadm_r and type sysadm_t): >>>>>>>> >>>>>>>> $ id -Z >>>>>>>> >>>>>>>> and got: Xsysadm_u:sysadm_r:sysadm_t:s0 >>>>>>>> >>>>>>>> So now I'm assuming the CLIP image is at "s0" sensitivity level. >>>>>>>> >>>>>>>> Then I noticed that the build.conf file states: "The >>>>>>>> sensitivities >>>>>>>> will >>>>>>>> be >>>>>>>> s0 to s(MLS_SENS-1)". >>>>>>>> >>>>>>>> So I built using: >>>>>>>> >>>>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" MLS_SENS=1 >>>>>>>> >>>>>>>> to get an "s0" sensitivity level. >>>>>>>> >>>>>>>> Tried to install and now I get: "duplicate declaration in >>>>>>>> module: >>>>>>>> type/attribute sysadm_userhelper_t". >>>>>>>> (A "Whac-A-Mole" game!) >>>>>>>> >>>>>>>> ---John >>>>>>>> >>>>>>>> >>>>>>>> On 2015-03-19 21:31, John Chludzinski wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> First thing ... I'm a newbie to SELinux. >>>>>>>>> >>>>>>>>> I'm trying to update the sysadm module in a CLIP image. I >>>>>>>>> downloaded >>>>>>>>> the SELinux policy code from: >>>>>>>>> https://github.com/QuarkSecurity/CLIP. >>>>>>>>> I modified the sysadm policy code and built (in >>>>>>>>> ~/clip/packages/clip-selinux-policy/clip-selinux-policy) using: >>>>>>>>> >>>>>>>>> $ make modules APPS_MODS="sysadm" >>>>>>>>> >>>>>>>>> Then I tried to install in the CLIP image using: >>>>>>>>> >>>>>>>>> $ semodule -i /mnt/hdd/SELinix/sysadm.pp >>>>>>>>> >>>>>>>>> and got: "tried to link in a non-MLS module with an MLS base". >>>>>>>>> (I >>>>>>>>> assume this means the CLIP image I'm working with is MLS?) >>>>>>>>> Next I built using: >>>>>>>>> >>>>>>>>> $ make modules APPS_MODS="sysadm" TYPE="mls" >>>>>>>>> >>>>>>>>> Tried to load/install the module and got: "sensitivy s10 not >>>>>>>>> declared >>>>>>>>> by >>>>>>>>> base." >>>>>>>>> >>>>>>>>> Next I tried: >>>>>>>>> >>>>>>>>> $ make modules APPS_MODS="auditadm sysadm" TYPE="mls" >>>>>>>>> MLS_SENS=15 >>>>>>>>> >>>>>>>>> and !still! got "sensitivy s10 not declared by base". >>>>>>>>> >>>>>>>>> Any suggestions/thoughts? >>>>>>>>> >>>>>>>>> ---John >>>>>>>>> _______________________________________________ >>>>>>>>> Selinux mailing list >>>>>>>>> Selinux@tycho.nsa.gov >>>>>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>>>>>> To get help, send an email containing "help" to >>>>>>>>> Selinux-request@tycho.nsa.gov. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> _______________________________________________ >>>>>>>> Selinux mailing list >>>>>>>> Selinux@tycho.nsa.gov >>>>>>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>>>>>> To get help, send an email containing "help" to >>>>>>>> Selinux-request@tycho.nsa.gov. >>>>>> >>>>>> >>>>>> >>>>>> >>>> >>>> _______________________________________________ >>>> Selinux mailing list >>>> Selinux@tycho.nsa.gov >>>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. >>>> To get help, send an email containing "help" to >>>> Selinux-request@tycho.nsa.gov. >> >> ^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2015-03-23 19:02 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-03-19 20:31 Trying to update sysadm module in CLIP John Chludzinski
2015-03-19 21:54 ` Spencer Shimko
2015-03-19 22:38 ` John Chludzinski
2015-03-20 0:23 ` Brandon Whalen
2015-03-20 21:56 ` John Chludzinski
[not found] ` <CAGNxgPiBThm0SpAo-+1D2UsaFyVNY2AKpj56RFvt+8SrfxL-Jw@mail.gmail.com>
2015-03-20 22:14 ` John Chludzinski
2015-03-21 13:57 ` Brandon Whalen
2015-03-21 17:36 ` Thomas Hurd
[not found] ` <55d4ced56b5ade45f9635caa3bd622b9@vivaldi.net>
[not found] ` <CAGNxgPh1Tq+ipErajh4F7VSW57cMTiNC7ZWJOa+jpWYsyw_HOA@mail.gmail.com>
2015-03-23 15:16 ` John Chludzinski
2015-03-23 16:01 ` Brandon Whalen
2015-03-23 17:36 ` John Chludzinski
2015-03-23 18:12 ` Mike Palmiotto
2015-03-23 18:22 ` Brandon Whalen
2015-03-23 19:01 ` John Chludzinski
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.