Re: How can i configure this?

Re: How can i configure this?

[Stephen Smalley]

On Thu, 8 Nov 2001, Hugo F. Martinez wrote:

>     I've just have installed  selinux on my notebook to test it and
> implement it on several servers if all my test works, and for acomplish
> my tests in need your help if you can. On my new flask-kernel I've got
> several messages from the AVC reporting that an action is denied. For
> example i got the following when starting my pcmcia services:

What is your base platform (e.g. RedHat 7.1)?  Did you do a full
installation of SELinux?

> Nov  8 09:06:46 radon-ntb kernel: avc:  denied  { } for  pid=510
> exe=/sbin/cardmgr path=/dev dev=00:05 ino=1
> Nov  8 09:06:46 radon-ntb kernel:
> scontext=system_u:system_r:cardmgr_t
> Nov  8 09:06:46 radon-ntb kernel:
> tcontext=system_u:object_r:unlabeled_t
> Nov  8 09:06:46 radon-ntb kernel:    tclass=file

Is /dev just a normal directory in an ext2 filesystem, or are you
using devfs?

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: How can i configure this?

[Stephen Smalley]

On Thu, 8 Nov 2001, Hugo F. Martinez wrote:

> Sorry, I've got RedHat 7.1 and i did a full installation of SELinux
> following
> the Readme, and some tips from the Linux Magazine of september. Im using
> devfs

I'm curious about the tips, since I never saw that article and don't get
Linux Magazine.  In any event, this particular AVC denied message looks
like it is being caused by a problem in the SELinux support for assigning
security contexts to devfs entries, which is experimental and isn't being
actively used by us.  I'll have to look into it.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

How can i configure this?

[Hugo F. Martinez]

Hello:
    I've just have installed  selinux on my notebook to test it and
implement it on several servers if all my test works, and for acomplish
my tests in need your help if you can. On my new flask-kernel I've got
several messages from the AVC reporting that an action is denied. For
example i got the following when starting my pcmcia services:

Nov  8 09:06:46 radon-ntb kernel: Linux PCMCIA Card Services 3.1.22
Nov  8 09:06:46 radon-ntb kernel:   options:  [pci] [cardbus]
Nov  8 09:06:46 radon-ntb kernel: PCI: Found IRQ 11 for device 00:11.0
Nov  8 09:06:46 radon-ntb kernel: PCI: The same IRQ used for device
00:11.1
Nov  8 09:06:46 radon-ntb kernel: PCI: Found IRQ 11 for device 00:11.1
Nov  8 09:06:46 radon-ntb kernel: PCI: The same IRQ used for device
00:11.0
Nov  8 09:06:46 radon-ntb kernel: Yenta IRQ list 0698, PCI irq11
Nov  8 09:06:46 radon-ntb kernel: Socket status: 30000006
Nov  8 09:06:46 radon-ntb kernel: Yenta IRQ list 0698, PCI irq11
Nov  8 09:06:46 radon-ntb kernel: Socket status: 30000010
Nov  8 09:06:46 radon-ntb pcmcia:  cardmgr.
Nov  8 09:06:46 radon-ntb kernel: AVC: 9 messages suppressed.
Nov  8 09:06:46 radon-ntb kernel:
Nov  8 09:06:46 radon-ntb kernel: avc:  denied  { } for  pid=510
exe=/sbin/cardmgr path=/dev dev=00:05 ino=1
Nov  8 09:06:46 radon-ntb kernel:
scontext=system_u:system_r:cardmgr_t
Nov  8 09:06:46 radon-ntb kernel:
tcontext=system_u:object_r:unlabeled_t
Nov  8 09:06:46 radon-ntb kernel:    tclass=file
Nov  8 09:06:46 radon-ntb cardmgr[510]: starting, version is 3.1.22
Nov  8 09:06:46 radon-ntb rc: Starting pcmcia:  succeeded
Nov  8 09:06:47 radon-ntb random: Initializing random number generator:
succeeded
Nov  8 09:06:47 radon-ntb cardmgr[510]: no sockets found!
Nov  8 09:06:47 radon-ntb cardmgr[510]: exiting

My question is how i can modifiy the behavior of the AVC to make my
pcmcia cards work. Please can you give me an example.

Thanks in advance.

Hugo F. Martinez





*******************************************************************************************
Este mensaje y todos los archivos adjuntos a el son para uso exclusivo del destinatario y pueden contener informacion confidencial o propietaria, cuya divulgacion es sancionada por ley.

Si usted recibio este mensaje erroneamente, por favor notifiquenos respondiendo al remitente, borre el mensaje original y destruya las copias (impresas o grabadas en cualquier medio magnetico) que pueda haber realizado del mismo.

Todas las opiniones contenidas en este mail son propias del autor del mensaje y no necesariamente coinciden con las de CTI Movil o alguna de las empresas accionistas. La publicacion, uso, copia e impresion total o parcial de este mensaje o documentos adjuntos queda prohibida.

Muchas gracias
CTI Movil
*******************************************************************************************
This message and any attachments are for exclusive usage of an addressee and may contain confidential or privileged information whose disclosure is subject to penalty by law.

If you are not the addressee, please notify the sender by return e-mail, delete the original message and destroy any existing copy no matter if printed or recorded.

Any opinions contained in this e-mail are those of the author of the message and do not necessarily coincide with those of CTI Movil or its shareholders. No part of this message or attachments may be used or reproduced in any manner whatsoever.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: How can i configure this?

[Stephen Smalley]

On Thu, 8 Nov 2001, Stephen Smalley wrote:

> In any event, this particular AVC denied message looks
> like it is being caused by a problem in the SELinux support for assigning
> security contexts to devfs entries, which is experimental and isn't being
> actively used by us.  I'll have to look into it.

Hugo subsequently clarified via private email that he was using the old
(pre-LSM) SELinux prototype.  That prototype never supported assigning
security contexts to devfs entries, so it isn't surprising that they show
up as unlabeled_t, although it does look like there is a bug in the
assignment of the security class.  The devfs labeling support wasn't added
until the 2nd release of the LSM-based SELinux prototype (the 9/26
release).  However, as I mentioned above, even this support is
experimental and isn't being actively used by us, so I don't know how
well it will work for real devfs users.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com






--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: How can i configure this?

[Hugo F. Martinez]

Sorry, I've got RedHat 7.1 and i did a full installation of SELinux
following
the Readme, and some tips from the Linux Magazine of september. Im using
devfs

Stephen Smalley wrote:

> On Thu, 8 Nov 2001, Hugo F. Martinez wrote:
>
> >     I've just have installed  selinux on my notebook to test it and
> > implement it on several servers if all my test works, and for acomplish
> > my tests in need your help if you can. On my new flask-kernel I've got
> > several messages from the AVC reporting that an action is denied. For
> > example i got the following when starting my pcmcia services:
>
> What is your base platform (e.g. RedHat 7.1)?  Did you do a full
> installation of SELinux?
>
> > Nov  8 09:06:46 radon-ntb kernel: avc:  denied  { } for  pid=510
> > exe=/sbin/cardmgr path=/dev dev=00:05 ino=1
> > Nov  8 09:06:46 radon-ntb kernel:
> > scontext=system_u:system_r:cardmgr_t
> > Nov  8 09:06:46 radon-ntb kernel:
> > tcontext=system_u:object_r:unlabeled_t
> > Nov  8 09:06:46 radon-ntb kernel:    tclass=file
>
> Is /dev just a normal directory in an ext2 filesystem, or are you
> using devfs?
>
> --
> Stephen D. Smalley, NAI Labs
> ssmalley@nai.com


*******************************************************************************************
Este mensaje y todos los archivos adjuntos a el son para uso exclusivo del destinatario y pueden contener informacion confidencial o propietaria, cuya divulgacion es sancionada por ley.

Si usted recibio este mensaje erroneamente, por favor notifiquenos respondiendo al remitente, borre el mensaje original y destruya las copias (impresas o grabadas en cualquier medio magnetico) que pueda haber realizado del mismo.

Todas las opiniones contenidas en este mail son propias del autor del mensaje y no necesariamente coinciden con las de CTI Movil o alguna de las empresas accionistas. La publicacion, uso, copia e impresion total o parcial de este mensaje o documentos adjuntos queda prohibida.

Muchas gracias
CTI Movil
*******************************************************************************************
This message and any attachments are for exclusive usage of an addressee and may contain confidential or privileged information whose disclosure is subject to penalty by law.

If you are not the addressee, please notify the sender by return e-mail, delete the original message and destroy any existing copy no matter if printed or recorded.

Any opinions contained in this e-mail are those of the author of the message and do not necessarily coincide with those of CTI Movil or its shareholders. No part of this message or attachments may be used or reproduced in any manner whatsoever.

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.