init running at s9 by default on a MLS system?

init running at s9 by default on a MLS system?

[Paul Moore]

Hello,

I have been playing with Dan Walsh's MLS policy RPM on Fedora Rawhide 
and I noticed on the later versions that init is running at level s9 
which appears to be causing some problems.  The particular issue I am 
dealing with right now is when fsck (as run from /etc/rc.d/rc.sysinit) 
tries to check all of the filesystems in /etc/fstab.  The problem lies 
in the fact that the disk partitions in /dev are all labeled at s0 and 
fsck is trying to open them with write access.  Needless to say the 
policy is correct for the strict policy but as soon as you introduce the 
different levels you run into problems.

My question is this: should init be running at s9 and if so should we 
relabel the partitions to be at s9 as well?

-- 
. paul moore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. paul.moore@hp.com                                      hewlett packard
. (603) 884-5056                                          linux security

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: init running at s9 by default on a MLS system?

[Chad Hanson]

Hi Paul,

I would agree the disk partitions should be at s9. The init process should
probably be at s0. We need to work on providing more updates for this
policy.

-Chad

> -----Original Message-----
> From: Paul Moore [mailto:paul.moore@hp.com]
> Sent: Friday, July 15, 2005 12:03 PM
> To: selinux@tycho.nsa.gov
> Subject: init running at s9 by default on a MLS system?
> 
> 
> Hello,
> 
> I have been playing with Dan Walsh's MLS policy RPM on Fedora Rawhide 
> and I noticed on the later versions that init is running at level s9 
> which appears to be causing some problems.  The particular issue I am 
> dealing with right now is when fsck (as run from 
> /etc/rc.d/rc.sysinit) 
> tries to check all of the filesystems in /etc/fstab.  The 
> problem lies 
> in the fact that the disk partitions in /dev are all labeled 
> at s0 and 
> fsck is trying to open them with write access.  Needless to say the 
> policy is correct for the strict policy but as soon as you 
> introduce the 
> different levels you run into problems.
> 
> My question is this: should init be running at s9 and if so should we 
> relabel the partitions to be at s9 as well?
> 
> -- 
> . paul moore . . . . . . . . . . . . . . . . . . . . . . . . 
> . . . . . .
> . paul.moore@hp.com                                      
> hewlett packard
> . (603) 884-5056                                          
> linux security
> 
> --
> This message was distributed to subscribers of the selinux 
> mailing list.
> If you no longer wish to subscribe, send mail to 
> majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
> 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: init running at s9 by default on a MLS system?

[Daniel J Walsh]

Chad Hanson wrote:

>Hi Paul,
>
>I would agree the disk partitions should be at s9. The init process should
>probably be at s0. We need to work on providing more updates for this
>policy.
>
>-Chad
>
>  
>
>>-----Original Message-----
>>From: Paul Moore [mailto:paul.moore@hp.com]
>>Sent: Friday, July 15, 2005 12:03 PM
>>To: selinux@tycho.nsa.gov
>>Subject: init running at s9 by default on a MLS system?
>>
>>
>>Hello,
>>
>>I have been playing with Dan Walsh's MLS policy RPM on Fedora Rawhide 
>>and I noticed on the later versions that init is running at level s9 
>>which appears to be causing some problems.  The particular issue I am 
>>dealing with right now is when fsck (as run from 
>>/etc/rc.d/rc.sysinit) 
>>tries to check all of the filesystems in /etc/fstab.  The 
>>problem lies 
>>in the fact that the disk partitions in /dev are all labeled 
>>at s0 and 
>>fsck is trying to open them with write access.  Needless to say the 
>>policy is correct for the strict policy but as soon as you 
>>introduce the 
>>different levels you run into problems.
>>
>>My question is this: should init be running at s9 and if so should we 
>>relabel the partitions to be at s9 as well?
>>
>>-- 
>>. paul moore . . . . . . . . . . . . . . . . . . . . . . . . 
>>. . . . . .
>>. paul.moore@hp.com                                      
>>hewlett packard
>>. (603) 884-5056                                          
>>linux security
>>
>>--
>>This message was distributed to subscribers of the selinux 
>>mailing list.
>>If you no longer wish to subscribe, send mail to 
>>majordomo@tycho.nsa.gov with
>>the words "unsubscribe selinux" without quotes as the message.
>>
>>    
>>
>
>--
>This message was distributed to subscribers of the selinux mailing list.
>If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
>the words "unsubscribe selinux" without quotes as the message.
>  
>
How do you specify in policy that kernel_t transitions to init_t but at 
level s0?

Dan

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: init running at s9 by default on a MLS system?

[Chad Hanson]

> >
> How do you specify in policy that kernel_t transitions to 
> init_t but at 
> level s0?
> 

Like as follows:

# run init_t at OS_LO-OS_HI
range_transition kernel_t init_exec_t s0 - s9:c0.c127;

-Chad

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: init running at s9 by default on a MLS system?

[Daniel J Walsh]

Chad Hanson wrote:

>>How do you specify in policy that kernel_t transitions to 
>>init_t but at 
>>level s0?
>>
>>    
>>
>
>Like as follows:
>
># run init_t at OS_LO-OS_HI
>range_transition kernel_t init_exec_t s0 - s9:c0.c127;
>
>-Chad
>  
>
That line is already in policy.

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: init running at s9 by default on a MLS system?

[Paul Moore]

Jonathan Kim wrote:
> Yes the line is updated originally by TCS and wrapped with mls_policy
> tunable later. 
> 
> I applied current Dan Walsh's selinux-policy-mls-1.25.2-5 on on Fedora
> Rawhide to FC4 and I see the init process is running correctly at
> s0-s9:c0.c127.
> 

I am running version 1.25.2-5 of Dan's MLS policy RPM and looking at the 
source version of the policy RPM I see the range_transition line and if 
I recompile the policy the line is present in the policy.conf file.

However, if I reboot the machine using either the policy that I have 
recompiled or Dan's original policy it appears that init is running in 
system_u:system_r:init_t:s9:c0.c127 not s0-s9:c0.c127.

Am I missing something?

> 
>>-----Original Message-----
>>From: Daniel J Walsh [mailto:dwalsh@redhat.com]
>>Sent: Tuesday, July 19, 2005 1:58 PM
>>To: Chad Hanson
>>Cc: Paul Moore; selinux@tycho.nsa.gov
>>Subject: Re: init running at s9 by default on a MLS system?
>>
>>
>>Chad Hanson wrote:
>>
>>
>>>>How do you specify in policy that kernel_t transitions to 
>>>>init_t but at 
>>>>level s0?
>>>>
>>>>   
>>>>
>>>
>>>Like as follows:
>>>
>>># run init_t at OS_LO-OS_HI
>>>range_transition kernel_t init_exec_t s0 - s9:c0.c127;
>>>
>>>-Chad
>>> 
>>>
>>
>>That line is already in policy.
>>
>>-- 
>>
>>
>>
>>--
>>This message was distributed to subscribers of the selinux 
>>mailing list.
>>If you no longer wish to subscribe, send mail to 
>>majordomo@tycho.nsa.gov with
>>the words "unsubscribe selinux" without quotes as the message.
>>
> 
> 


-- 
. paul moore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. paul.moore@hp.com                                      hewlett packard
. (603) 884-5056                                          linux security

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: init running at s9 by default on a MLS system?

[Paul Moore]

Jonathan Kim wrote:
> Could you check the context of /sbin/init?
> It should be -rwxr-xr-x root root system_u:object_r:init_exec_t:s0

Looks okay to me ...

[root@olly ~]# ls -Z /sbin/init
-rwxr-xr-x  root     root     system_u:object_r:init_exec_t:s0 /sbin/init

I'll run a 'fixfiles check /' and see if anything strange pops up, but 
everything should be okay.

>>-----Original Message-----
>>From: Paul Moore [mailto:paul.moore@hp.com]
>>Sent: Wednesday, July 20, 2005 1:52 PM
>>To: Jonathan Kim
>>Cc: Daniel J Walsh; Chad Hanson; selinux@tycho.nsa.gov
>>Subject: Re: init running at s9 by default on a MLS system?
>>
>>
>>Jonathan Kim wrote:
>>
>>>Yes the line is updated originally by TCS and wrapped with 
>>
>>mls_policy
>>
>>>tunable later. 
>>>
>>>I applied current Dan Walsh's selinux-policy-mls-1.25.2-5 
>>
>>on on Fedora
>>
>>>Rawhide to FC4 and I see the init process is running correctly at
>>>s0-s9:c0.c127.
>>>
>>
>>I am running version 1.25.2-5 of Dan's MLS policy RPM and 
>>looking at the 
>>source version of the policy RPM I see the range_transition 
>>line and if 
>>I recompile the policy the line is present in the policy.conf file.
>>
>>However, if I reboot the machine using either the policy that I have 
>>recompiled or Dan's original policy it appears that init is 
>>running in 
>>system_u:system_r:init_t:s9:c0.c127 not s0-s9:c0.c127.
>>
>>Am I missing something?
>>
>>
>>>>-----Original Message-----
>>>>From: Daniel J Walsh [mailto:dwalsh@redhat.com]
>>>>Sent: Tuesday, July 19, 2005 1:58 PM
>>>>To: Chad Hanson
>>>>Cc: Paul Moore; selinux@tycho.nsa.gov
>>>>Subject: Re: init running at s9 by default on a MLS system?
>>>>
>>>>
>>>>Chad Hanson wrote:
>>>>
>>>>
>>>>
>>>>>>How do you specify in policy that kernel_t transitions to 
>>>>>>init_t but at 
>>>>>>level s0?
>>>>>>
>>>>>>  
>>>>>>
>>>>>
>>>>>Like as follows:
>>>>>
>>>>># run init_t at OS_LO-OS_HI
>>>>>range_transition kernel_t init_exec_t s0 - s9:c0.c127;
>>>>>
>>>>>-Chad
>>>>>
>>>>>
>>>>
>>>>That line is already in policy.
>>>>
>>>>-- 
>>>>
>>>>
>>>>
>>>>--
>>>>This message was distributed to subscribers of the selinux 
>>>>mailing list.
>>>>If you no longer wish to subscribe, send mail to 
>>>>majordomo@tycho.nsa.gov with
>>>>the words "unsubscribe selinux" without quotes as the message.
>>>>
>>>
>>>
>>
>>-- 
>>. paul moore . . . . . . . . . . . . . . . . . . . . . . . . 
>>. . . . . .
>>. paul.moore@hp.com                                      
>>hewlett packard
>>. (603) 884-5056                                          
>>linux security
>>
> 
> 


-- 
. paul moore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. paul.moore@hp.com                                      hewlett packard
. (603) 884-5056                                          linux security

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.