Re: Another place where policy blows up because of translations in MCS.

[Daniel J Walsh <dwalsh@redhat.com>]

Stephen Smalley wrote:

>On Tue, 2005-08-30 at 12:02 -0400, Daniel J Walsh wrote:
>  
>
>>/usr/bin/checkpolicy -M -o policy.20 policy.conf
>>/usr/bin/checkpolicy:  loading policy configuration from policy.conf
>>/usr/bin/checkpolicy:  policy configuration loaded
>>/usr/bin/checkpolicy:  writing binary representation (version 20) to 
>>policy.20
>>Validating file contexts files ...
>>/usr/sbin/setfiles -q -c policy.20 file_contexts/file_contexts
>>libsepol.sepol_ctx_struct_create: mls is enabled, but no mls context found
>>libsepol.sepol_ctx_struct_create: error creating context structure
>>libsepol.sepol_ctx_struct_from_string: unable to create context structure
>>libsepol.sepol_context_to_sid: could not convert 
>>system_u:object_r:default_t to sid
>>file_contexts/file_contexts:  line 155 has invalid context 
>>system_u:object_r:default_t
>>make: *** [policy.20] Error 1
>>error: Bad exit status from /var/tmp/rpm-tmp.74451 (%build)
>>    
>>
>
>That looks correct to me.  file_contexts for MCS should include the s0
>component.  The goal wasn't to allow you to ship policy without MLS
>fields, just to not require a complete relabeling of the filesystem upon
>an upgrade from non-MLS to MLS/MCS.
>
>  
>
They do.  I think Matchpathcon is going through the translation library 
and removing the :s0.  If I turn off translation it works.

>A while back, I added the 'make mlsconvert' target to the policy
>Makefile to allow simple conversion to a MLS enabled policy from the
>example policy.
>
>  
>
We use it.

>On a different note, is anyone working on kernel patch to cause SELinux
>to set the on-disk xattr to be consistent with the incore inode security
>label when it lacks the MLS field, so that getxattr will subsequently
>return the right value?
>
>  
>


-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.