Re: semanage non MLS breakage

[Joshua Brindle <method@gentoo.org>]

Ivan Gyurdiev wrote:
>
>>>> # semanage login -l
>>>>
>>>> Login Name                SELinux User              MLS/MCS Range
>>>>
>>>> root                      root                      __default__:user_u
> That doesn't look like a valid MLS range.
> What exactly is in your seusers file?
>>
>> #2  0x00476143 in sepol_mls_contains (handle=0x8b06b70, 
>> policydb=0x8b30a78, mls1=0x0, mls2=0x8b2fd98 "s0", response=0xbfdc7068)
> This indicates the seuser has an mls range s0, but the user does not. 
> The mls check is conditional on the seuser's mls range, which is why 
> it proceeds.  I can add a check that makes sure neither exists, but it 
> shouldn't be necessary - on a non-MLS system the seuser should not 
> have an mls range.
>
if it has s0 then semanage is dreaming it up because the policy has no 
mls whatsoever and none was specified on the command line.
> I'm not sure how a situation would occur where the seuser has an mls 
> range on a non-mls system. I guess seuser_print will write out an mls 
> field if it finds one, so maybe that's how this happens...it gets an 
> mls field from the policy package, and fails to ignore it. Need more 
> info.

what info? it isn't hard to reproduce.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.