* [PATCH] refpolicy: add X object classes to unconfined_t
@ 2006-09-12 19:11 Eamon Walsh
2006-09-13 13:47 ` Christopher J. PeBenito
2006-09-14 14:10 ` Joshua Brindle
0 siblings, 2 replies; 13+ messages in thread
From: Eamon Walsh @ 2006-09-12 19:11 UTC (permalink / raw)
To: cpebenito; +Cc: selinux
[-- Attachment #1: Type: text/plain, Size: 417 bytes --]
Hello,
I'm working on the XSELinux code, which has just been brought up to date
with the current X.org code base.
The following patch adds the X Windows userspace object classes to
unconfined_t.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
policy/modules/system/unconfined.if | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
[-- Attachment #2: unconfined-x.patch --]
[-- Type: text/x-patch, Size: 1149 bytes --]
--- refpolicy/policy/modules/system/unconfined.if 2006-09-11 21:06:30.000000000 -0400
+++ refpolicy-new/policy/modules/system/unconfined.if 2006-09-11 21:08:55.000000000 -0400
@@ -15,6 +15,17 @@
class dbus all_dbus_perms;
class nscd all_nscd_perms;
class passwd all_passwd_perms;
+ class drawable all_drawable_perms;
+ class window all_window_perms;
+ class gc all_gc_perms;
+ class font all_font_perms;
+ class colormap all_colormap_perms;
+ class property all_property_perms;
+ class cursor all_cursor_perms;
+ class xclient all_xclient_perms;
+ class xserver all_xserver_perms;
+ class xinput all_xinput_perms;
+ class xextension all_xextension_perms;
')
# Use any Linux capability.
@@ -31,6 +42,17 @@
allow $1 self:nscd *;
allow $1 self:dbus *;
allow $1 self:passwd *;
+ allow $1 self:drawable *;
+ allow $1 self:window *;
+ allow $1 self:gc *;
+ allow $1 self:font *;
+ allow $1 self:colormap *;
+ allow $1 self:property *;
+ allow $1 self:cursor *;
+ allow $1 self:xclient *;
+ allow $1 self:xserver *;
+ allow $1 self:xinput *;
+ allow $1 self:xextension *;
kernel_unconfined($1)
corenet_unconfined($1)
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-09-12 19:11 [PATCH] refpolicy: add X object classes to unconfined_t Eamon Walsh
@ 2006-09-13 13:47 ` Christopher J. PeBenito
2006-09-13 21:13 ` Eamon Walsh
2006-09-14 14:10 ` Joshua Brindle
1 sibling, 1 reply; 13+ messages in thread
From: Christopher J. PeBenito @ 2006-09-13 13:47 UTC (permalink / raw)
To: ewalsh; +Cc: selinux
On Tue, 2006-09-12 at 15:11 -0400, Eamon Walsh wrote:
> I'm working on the XSELinux code, which has just been brought up to date
> with the current X.org code base.
Is there any idea when this is going to be merged into xorg trunk?
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-09-13 13:47 ` Christopher J. PeBenito
@ 2006-09-13 21:13 ` Eamon Walsh
0 siblings, 0 replies; 13+ messages in thread
From: Eamon Walsh @ 2006-09-13 21:13 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: selinux
On Wed, 2006-09-13 at 09:47 -0400, Christopher J. PeBenito wrote:
> On Tue, 2006-09-12 at 15:11 -0400, Eamon Walsh wrote:
> > I'm working on the XSELinux code, which has just been brought up to date
> > with the current X.org code base.
>
> Is there any idea when this is going to be merged into xorg trunk?
X.org is on a 6-month cycle with the 7.2 release scheduled for November.
I'm targeting the 7.3 release, but I may be able to get the hooks layer
into 7.2.
In the meantime, the code can be checked out of the XACE-SELINUX branch
of the X.org "xserver" git repository. It it fully up to date with the
trunk, and builds and runs fine, except that there isn't any policy
support for it yet other than what TCS has done.
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-09-12 19:11 [PATCH] refpolicy: add X object classes to unconfined_t Eamon Walsh
2006-09-13 13:47 ` Christopher J. PeBenito
@ 2006-09-14 14:10 ` Joshua Brindle
2006-09-15 12:46 ` Joshua Brindle
1 sibling, 1 reply; 13+ messages in thread
From: Joshua Brindle @ 2006-09-14 14:10 UTC (permalink / raw)
To: ewalsh; +Cc: cpebenito, selinux
Eamon Walsh wrote:
> Hello,
> I'm working on the XSELinux code, which has just been brought up to date
> with the current X.org code base.
>
> The following patch adds the X Windows userspace object classes to
> unconfined_t.
>
This patch doesn't add the types necessary to run the default XSELinux
installation. Do you have a module that adds those types so that we can
test the codebase out?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-09-14 14:10 ` Joshua Brindle
@ 2006-09-15 12:46 ` Joshua Brindle
2006-09-15 21:19 ` Eamon Walsh
0 siblings, 1 reply; 13+ messages in thread
From: Joshua Brindle @ 2006-09-15 12:46 UTC (permalink / raw)
To: ewalsh; +Cc: cpebenito, selinux
On Thu, 2006-09-14 at 10:10 -0400, Joshua Brindle wrote:
> Eamon Walsh wrote:
> > Hello,
> > I'm working on the XSELinux code, which has just been brought up to date
> > with the current X.org code base.
> >
> > The following patch adds the X Windows userspace object classes to
> > unconfined_t.
> >
>
> This patch doesn't add the types necessary to run the default XSELinux
> installation. Do you have a module that adds those types so that we can
> test the codebase out?
It also seems that the XSELinuxConfig in the git repository doesn't have
all the necessary entries, one for root_window_context needs to be added
to start the X server up.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-09-15 12:46 ` Joshua Brindle
@ 2006-09-15 21:19 ` Eamon Walsh
2006-09-18 14:43 ` Christopher J. PeBenito
2006-11-29 15:12 ` Xavier Toth
0 siblings, 2 replies; 13+ messages in thread
From: Eamon Walsh @ 2006-09-15 21:19 UTC (permalink / raw)
To: Joshua Brindle; +Cc: selinux
[-- Attachment #1: Type: text/plain, Size: 743 bytes --]
On Fri, 2006-09-15 at 08:46 -0400, Joshua Brindle wrote:
> On Thu, 2006-09-14 at 10:10 -0400, Joshua Brindle wrote:
[snip]
> It also seems that the XSELinuxConfig in the git repository doesn't have
> all the necessary entries, one for root_window_context needs to be added
> to start the X server up.
I've been using the attached config file, however, without the
unconfined_t patch for targeted, it still won't work unless in
permissive mode.
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
[-- Attachment #2: XSELinuxConfig --]
[-- Type: text/plain, Size: 3165 bytes --]
#
# Config file for XSELinux extension
#
#
# The nonlocal_context rule defines a context to be used for all clients
# connecting to the server from a remote host. The nonlocal context must
# be defined, and it must be a valid context according to the SELinux
# security policy. Only one nonlocal_context rule may be defined.
#
nonlocal_context system_u:object_r:unconfined_t
root_window_context system_u:object_r:unconfined_t
#
# Property rules map a property name to a SELinux type. The type must
# be valid according to the SELinux security policy. There can be any
# number of property rules. Additionally, a default property type can be
# defined for all properties not explicitly listed. The default
# property type may not be omitted. The default rule may appear in
# any position (it need not be the last property rule listed).
#
property WM_NAME unconfined_t
property WM_CLASS unconfined_t
property WM_ICON_NAME unconfined_t
property WM_HINTS unconfined_t
property WM_NORMAL_HINTS unconfined_t
property WM_COMMAND unconfined_t
property CUT_BUFFER0 unconfined_t
property CUT_BUFFER1 unconfined_t
property CUT_BUFFER2 unconfined_t
property CUT_BUFFER3 unconfined_t
property CUT_BUFFER4 unconfined_t
property CUT_BUFFER5 unconfined_t
property CUT_BUFFER6 unconfined_t
property CUT_BUFFER7 unconfined_t
property default unconfined_t
#
# Extension rules map an extension name to a SELinux type. The type must
# be valid according to the SELinux security policy. There can be any
# number of extension rules. Additionally, a default extension type can
# be defined for all extensions not explicitly listed. The default
# extension type may not be omitted. The default rule may appear in
# any position (it need not be the last extension rule listed).
#
extension BIG-REQUESTS unconfined_t
extension DOUBLE-BUFFER unconfined_t
extension DPMS unconfined_t
extension Extended-Visual-Information unconfined_t
extension FontCache unconfined_t
extension GLX unconfined_t
extension LBX unconfined_t
extension MIT-SCREEN-SAVER unconfined_t
extension MIT-SHM unconfined_t
extension MIT-SUNDRY-NONSTANDARD unconfined_t
extension NV-CONTROL unconfined_t
extension NV-GLX unconfined_t
extension NVIDIA-GLX unconfined_t
extension RANDR unconfined_t
extension RECORD unconfined_t
extension RENDER unconfined_t
extension SECURITY unconfined_t
extension SELinux unconfined_t
extension SHAPE unconfined_t
extension SYNC unconfined_t
extension TOG-CUP unconfined_t
extension X-Resource unconfined_t
extension XAccessControlExtension unconfined_t
extension XACEUSR unconfined_t
extension XC-APPGROUP unconfined_t
extension XC-MISC unconfined_t
extension XFree86-Bigfont unconfined_t
extension XFree86-DGA unconfined_t
extension XFree86-Misc unconfined_t
extension XFree86-VidModeExtension unconfined_t
extension XInputExtension unconfined_t
extension XKEYBOARD unconfined_t
extension XpExtension unconfined_t
extension XTEST unconfined_t
extension XVideo unconfined_t
extension XVideo-MotionCompensation unconfined_t
extension default unconfined_t
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-09-15 21:19 ` Eamon Walsh
@ 2006-09-18 14:43 ` Christopher J. PeBenito
2006-11-29 15:12 ` Xavier Toth
1 sibling, 0 replies; 13+ messages in thread
From: Christopher J. PeBenito @ 2006-09-18 14:43 UTC (permalink / raw)
To: ewalsh; +Cc: Joshua Brindle, selinux
On Fri, 2006-09-15 at 17:19 -0400, Eamon Walsh wrote:
> On Fri, 2006-09-15 at 08:46 -0400, Joshua Brindle wrote:
> > On Thu, 2006-09-14 at 10:10 -0400, Joshua Brindle wrote:
> [snip]
> > It also seems that the XSELinuxConfig in the git repository doesn't have
> > all the necessary entries, one for root_window_context needs to be added
> > to start the X server up.
>
> I've been using the attached config file, however, without the
> unconfined_t patch for targeted, it still won't work unless in
> permissive mode.
I'm not convinced the original patch should go in refpolicy. What we
need to do is reestablish all the types for the X server properties,
extensions, etc. Then the unconfined rules would use all the the above,
and then have access to all domains' windows, etc. Its hard for me to
articulate, since I don't know how all the X object classes work. What
I'd really like to see would be an example policy.
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-09-15 21:19 ` Eamon Walsh
2006-09-18 14:43 ` Christopher J. PeBenito
@ 2006-11-29 15:12 ` Xavier Toth
2006-11-29 20:09 ` Eamon Walsh
1 sibling, 1 reply; 13+ messages in thread
From: Xavier Toth @ 2006-11-29 15:12 UTC (permalink / raw)
To: ewalsh; +Cc: Joshua Brindle, selinux
[-- Attachment #1: Type: text/plain, Size: 969 bytes --]
I've replaced the XSELinuxConfig file with the attached version but
Xorg still fails to start. Any advice would be appreciated.
On 9/15/06, Eamon Walsh <ewalsh@tycho.nsa.gov> wrote:
> On Fri, 2006-09-15 at 08:46 -0400, Joshua Brindle wrote:
> > On Thu, 2006-09-14 at 10:10 -0400, Joshua Brindle wrote:
>
> [snip]
>
> > It also seems that the XSELinuxConfig in the git repository doesn't have
> > all the necessary entries, one for root_window_context needs to be added
> > to start the X server up.
>
> I've been using the attached config file, however, without the
> unconfined_t patch for targeted, it still won't work unless in
> permissive mode.
>
> >
> >
> > --
> > This message was distributed to subscribers of the selinux mailing list.
> > If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> > the words "unsubscribe selinux" without quotes as the message.
> --
> Eamon Walsh <ewalsh@tycho.nsa.gov>
> National Security Agency
>
>
>
[-- Attachment #2: Xorg.1.log --]
[-- Type: text/x-log, Size: 18958 bytes --]
This is a pre-release version of the X server from The X.Org Foundation.
It is not supported in any way.
Bugs may be filed in the bugzilla at http://bugs.freedesktop.org/.
Select the "xorg" product for bugs you find in this release.
Before reporting bugs in pre-release versions please check the
latest version in the X.Org Foundation CVS repository.
See http://wiki.x.org/wiki/CvsPage for CVS access instructions.
X Window System Version 7.1.99.2
Release Date: 21 December 2005
X Protocol Version 11, Revision 0, Release 7.1.99.2
Build Operating System: Linux 2.6.18-1.2798.fc6 i686
Current Operating System: Linux localhost.localdomain 2.6.18-1.2798.fc6 #1 SMP Mon Oct 16 14:37:32 EDT 2006 i686
Build Date: 28 November 2006
Before reporting problems, check http://wiki.x.org
to make sure that you have the latest version.
Module Loader present
Markers: (--) probed, (**) from config file, (==) default setting,
(++) from command line, (!!) notice, (II) informational,
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/home/jcdxdev/tmp/modular/var/log/Xorg.1.log", Time: Wed Nov 29 08:49:29 2006
(==) Using config file: "/etc/X11/xorg.conf"
(==) ServerLayout "single head configuration"
(**) |-->Screen "Screen0" (0)
(**) | |-->Monitor "Monitor0"
(**) | |-->Device "Videocard0"
(**) |-->Input Device "Keyboard0"
(==) |-->Input Device "<default pointer>"
(WW) The core pointer device wasn't specified explicitly in the layout.
Using the default mouse configuration.
(WW) The directory "/home/jcdxdev/tmp/modular/lib/X11/fonts/OTF" does not exist.
Entry deleted from font path.
(WW) The directory "/home/jcdxdev/tmp/modular/lib/X11/fonts/CID/" does not exist.
Entry deleted from font path.
(==) FontPath set to:
/home/jcdxdev/tmp/modular/lib/X11/fonts/misc/,
/home/jcdxdev/tmp/modular/lib/X11/fonts/TTF/,
/home/jcdxdev/tmp/modular/lib/X11/fonts/Type1/,
/home/jcdxdev/tmp/modular/lib/X11/fonts/100dpi/,
/home/jcdxdev/tmp/modular/lib/X11/fonts/75dpi/
(==) RgbPath set to "/home/jcdxdev/tmp/modular/share/X11/rgb"
(**) ModulePath set to "/usr/lib/xorg/modules/extensions/nvidia,/usr/lib/xorg/modules"
(**) Ignoring ABI Version
(II) Open ACPI successful (/var/run/acpid.socket)
(II) Loader magic: 0x81c6520
(II) Module ABI versions:
X.Org ANSI C Emulation: 0.3
X.Org Video Driver: 1.0
X.Org XInput driver : 0.6
X.Org Server Extension : 0.3
X.Org Font Renderer : 0.5
(II) Loader running on linux
(II) LoadModule: "pcidata"
(II) Loading /usr/lib/xorg/modules//libpcidata.so
(II) Module pcidata: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 1.0.0
ABI class: X.Org Video Driver, version 1.0
(--) using VT number 9
(II) PCI: PCI scan (all values are in hex)
(II) PCI: 00:00:0: chip 8086,2578 card 103c,12bf rev 02 class 06,00,00 hdr 00
(II) PCI: 00:01:0: chip 8086,2579 card 0000,0000 rev 02 class 06,04,00 hdr 01
(II) PCI: 00:1d:0: chip 8086,24d2 card 103c,12bf rev 02 class 0c,03,00 hdr 80
(II) PCI: 00:1d:1: chip 8086,24d4 card 103c,12bf rev 02 class 0c,03,00 hdr 00
(II) PCI: 00:1d:2: chip 8086,24d7 card 103c,12bf rev 02 class 0c,03,00 hdr 00
(II) PCI: 00:1d:7: chip 8086,24dd card 103c,12bf rev 02 class 0c,03,20 hdr 00
(II) PCI: 00:1e:0: chip 8086,244e card 0000,0000 rev c2 class 06,04,00 hdr 01
(II) PCI: 00:1f:0: chip 8086,24d0 card 0000,0000 rev 02 class 06,01,00 hdr 80
(II) PCI: 00:1f:1: chip 8086,24db card 103c,12bf rev 02 class 01,01,8a hdr 00
(II) PCI: 00:1f:2: chip 8086,24d1 card 103c,12bf rev 02 class 01,01,8f hdr 00
(II) PCI: 00:1f:5: chip 8086,24d5 card 103c,12bf rev 02 class 04,01,00 hdr 00
(II) PCI: 01:00:0: chip 10de,0110 card 1043,407f rev b2 class 03,00,00 hdr 00
(II) PCI: 05:02:0: chip 14e4,1696 card 103c,12bf rev 03 class 02,00,00 hdr 00
(II) PCI: End of PCI scan
(II) Intel Bridge workaround enabled
(II) Host-to-PCI bridge:
(II) Bus 0: bridge is at (0:0:0), (0,0,5), BCTRL: 0x0008 (VGA_EN is set)
(II) Bus 0 I/O range:
[0] -1 0 0x00000000 - 0x0000ffff (0x10000) IX[B]
(II) Bus 0 non-prefetchable memory range:
[0] -1 0 0x00000000 - 0xffffffff (0x0) MX[B]
(II) Bus 0 prefetchable memory range:
[0] -1 0 0x00000000 - 0xffffffff (0x0) MX[B]
(II) PCI-to-PCI bridge:
(II) Bus 1: bridge is at (0:1:0), (0,1,1), BCTRL: 0x0008 (VGA_EN is set)
(II) Bus 1 non-prefetchable memory range:
[0] -1 0 0xf9000000 - 0xfa1fffff (0x1200000) MX[B]
(II) Bus 1 prefetchable memory range:
[0] -1 0 0xf0000000 - 0xf81fffff (0x8200000) MX[B]
(II) Subtractive PCI-to-PCI bridge:
(II) Bus 5: bridge is at (0:30:0), (0,5,5), BCTRL: 0x0006 (VGA_EN is cleared)
(II) Bus 5 non-prefetchable memory range:
[0] -1 0 0xf8200000 - 0xf84fffff (0x300000) MX[B]
(II) PCI-to-ISA bridge:
(II) Bus -1: bridge is at (0:31:0), (0,-1,-1), BCTRL: 0x0008 (VGA_EN is set)
(--) PCI:*(1:0:0) nVidia Corporation NV11 [GeForce2 MX/MX 400] rev 178, Mem @ 0xf9000000/24, 0xf0000000/27
(II) Addressable bus resource ranges are
[0] -1 0 0x00000000 - 0xffffffff (0x0) MX[B]
[1] -1 0 0x00000000 - 0x0000ffff (0x10000) IX[B]
(II) OS-reported resource ranges:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[5] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
(II) PCI Memory resource overlap reduced 0xe8000000 from 0xefffffff to 0xe7ffffff
(II) Active PCI resource ranges:
[0] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[1] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[2] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[3] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[4] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[5] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[6] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[7] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[8] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[9] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[10] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[11] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[12] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[13] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[14] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[15] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[16] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[17] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[18] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[19] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[20] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[21] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[22] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
(II) Active PCI resource ranges after removing overlaps:
[0] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[1] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[2] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[3] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[4] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[5] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[6] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[7] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[8] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[9] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[10] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[11] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[12] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[13] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[14] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[15] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[16] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[17] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[18] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[19] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[20] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[21] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[22] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
(II) OS-reported resource ranges after removing overlaps with PCI:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[5] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
(II) All system resource ranges:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[5] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[6] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[7] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[8] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[9] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[10] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[11] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[12] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[13] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
[14] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[15] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[16] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[17] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[18] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[19] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[20] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[21] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[22] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[23] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[24] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[25] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[26] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[27] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[28] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
(II) LoadModule: "glx"
(II) Loading /usr/lib/xorg/modules/extensions/nvidia//libglx.so
(II) Module glx: vendor="NVIDIA Corporation"
compiled for 4.0.2, module version = 1.0.8776
Module class: X.Org Server Extension
ABI class: X.Org Server Extension, version 0.1
(II) Loading extension GLX
(II) LoadModule: "nvidia"
(II) Loading /usr/lib/xorg/modules/drivers//nvidia_drv.so
(II) Module nvidia: vendor="NVIDIA Corporation"
compiled for 4.0.2, module version = 1.0.8776
Module class: X.Org Video Driver
(II) LoadModule: "kbd"
(II) Loading /usr/lib/xorg/modules/input//kbd_drv.so
(II) Module kbd: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 1.1.0
Module class: X.Org XInput Driver
ABI class: X.Org XInput driver, version 0.6
(II) LoadModule: "mouse"
(II) Loading /usr/lib/xorg/modules/input//mouse_drv.so
(II) Module mouse: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 1.1.1
Module class: X.Org XInput Driver
ABI class: X.Org XInput driver, version 0.6
(II) NVIDIA dlloader X Driver 1.0-8776 Mon Oct 16 21:57:32 PDT 2006
(II) NVIDIA Unified Driver for all Supported NVIDIA GPUs
(II) Primary Device is: PCI 01:00:0
(--) Assigning device section with no busID to primary device
(--) Chipset NVIDIA GPU found
(II) Loading sub module "fb"
(II) LoadModule: "fb"
(II) Loading /usr/lib/xorg/modules//libfb.so
(II) Module fb: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 1.0.0
ABI class: X.Org ANSI C Emulation, version 0.3
(II) Loading sub module "ramdac"
(II) LoadModule: "ramdac"
(II) Loading /usr/lib/xorg/modules//libramdac.so
(II) Module ramdac: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 0.1.0
ABI class: X.Org Video Driver, version 1.0
(II) resource ranges after xf86ClaimFixedResources() call:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[5] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[6] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[7] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[8] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[9] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[10] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[11] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[12] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[13] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
[14] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[15] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[16] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[17] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[18] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[19] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[20] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[21] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[22] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[23] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[24] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[25] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[26] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[27] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[28] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
(II) resource ranges after probing:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[5] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[6] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[7] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[8] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[9] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[10] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[11] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[12] 0 0 0x000a0000 - 0x000affff (0x10000) MS[B]
[13] 0 0 0x000b0000 - 0x000b7fff (0x8000) MS[B]
[14] 0 0 0x000b8000 - 0x000bffff (0x8000) MS[B]
[15] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[16] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
[17] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[18] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[19] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[20] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[21] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[22] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[23] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[24] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[25] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[26] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[27] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[28] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[29] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[30] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[31] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
[32] 0 0 0x000003b0 - 0x000003bb (0xc) IS[B]
[33] 0 0 0x000003c0 - 0x000003df (0x20) IS[B]
(II) Setting vga for screen 0.
(**) NVIDIA(0): Depth 24, (--) framebuffer bpp 32
(==) NVIDIA(0): RGB weight 888
(==) NVIDIA(0): Default visual is TrueColor
(==) NVIDIA(0): Using gamma correction (1.0, 1.0, 1.0)
(**) NVIDIA(0): Enabling RENDER acceleration
(WW) NVIDIA(0): Unable to read EDID for display device CRT-0
(II) NVIDIA(0): NVIDIA GPU GeForce2 MX/MX 400 at PCI:1:0:0
(--) NVIDIA(0): VideoRAM: 32768 kBytes
(--) NVIDIA(0): VideoBIOS: 03.11.01.48.86
(II) NVIDIA(0): Detected AGP rate: 4X
(--) NVIDIA(0): Interlaced video modes are not supported on this GPU
(--) NVIDIA(0): Connected display device(s) on GeForce2 MX/MX 400 at
(--) NVIDIA(0): PCI:1:0:0:
(--) NVIDIA(0): CRT-0
(--) NVIDIA(0): CRT-0: 350.0 MHz maximum pixel clock
(II) NVIDIA(0): Assigned Display Device: CRT-0
(WW) NVIDIA(0): No valid modes for "1280x800"; removing.
(II) NVIDIA(0): Validated modes:
(II) NVIDIA(0): "1280x1024"
(II) NVIDIA(0): "1280x960"
(II) NVIDIA(0): "1152x864"
(II) NVIDIA(0): "1152x768"
(II) NVIDIA(0): "1024x768"
(II) NVIDIA(0): "800x600"
(II) NVIDIA(0): "640x480"
(II) NVIDIA(0): Virtual screen size determined to be 1280 x 1024
(WW) NVIDIA(0): Unable to get display device CRT-0's EDID; cannot compute DPI
(WW) NVIDIA(0): from EDID.
(==) NVIDIA(0): DPI set to (75, 75); computed from built-in default
(--) Depth 24 pixmap format is 32 bpp
(II) do I need RAC? No, I don't.
(II) resource ranges after preInit:
[0] 0 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B]
[1] 0 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B]
[2] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[3] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[4] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[5] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[6] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[7] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[8] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[9] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[10] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[11] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[12] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[13] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[14] 0 0 0x000a0000 - 0x000affff (0x10000) MS[B](OprD)
[15] 0 0 0x000b0000 - 0x000b7fff (0x8000) MS[B](OprD)
[16] 0 0 0x000b8000 - 0x000bffff (0x8000) MS[B](OprD)
[17] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[18] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
[19] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[20] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[21] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[22] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[23] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[24] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[25] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[26] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[27] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[28] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[29] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[30] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[31] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[32] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[33] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
[34] 0 0 0x000003b0 - 0x000003bb (0xc) IS[B](OprU)
[35] 0 0 0x000003c0 - 0x000003df (0x20) IS[B](OprU)
(II) NVIDIA(0): Setting mode "1280x1024"
(II) Loading extension NV-GLX
(II) NVIDIA(0): NVIDIA 3D Acceleration Architecture Initialized
(II) NVIDIA(0): Using the NVIDIA 2D acceleration architecture
(==) NVIDIA(0): Backing store disabled
(==) NVIDIA(0): Silken mouse enabled
(**) Option "dpms"
(**) NVIDIA(0): DPMS enabled
(II) Loading extension NV-CONTROL
(==) RandR enabled
(II) Initializing built-in extension MIT-SHM
(II) Initializing built-in extension XInputExtension
(II) Initializing built-in extension XTEST
(II) Initializing built-in extension XKEYBOARD
(II) Initializing built-in extension XC-APPGROUP
(II) Initializing built-in extension XAccessControlExtension
(II) Initializing built-in extension SECURITY
(II) Initializing built-in extension SELinux
(II) Initializing built-in extension XINERAMA
(II) Initializing built-in extension XFIXES
(II) Initializing built-in extension XFree86-Bigfont
(II) Initializing built-in extension RENDER
(II) Initializing built-in extension RANDR
(II) Initializing built-in extension COMPOSITE
(II) Initializing built-in extension DAMAGE
(II) Initializing built-in extension XEVIE
(II) Initializing extension GLX
XSELinux: Line 11 of /home/jcdxdev/tmp/modular/lib/xserver/XSELinuxConfig is invalid
Fatal server error:
XSELinux: Failed to load security policy
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-11-29 15:12 ` Xavier Toth
@ 2006-11-29 20:09 ` Eamon Walsh
2006-11-29 22:34 ` Xavier Toth
0 siblings, 1 reply; 13+ messages in thread
From: Eamon Walsh @ 2006-11-29 20:09 UTC (permalink / raw)
To: Xavier Toth; +Cc: selinux
On Wed, 2006-11-29 at 09:12 -0600, Xavier Toth wrote:
> I've replaced the XSELinuxConfig file with the attached version but
> Xorg still fails to start. Any advice would be appreciated.
>
Are you running with targeted policy? In your message to the X list you
indicated you were running MLS policy.
What's in your Xorg log file?
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-11-29 20:09 ` Eamon Walsh
@ 2006-11-29 22:34 ` Xavier Toth
2006-11-30 3:27 ` Eamon Walsh
0 siblings, 1 reply; 13+ messages in thread
From: Xavier Toth @ 2006-11-29 22:34 UTC (permalink / raw)
To: selinux
[-- Attachment #1: Type: text/plain, Size: 1175 bytes --]
Humm I attached the log to my last post anyway I attached it again. I
have been able to run Xorg under the targeted policy (permissive mode)
after I chcon'd it to the same context as the Xorg in /usr/bin. Now
I'm trying to get it working under the MLS permissive policy which
doesn't have the unconfined_t type. Under MLS Xorg gets labeled as
type bin_t so I chcon'd my Xorg to match and edited XSELinuxConfig
replacing unconfined_t with bin_t. However the result of my simplistic
approach is that Xorg fails to start complaining:
XSELinux: Line 11 of
/home/jcdxdev/tmp/modular/lib/xserver/XSELinuxConfig is invalid
Fatal server error:
XSELinux: Failed to load security policy
Any suggestions?
On 11/29/06, Eamon Walsh <ewalsh@tycho.nsa.gov> wrote:
> On Wed, 2006-11-29 at 09:12 -0600, Xavier Toth wrote:
> > I've replaced the XSELinuxConfig file with the attached version but
> > Xorg still fails to start. Any advice would be appreciated.
> >
>
> Are you running with targeted policy? In your message to the X list you
> indicated you were running MLS policy.
>
> What's in your Xorg log file?
>
> --
> Eamon Walsh <ewalsh@tycho.nsa.gov>
> National Security Agency
>
>
[-- Attachment #2: Xorg.0.log --]
[-- Type: text/x-log, Size: 18958 bytes --]
This is a pre-release version of the X server from The X.Org Foundation.
It is not supported in any way.
Bugs may be filed in the bugzilla at http://bugs.freedesktop.org/.
Select the "xorg" product for bugs you find in this release.
Before reporting bugs in pre-release versions please check the
latest version in the X.Org Foundation CVS repository.
See http://wiki.x.org/wiki/CvsPage for CVS access instructions.
X Window System Version 7.1.99.2
Release Date: 21 December 2005
X Protocol Version 11, Revision 0, Release 7.1.99.2
Build Operating System: Linux 2.6.18-1.2798.fc6 i686
Current Operating System: Linux localhost.localdomain 2.6.18-1.2798.fc6 #1 SMP Mon Oct 16 14:37:32 EDT 2006 i686
Build Date: 28 November 2006
Before reporting problems, check http://wiki.x.org
to make sure that you have the latest version.
Module Loader present
Markers: (--) probed, (**) from config file, (==) default setting,
(++) from command line, (!!) notice, (II) informational,
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/home/jcdxdev/tmp/modular/var/log/Xorg.0.log", Time: Wed Nov 29 13:49:28 2006
(==) Using config file: "/etc/X11/xorg.conf"
(==) ServerLayout "single head configuration"
(**) |-->Screen "Screen0" (0)
(**) | |-->Monitor "Monitor0"
(**) | |-->Device "Videocard0"
(**) |-->Input Device "Keyboard0"
(==) |-->Input Device "<default pointer>"
(WW) The core pointer device wasn't specified explicitly in the layout.
Using the default mouse configuration.
(WW) The directory "/home/jcdxdev/tmp/modular/lib/X11/fonts/OTF" does not exist.
Entry deleted from font path.
(WW) The directory "/home/jcdxdev/tmp/modular/lib/X11/fonts/CID/" does not exist.
Entry deleted from font path.
(==) FontPath set to:
/home/jcdxdev/tmp/modular/lib/X11/fonts/misc/,
/home/jcdxdev/tmp/modular/lib/X11/fonts/TTF/,
/home/jcdxdev/tmp/modular/lib/X11/fonts/Type1/,
/home/jcdxdev/tmp/modular/lib/X11/fonts/100dpi/,
/home/jcdxdev/tmp/modular/lib/X11/fonts/75dpi/
(==) RgbPath set to "/home/jcdxdev/tmp/modular/share/X11/rgb"
(**) ModulePath set to "/usr/lib/xorg/modules/extensions/nvidia,/usr/lib/xorg/modules"
(**) Ignoring ABI Version
(II) Open ACPI successful (/var/run/acpid.socket)
(II) Loader magic: 0x81c6520
(II) Module ABI versions:
X.Org ANSI C Emulation: 0.3
X.Org Video Driver: 1.0
X.Org XInput driver : 0.6
X.Org Server Extension : 0.3
X.Org Font Renderer : 0.5
(II) Loader running on linux
(II) LoadModule: "pcidata"
(II) Loading /usr/lib/xorg/modules//libpcidata.so
(II) Module pcidata: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 1.0.0
ABI class: X.Org Video Driver, version 1.0
(--) using VT number 7
(II) PCI: PCI scan (all values are in hex)
(II) PCI: 00:00:0: chip 8086,2578 card 103c,12bf rev 02 class 06,00,00 hdr 00
(II) PCI: 00:01:0: chip 8086,2579 card 0000,0000 rev 02 class 06,04,00 hdr 01
(II) PCI: 00:1d:0: chip 8086,24d2 card 103c,12bf rev 02 class 0c,03,00 hdr 80
(II) PCI: 00:1d:1: chip 8086,24d4 card 103c,12bf rev 02 class 0c,03,00 hdr 00
(II) PCI: 00:1d:2: chip 8086,24d7 card 103c,12bf rev 02 class 0c,03,00 hdr 00
(II) PCI: 00:1d:7: chip 8086,24dd card 103c,12bf rev 02 class 0c,03,20 hdr 00
(II) PCI: 00:1e:0: chip 8086,244e card 0000,0000 rev c2 class 06,04,00 hdr 01
(II) PCI: 00:1f:0: chip 8086,24d0 card 0000,0000 rev 02 class 06,01,00 hdr 80
(II) PCI: 00:1f:1: chip 8086,24db card 103c,12bf rev 02 class 01,01,8a hdr 00
(II) PCI: 00:1f:2: chip 8086,24d1 card 103c,12bf rev 02 class 01,01,8f hdr 00
(II) PCI: 00:1f:5: chip 8086,24d5 card 103c,12bf rev 02 class 04,01,00 hdr 00
(II) PCI: 01:00:0: chip 10de,0110 card 1043,407f rev b2 class 03,00,00 hdr 00
(II) PCI: 05:02:0: chip 14e4,1696 card 103c,12bf rev 03 class 02,00,00 hdr 00
(II) PCI: End of PCI scan
(II) Intel Bridge workaround enabled
(II) Host-to-PCI bridge:
(II) Bus 0: bridge is at (0:0:0), (0,0,5), BCTRL: 0x0008 (VGA_EN is set)
(II) Bus 0 I/O range:
[0] -1 0 0x00000000 - 0x0000ffff (0x10000) IX[B]
(II) Bus 0 non-prefetchable memory range:
[0] -1 0 0x00000000 - 0xffffffff (0x0) MX[B]
(II) Bus 0 prefetchable memory range:
[0] -1 0 0x00000000 - 0xffffffff (0x0) MX[B]
(II) PCI-to-PCI bridge:
(II) Bus 1: bridge is at (0:1:0), (0,1,1), BCTRL: 0x0008 (VGA_EN is set)
(II) Bus 1 non-prefetchable memory range:
[0] -1 0 0xf9000000 - 0xfa1fffff (0x1200000) MX[B]
(II) Bus 1 prefetchable memory range:
[0] -1 0 0xf0000000 - 0xf81fffff (0x8200000) MX[B]
(II) Subtractive PCI-to-PCI bridge:
(II) Bus 5: bridge is at (0:30:0), (0,5,5), BCTRL: 0x0006 (VGA_EN is cleared)
(II) Bus 5 non-prefetchable memory range:
[0] -1 0 0xf8200000 - 0xf84fffff (0x300000) MX[B]
(II) PCI-to-ISA bridge:
(II) Bus -1: bridge is at (0:31:0), (0,-1,-1), BCTRL: 0x0008 (VGA_EN is set)
(--) PCI:*(1:0:0) nVidia Corporation NV11 [GeForce2 MX/MX 400] rev 178, Mem @ 0xf9000000/24, 0xf0000000/27
(II) Addressable bus resource ranges are
[0] -1 0 0x00000000 - 0xffffffff (0x0) MX[B]
[1] -1 0 0x00000000 - 0x0000ffff (0x10000) IX[B]
(II) OS-reported resource ranges:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[5] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
(II) PCI Memory resource overlap reduced 0xe8000000 from 0xefffffff to 0xe7ffffff
(II) Active PCI resource ranges:
[0] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[1] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[2] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[3] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[4] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[5] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[6] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[7] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[8] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[9] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[10] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[11] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[12] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[13] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[14] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[15] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[16] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[17] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[18] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[19] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[20] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[21] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[22] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
(II) Active PCI resource ranges after removing overlaps:
[0] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[1] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[2] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[3] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[4] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[5] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[6] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[7] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[8] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[9] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[10] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[11] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[12] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[13] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[14] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[15] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[16] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[17] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[18] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[19] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[20] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[21] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[22] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
(II) OS-reported resource ranges after removing overlaps with PCI:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[5] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
(II) All system resource ranges:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[5] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[6] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[7] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[8] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[9] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[10] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[11] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[12] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[13] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
[14] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[15] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[16] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[17] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[18] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[19] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[20] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[21] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[22] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[23] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[24] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[25] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[26] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[27] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[28] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
(II) LoadModule: "glx"
(II) Loading /usr/lib/xorg/modules/extensions/nvidia//libglx.so
(II) Module glx: vendor="NVIDIA Corporation"
compiled for 4.0.2, module version = 1.0.8776
Module class: X.Org Server Extension
ABI class: X.Org Server Extension, version 0.1
(II) Loading extension GLX
(II) LoadModule: "nvidia"
(II) Loading /usr/lib/xorg/modules/drivers//nvidia_drv.so
(II) Module nvidia: vendor="NVIDIA Corporation"
compiled for 4.0.2, module version = 1.0.8776
Module class: X.Org Video Driver
(II) LoadModule: "kbd"
(II) Loading /usr/lib/xorg/modules/input//kbd_drv.so
(II) Module kbd: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 1.1.0
Module class: X.Org XInput Driver
ABI class: X.Org XInput driver, version 0.6
(II) LoadModule: "mouse"
(II) Loading /usr/lib/xorg/modules/input//mouse_drv.so
(II) Module mouse: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 1.1.1
Module class: X.Org XInput Driver
ABI class: X.Org XInput driver, version 0.6
(II) NVIDIA dlloader X Driver 1.0-8776 Mon Oct 16 21:57:32 PDT 2006
(II) NVIDIA Unified Driver for all Supported NVIDIA GPUs
(II) Primary Device is: PCI 01:00:0
(--) Assigning device section with no busID to primary device
(--) Chipset NVIDIA GPU found
(II) Loading sub module "fb"
(II) LoadModule: "fb"
(II) Loading /usr/lib/xorg/modules//libfb.so
(II) Module fb: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 1.0.0
ABI class: X.Org ANSI C Emulation, version 0.3
(II) Loading sub module "ramdac"
(II) LoadModule: "ramdac"
(II) Loading /usr/lib/xorg/modules//libramdac.so
(II) Module ramdac: vendor="X.Org Foundation"
compiled for 7.1.1, module version = 0.1.0
ABI class: X.Org Video Driver, version 1.0
(II) resource ranges after xf86ClaimFixedResources() call:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[5] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[6] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[7] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[8] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[9] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[10] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[11] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[12] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[13] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
[14] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[15] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[16] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[17] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[18] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[19] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[20] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[21] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[22] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[23] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[24] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[25] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[26] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[27] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[28] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
(II) resource ranges after probing:
[0] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[1] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[2] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[3] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[4] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[5] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[6] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[7] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[8] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[9] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[10] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[11] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[12] 0 0 0x000a0000 - 0x000affff (0x10000) MS[B]
[13] 0 0 0x000b0000 - 0x000b7fff (0x8000) MS[B]
[14] 0 0 0x000b8000 - 0x000bffff (0x8000) MS[B]
[15] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[16] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
[17] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[18] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[19] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[20] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[21] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[22] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[23] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[24] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[25] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[26] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[27] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[28] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[29] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[30] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[31] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
[32] 0 0 0x000003b0 - 0x000003bb (0xc) IS[B]
[33] 0 0 0x000003c0 - 0x000003df (0x20) IS[B]
(II) Setting vga for screen 0.
(**) NVIDIA(0): Depth 24, (--) framebuffer bpp 32
(==) NVIDIA(0): RGB weight 888
(==) NVIDIA(0): Default visual is TrueColor
(==) NVIDIA(0): Using gamma correction (1.0, 1.0, 1.0)
(**) NVIDIA(0): Enabling RENDER acceleration
(WW) NVIDIA(0): Unable to read EDID for display device CRT-0
(II) NVIDIA(0): NVIDIA GPU GeForce2 MX/MX 400 at PCI:1:0:0
(--) NVIDIA(0): VideoRAM: 32768 kBytes
(--) NVIDIA(0): VideoBIOS: 03.11.01.48.86
(II) NVIDIA(0): Detected AGP rate: 4X
(--) NVIDIA(0): Interlaced video modes are not supported on this GPU
(--) NVIDIA(0): Connected display device(s) on GeForce2 MX/MX 400 at
(--) NVIDIA(0): PCI:1:0:0:
(--) NVIDIA(0): CRT-0
(--) NVIDIA(0): CRT-0: 350.0 MHz maximum pixel clock
(II) NVIDIA(0): Assigned Display Device: CRT-0
(WW) NVIDIA(0): No valid modes for "1280x800"; removing.
(II) NVIDIA(0): Validated modes:
(II) NVIDIA(0): "1280x1024"
(II) NVIDIA(0): "1280x960"
(II) NVIDIA(0): "1152x864"
(II) NVIDIA(0): "1152x768"
(II) NVIDIA(0): "1024x768"
(II) NVIDIA(0): "800x600"
(II) NVIDIA(0): "640x480"
(II) NVIDIA(0): Virtual screen size determined to be 1280 x 1024
(WW) NVIDIA(0): Unable to get display device CRT-0's EDID; cannot compute DPI
(WW) NVIDIA(0): from EDID.
(==) NVIDIA(0): DPI set to (75, 75); computed from built-in default
(--) Depth 24 pixmap format is 32 bpp
(II) do I need RAC? No, I don't.
(II) resource ranges after preInit:
[0] 0 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B]
[1] 0 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B]
[2] -1 0 0x00100000 - 0x3fffffff (0x3ff00000) MX[B]E(B)
[3] -1 0 0x000f0000 - 0x000fffff (0x10000) MX[B]
[4] -1 0 0x000c0000 - 0x000effff (0x30000) MX[B]
[5] -1 0 0x00000000 - 0x0009ffff (0xa0000) MX[B]
[6] -1 0 0xf8400000 - 0xf840ffff (0x10000) MX[B]
[7] -1 0 0xf8500600 - 0xf85006ff (0x100) MX[B]
[8] -1 0 0xf8500400 - 0xf85005ff (0x200) MX[B]
[9] -1 0 0x70000000 - 0x700003ff (0x400) MX[B]
[10] -1 0 0xf8500000 - 0xf85003ff (0x400) MX[B]
[11] -1 0 0xe8000000 - 0xe7ffffff (0x0) MX[B]O
[12] -1 0 0xf0000000 - 0xf7ffffff (0x8000000) MX[B](B)
[13] -1 0 0xf9000000 - 0xf9ffffff (0x1000000) MX[B](B)
[14] 0 0 0x000a0000 - 0x000affff (0x10000) MS[B](OprD)
[15] 0 0 0x000b0000 - 0x000b7fff (0x8000) MS[B](OprD)
[16] 0 0 0x000b8000 - 0x000bffff (0x8000) MS[B](OprD)
[17] -1 0 0x0000ffff - 0x0000ffff (0x1) IX[B]
[18] -1 0 0x00000000 - 0x000000ff (0x100) IX[B]
[19] -1 0 0x00001400 - 0x0000143f (0x40) IX[B]
[20] -1 0 0x00001000 - 0x000010ff (0x100) IX[B]
[21] -1 0 0x000014d0 - 0x000014df (0x10) IX[B]
[22] -1 0 0x0000180c - 0x0000180f (0x4) IX[B]
[23] -1 0 0x000014f8 - 0x000014ff (0x8) IX[B]
[24] -1 0 0x00001808 - 0x0000180b (0x4) IX[B]
[25] -1 0 0x000014f0 - 0x000014f7 (0x8) IX[B]
[26] -1 0 0x000014c0 - 0x000014cf (0x10) IX[B]
[27] -1 0 0x00001804 - 0x00001804 (0x1) IX[B]
[28] -1 0 0x000014e8 - 0x000014e8 (0x1) IX[B]
[29] -1 0 0x00001800 - 0x00001800 (0x1) IX[B]
[30] -1 0 0x000014e0 - 0x000014e0 (0x1) IX[B]
[31] -1 0 0x00001480 - 0x0000149f (0x20) IX[B]
[32] -1 0 0x00001460 - 0x0000147f (0x20) IX[B]
[33] -1 0 0x00001440 - 0x0000145f (0x20) IX[B]
[34] 0 0 0x000003b0 - 0x000003bb (0xc) IS[B](OprU)
[35] 0 0 0x000003c0 - 0x000003df (0x20) IS[B](OprU)
(II) NVIDIA(0): Setting mode "1280x1024"
(II) Loading extension NV-GLX
(II) NVIDIA(0): NVIDIA 3D Acceleration Architecture Initialized
(II) NVIDIA(0): Using the NVIDIA 2D acceleration architecture
(==) NVIDIA(0): Backing store disabled
(==) NVIDIA(0): Silken mouse enabled
(**) Option "dpms"
(**) NVIDIA(0): DPMS enabled
(II) Loading extension NV-CONTROL
(==) RandR enabled
(II) Initializing built-in extension MIT-SHM
(II) Initializing built-in extension XInputExtension
(II) Initializing built-in extension XTEST
(II) Initializing built-in extension XKEYBOARD
(II) Initializing built-in extension XC-APPGROUP
(II) Initializing built-in extension XAccessControlExtension
(II) Initializing built-in extension SECURITY
(II) Initializing built-in extension SELinux
(II) Initializing built-in extension XINERAMA
(II) Initializing built-in extension XFIXES
(II) Initializing built-in extension XFree86-Bigfont
(II) Initializing built-in extension RENDER
(II) Initializing built-in extension RANDR
(II) Initializing built-in extension COMPOSITE
(II) Initializing built-in extension DAMAGE
(II) Initializing built-in extension XEVIE
(II) Initializing extension GLX
XSELinux: Line 11 of /home/jcdxdev/tmp/modular/lib/xserver/XSELinuxConfig is invalid
Fatal server error:
XSELinux: Failed to load security policy
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH] refpolicy: add X object classes to unconfined_t
2006-11-29 22:34 ` Xavier Toth
@ 2006-11-30 3:27 ` Eamon Walsh
2006-12-05 22:47 ` XACE and MLS Ted X Toth
0 siblings, 1 reply; 13+ messages in thread
From: Eamon Walsh @ 2006-11-30 3:27 UTC (permalink / raw)
To: Xavier Toth; +Cc: selinux
[-- Attachment #1: Type: text/plain, Size: 1647 bytes --]
On Wed, 2006-11-29 at 16:34 -0600, Xavier Toth wrote:
> Humm I attached the log to my last post anyway I attached it again. I
> have been able to run Xorg under the targeted policy (permissive mode)
> after I chcon'd it to the same context as the Xorg in /usr/bin. Now
> I'm trying to get it working under the MLS permissive policy which
> doesn't have the unconfined_t type. Under MLS Xorg gets labeled as
> type bin_t so I chcon'd my Xorg to match and edited XSELinuxConfig
> replacing unconfined_t with bin_t. However the result of my simplistic
> approach is that Xorg fails to start complaining:
> XSELinux: Line 11 of
> /home/jcdxdev/tmp/modular/lib/xserver/XSELinuxConfig is invalid
>
> Fatal server error:
> XSELinux: Failed to load security policy
>
> Any suggestions?
The type of the Xorg executable itself is not what goes in the
XSELinuxConfig file. The types in the file are for internal X objects
such as windows that are managed by the SELinux control code in the X
server.
Try the the attached .te file. It works for me with MLS policy in
permissive mode. Use the instructions mentioned earlier to build it and
load it into your policy (URL below).
You also need to add the following line to XSELinuxConfig:
root_window_context system_u:object_r:root_window_t:s1
I just fixed this in git.
Again, this is going to create loads of denial messages in the Xorg log
file. The next step is to flesh out the .te file with appropriate allow
rules; something I haven't gotten around to yet.
http://fedora.redhat.com/docs/selinux-faq-fc5/#faq-entry-local.te
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
[-- Attachment #2: local.te --]
[-- Type: text/plain, Size: 874 bytes --]
policy_module(local, 1.0)
require {
class drawable all_drawable_perms;
class window all_window_perms;
class gc all_gc_perms;
class font all_font_perms;
class colormap all_colormap_perms;
class property all_property_perms;
class cursor all_cursor_perms;
class xclient all_xclient_perms;
class xserver all_xserver_perms;
class xinput all_xinput_perms;
class xextension all_xextension_perms;
}
# Type for remotely connected X clients
type remote_xclient_t;
# Type for the root window
type root_window_t;
# Types for properties
type wm_property_t;
type cut_buffer_property_t;
type unknown_property_t;
# Types for extensions
type std_ext_t;
type screensaver_ext_t;
type font_ext_t;
type shmem_ext_t;
type accelgraphics_ext_t;
type debug_ext_t;
type sync_ext_t;
type windowmgr_ext_t;
type video_ext_t;
type input_ext_t;
type security_ext_t;
type unknown_ext_t;
^ permalink raw reply [flat|nested] 13+ messages in thread
* XACE and MLS
2006-11-30 3:27 ` Eamon Walsh
@ 2006-12-05 22:47 ` Ted X Toth
2006-12-05 23:37 ` Eamon Walsh
0 siblings, 1 reply; 13+ messages in thread
From: Ted X Toth @ 2006-12-05 22:47 UTC (permalink / raw)
To: ewalsh; +Cc: selinux
We are interested in using X and an associated desktop/window manager
(most likely GNOME/Metacity) in an MLS environment and I'm trying to
figure out what all needs to be addressed to get there. A couple of
areas that I've thought about so far are window labeling and cut and
paste. For window labeling the window manager ought to be able to use
the context of it X server connection to decorate the window with the
level but what happens if for example a user does a newrole and changes
their level? For cut and paste dominance checks are needed would it be
reasonable to do these as an extension of the XACE and if so where can I
find out more about how to do this and if not where then?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: XACE and MLS
2006-12-05 22:47 ` XACE and MLS Ted X Toth
@ 2006-12-05 23:37 ` Eamon Walsh
0 siblings, 0 replies; 13+ messages in thread
From: Eamon Walsh @ 2006-12-05 23:37 UTC (permalink / raw)
To: Ted X Toth; +Cc: selinux
Ted X Toth wrote:
> We are interested in using X and an associated desktop/window manager
> (most likely GNOME/Metacity) in an MLS environment and I'm trying to
> figure out what all needs to be addressed to get there. A couple of
> areas that I've thought about so far are window labeling and cut and
> paste. For window labeling the window manager ought to be able to use
> the context of it X server connection to decorate the window with the
> level but what happens if for example a user does a newrole and changes
> their level?
The XSELinux extension provides window properties that can be used by
the window manager in the same manner as the usual WM_NAME, WM_COMMAND,
etc. The one currently available is _SELINUX_CLIENT_CONTEXT which
contains the domain of the connected process. Others will be introduced
in the future in particular _SELINUX_CONTEXT which will contain the
context of the window itself.
Here's a screen shot of a hacked twm that displays this property in
place of the usual window title:
http://people.freedesktop.org/~ewalsh/twm-demo.png
Note that what's really needed for proper labeling however is a
server-controlled, secure area of the screen that clients can't draw
into. There could be spoofing attacks otherwise.
> For cut and paste dominance checks are needed would it be
> reasonable to do these as an extension of the XACE and if so where can I
> find out more about how to do this and if not where then?
It depends on which cut & paste. The X server provides two methods: cut
buffers, which are implemented as properties on the root window, and
selections, which are implemented using a convoluted method of setting
properties on client windows and sending notification events. I believe
that both of these methods should be securable using the XSELinux
extension although ths work has not been done just yet.
Other cut & paste functionality may be provided by higher-level layers
such as toolkits (GTK+) or desktop systems (GNOME, etc). I have no
knowledge of these areas.
A good reference for X cut & paste is the xlib.PS document in the
xorg-docs package. The basic SELinux X classes and permissions are
described in the "Securing the X Window System with SELinux" paper on
www.nsa.gov/selinux.
--
Eamon Walsh <ewalsh@tycho.nsa.gov>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2006-12-05 23:37 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-09-12 19:11 [PATCH] refpolicy: add X object classes to unconfined_t Eamon Walsh
2006-09-13 13:47 ` Christopher J. PeBenito
2006-09-13 21:13 ` Eamon Walsh
2006-09-14 14:10 ` Joshua Brindle
2006-09-15 12:46 ` Joshua Brindle
2006-09-15 21:19 ` Eamon Walsh
2006-09-18 14:43 ` Christopher J. PeBenito
2006-11-29 15:12 ` Xavier Toth
2006-11-29 20:09 ` Eamon Walsh
2006-11-29 22:34 ` Xavier Toth
2006-11-30 3:27 ` Eamon Walsh
2006-12-05 22:47 ` XACE and MLS Ted X Toth
2006-12-05 23:37 ` Eamon Walsh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.