Re: Label Translation on Fedora 9

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul Moore wrote:
> On Monday 03 November 2008 8:51:49 am Stephen Smalley wrote:
>> On Mon, 2008-11-03 at 14:47 +0100, Andy Warner wrote:
>>> Stephen Smalley wrote:
>>>> On Mon, 2008-11-03 at 12:49 +0100, Andy Warner wrote:
>>>>> I am running Fedora 9 with the MLS policy and see no evidence
>>>>> that the label translation is enabled. I am using the default
>>>>> setrans.conf and the "disable=1" flag is commented out.
>>>>>
>>>>> Using the selinux_trans_to_raw (e.g., with a SystemHigh level)
>>>>> produces the exact same label string as passed in which will
>>>>> not pass validation (using s15:c0.c1023 will pass validation).
>>>>>
>>>>> Trying id-Z followed by newrole produces:
>>>>> id -Z
>>>>> warner_u:secadm_r:secadm_t:s0-s15:c0.c1023
>>>>>
>>>>> newrole -l SystemLow-SystemHigh
>>>>> warner_u:secadm_r:secadm_t:SystemLow-SystemHigh is not a valid
>>>>> context
>>>>>
>>>>> Is there something that must be done to activate label
>>>>> translation?
>>>> Label translation is provided by a daemon, mcstrans.
>>>>
>>>> yum install mcstrans
>>>> /sbin/chkconfig mcstrans on
>>>> /sbin/service mcstrans start
>>> Thanks. I was not starting the mcstrans service. When I get a
>>> translation, it seems odd as follows.
>>>
>>> without mcstrans:
>>> id -Z
>>> warner_u:secadm_r:secadm_t:s0-s15:c0.c1023
>>>
>>> with mcstrans:
>>> id -Z
>>> warner_u:secadm_r:secadm_t:SystemLow:SystemLow-SystemHigh
>>>
>>> Is it expected to have the high end of the range expressed as a
>>> range? The translation table has the following relevant entries:
>>> s0                             SystemLow
>>> s0-s15:c0.c1023      SystemLow-SystemHigh
>> No, that looks wrong to me as well.  cc'ing Dan Walsh of Red Hat, who
>> maintains mcstrans.
>>
>> BTW, if you are looking for more complete MLS label translation
>> support, you might try the extended mcstrans posted by Joe Nall.
> 
> What is the status of the patch?  I vaguely remember a little bit of 
> discussion/review about the patch but it's not clear to me if it was 
> ever accepted into upstream/Fedora and if it wasn't what the next steps 
> were going to be ...
> 
Good question, we have let this slip through the cracks.  I would like
to replace my library totally with Joe's.  The only concern would be to
allow people who used my format to convert to the new format if possible
or at least document how to do this.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkkPYFkACgkQrlYvE4MpobOZRQCfbG2Nk+8sRypiJgSjIATHqLeI
jz4An3xTcOjf4ZJpwP2j0PtnM+bPRrR7
=iNCh
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.