* Setting labels on a disabled SELinux box.
@ 2010-04-20 14:21 Daniel J Walsh
2010-04-20 14:45 ` Stephen Smalley
0 siblings, 1 reply; 6+ messages in thread
From: Daniel J Walsh @ 2010-04-20 14:21 UTC (permalink / raw)
To: SELinux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Currently the kernel is blocking the setting of labels on a disabled
SELinux box.
We have made changes to livecd to be able to build a livecd image on a
disabled SELinux box, but the kernel is preventing the placing of labels.
We want this functionality so that Fedora Build machines can be allowed
to create different kinds of images and do not want to require all
machines to enable SELinux.
Currently these images are being built with SELinux disabled because of
this.
strace shows
lsetxattr("/root/whatever/", "security.selinux",
"system_u:object_r:root_t:s0", 28, 0) = -1 EOPNOTSUPP (Operation not
supported)
eparis says this code is causing the problem.
static int cap_inode_setsecurity(struct inode *inode, const char *name,
const void *value, size_t size, int flags)
{
return -EOPNOTSUPP;
}
I think we should allow this if you have a capability like sys_admin or
dac_override.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvNuHcACgkQrlYvE4MpobO6pACgxMKs4oFogWstSyTdzLFsO1Ot
8DkAoKZswtvA17iC0HGDpssyNyUxDjNa
=lGy3
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Setting labels on a disabled SELinux box.
2010-04-20 14:21 Setting labels on a disabled SELinux box Daniel J Walsh
@ 2010-04-20 14:45 ` Stephen Smalley
2010-04-20 15:00 ` Daniel J Walsh
0 siblings, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2010-04-20 14:45 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SELinux, Eric Paris
On Tue, 2010-04-20 at 10:21 -0400, Daniel J Walsh wrote:
> Currently the kernel is blocking the setting of labels on a disabled
> SELinux box.
>
> We have made changes to livecd to be able to build a livecd image on a
> disabled SELinux box, but the kernel is preventing the placing of labels.
>
> We want this functionality so that Fedora Build machines can be allowed
> to create different kinds of images and do not want to require all
> machines to enable SELinux.
>
> Currently these images are being built with SELinux disabled because of
> this.
>
> strace shows
>
> lsetxattr("/root/whatever/", "security.selinux",
> "system_u:object_r:root_t:s0", 28, 0) = -1 EOPNOTSUPP (Operation not
> supported)
>
>
> eparis says this code is causing the problem.
>
> static int cap_inode_setsecurity(struct inode *inode, const char *name,
> const void *value, size_t size, int flags)
> {
> return -EOPNOTSUPP;
> }
>
> I think we should allow this if you have a capability like sys_admin or
> dac_override.
Perhaps I don't understand, but inode_setsecurity() is only called if
the filesystem does not support xattrs; otherwise it gets handled via
the filesytem's ->setxattr handler, and that should work regardless of
SELinux-disabled (and always has in the past).
I think we need more details, like kernel version, filesystem type, etc.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Setting labels on a disabled SELinux box.
2010-04-20 14:45 ` Stephen Smalley
@ 2010-04-20 15:00 ` Daniel J Walsh
2010-04-20 15:05 ` Eric Paris
0 siblings, 1 reply; 6+ messages in thread
From: Daniel J Walsh @ 2010-04-20 15:00 UTC (permalink / raw)
To: Stephen Smalley; +Cc: SELinux, Eric Paris
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/20/2010 10:45 AM, Stephen Smalley wrote:
> On Tue, 2010-04-20 at 10:21 -0400, Daniel J Walsh wrote:
>> Currently the kernel is blocking the setting of labels on a disabled
>> SELinux box.
>>
>> We have made changes to livecd to be able to build a livecd image on a
>> disabled SELinux box, but the kernel is preventing the placing of labels.
>>
>> We want this functionality so that Fedora Build machines can be allowed
>> to create different kinds of images and do not want to require all
>> machines to enable SELinux.
>>
>> Currently these images are being built with SELinux disabled because of
>> this.
>>
>> strace shows
>>
>> lsetxattr("/root/whatever/", "security.selinux",
>> "system_u:object_r:root_t:s0", 28, 0) = -1 EOPNOTSUPP (Operation not
>> supported)
>>
>>
>> eparis says this code is causing the problem.
>>
>> static int cap_inode_setsecurity(struct inode *inode, const char *name,
>> const void *value, size_t size, int flags)
>> {
>> return -EOPNOTSUPP;
>> }
>>
>> I think we should allow this if you have a capability like sys_admin or
>> dac_override.
>
> Perhaps I don't understand, but inode_setsecurity() is only called if
> the filesystem does not support xattrs; otherwise it gets handled via
> the filesytem's ->setxattr handler, and that should work regardless of
> SELinux-disabled (and always has in the past).
>
> I think we need more details, like kernel version, filesystem type, etc.
>
2.6.32.11-99.fc12.x86_64; ext4
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvNwXsACgkQrlYvE4MpobPKMQCgpuvQ4a3fmPWRqs27VFQzR5rT
G44An1MkWEUAOIshAvbmvaqQqzG3Oiql
=tQVy
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Setting labels on a disabled SELinux box.
2010-04-20 15:00 ` Daniel J Walsh
@ 2010-04-20 15:05 ` Eric Paris
2010-04-20 15:12 ` Stephen Smalley
0 siblings, 1 reply; 6+ messages in thread
From: Eric Paris @ 2010-04-20 15:05 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SELinux
It does look like you are right, we might never hit the
cap_inode_setsecurity, but I'm trying to run down exactly how this is
happening....
-Eric
On Tue, Apr 20, 2010 at 11:00 AM, Daniel J Walsh <dwalsh@redhat.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 04/20/2010 10:45 AM, Stephen Smalley wrote:
>> On Tue, 2010-04-20 at 10:21 -0400, Daniel J Walsh wrote:
>>> Currently the kernel is blocking the setting of labels on a disabled
>>> SELinux box.
>>>
>>> We have made changes to livecd to be able to build a livecd image on a
>>> disabled SELinux box, but the kernel is preventing the placing of labels.
>>>
>>> We want this functionality so that Fedora Build machines can be allowed
>>> to create different kinds of images and do not want to require all
>>> machines to enable SELinux.
>>>
>>> Currently these images are being built with SELinux disabled because of
>>> this.
>>>
>>> strace shows
>>>
>>> lsetxattr("/root/whatever/", "security.selinux",
>>> "system_u:object_r:root_t:s0", 28, 0) = -1 EOPNOTSUPP (Operation not
>>> supported)
>>>
>>>
>>> eparis says this code is causing the problem.
>>>
>>> static int cap_inode_setsecurity(struct inode *inode, const char *name,
>>> const void *value, size_t size, int flags)
>>> {
>>> return -EOPNOTSUPP;
>>> }
>>>
>>> I think we should allow this if you have a capability like sys_admin or
>>> dac_override.
>>
>> Perhaps I don't understand, but inode_setsecurity() is only called if
>> the filesystem does not support xattrs; otherwise it gets handled via
>> the filesytem's ->setxattr handler, and that should work regardless of
>> SELinux-disabled (and always has in the past).
>>
>> I think we need more details, like kernel version, filesystem type, etc.
>>
>
> 2.6.32.11-99.fc12.x86_64; ext4
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.14 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkvNwXsACgkQrlYvE4MpobPKMQCgpuvQ4a3fmPWRqs27VFQzR5rT
> G44An1MkWEUAOIshAvbmvaqQqzG3Oiql
> =tQVy
> -----END PGP SIGNATURE-----
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Setting labels on a disabled SELinux box.
2010-04-20 15:05 ` Eric Paris
@ 2010-04-20 15:12 ` Stephen Smalley
2010-04-20 16:00 ` Daniel J Walsh
0 siblings, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2010-04-20 15:12 UTC (permalink / raw)
To: Eric Paris; +Cc: Daniel J Walsh, SELinux
On Tue, 2010-04-20 at 11:05 -0400, Eric Paris wrote:
> It does look like you are right, we might never hit the
> cap_inode_setsecurity, but I'm trying to run down exactly how this is
> happening....
>
> -Eric
>
> On Tue, Apr 20, 2010 at 11:00 AM, Daniel J Walsh <dwalsh@redhat.com> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On 04/20/2010 10:45 AM, Stephen Smalley wrote:
> >> On Tue, 2010-04-20 at 10:21 -0400, Daniel J Walsh wrote:
> >>> Currently the kernel is blocking the setting of labels on a disabled
> >>> SELinux box.
> >>>
> >>> We have made changes to livecd to be able to build a livecd image on a
> >>> disabled SELinux box, but the kernel is preventing the placing of labels.
> >>>
> >>> We want this functionality so that Fedora Build machines can be allowed
> >>> to create different kinds of images and do not want to require all
> >>> machines to enable SELinux.
> >>>
> >>> Currently these images are being built with SELinux disabled because of
> >>> this.
> >>>
> >>> strace shows
> >>>
> >>> lsetxattr("/root/whatever/", "security.selinux",
> >>> "system_u:object_r:root_t:s0", 28, 0) = -1 EOPNOTSUPP (Operation not
> >>> supported)
> >>>
> >>>
> >>> eparis says this code is causing the problem.
> >>>
> >>> static int cap_inode_setsecurity(struct inode *inode, const char *name,
> >>> const void *value, size_t size, int flags)
> >>> {
> >>> return -EOPNOTSUPP;
> >>> }
> >>>
> >>> I think we should allow this if you have a capability like sys_admin or
> >>> dac_override.
> >>
> >> Perhaps I don't understand, but inode_setsecurity() is only called if
> >> the filesystem does not support xattrs; otherwise it gets handled via
> >> the filesytem's ->setxattr handler, and that should work regardless of
> >> SELinux-disabled (and always has in the past).
> >>
> >> I think we need more details, like kernel version, filesystem type, etc.
> >>
> >
> > 2.6.32.11-99.fc12.x86_64; ext4
Oh, this is the dracut bug that isn't really disabling SELinux (just
leaving it permissive with no policy loaded). Ala FC2 days. Didn't
that get fixed?
grep selinuxfs /proc/filesystems
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Setting labels on a disabled SELinux box.
2010-04-20 15:12 ` Stephen Smalley
@ 2010-04-20 16:00 ` Daniel J Walsh
0 siblings, 0 replies; 6+ messages in thread
From: Daniel J Walsh @ 2010-04-20 16:00 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Eric Paris, SELinux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/20/2010 11:12 AM, Stephen Smalley wrote:
> On Tue, 2010-04-20 at 11:05 -0400, Eric Paris wrote:
>> It does look like you are right, we might never hit the
>> cap_inode_setsecurity, but I'm trying to run down exactly how this is
>> happening....
>>
>> -Eric
>>
>> On Tue, Apr 20, 2010 at 11:00 AM, Daniel J Walsh <dwalsh@redhat.com> wrote:
>>> -----BEGIN PGP SIGNED MESSAGE-----
>>> Hash: SHA1
>>>
>>> On 04/20/2010 10:45 AM, Stephen Smalley wrote:
>>>> On Tue, 2010-04-20 at 10:21 -0400, Daniel J Walsh wrote:
>>>>> Currently the kernel is blocking the setting of labels on a disabled
>>>>> SELinux box.
>>>>>
>>>>> We have made changes to livecd to be able to build a livecd image on a
>>>>> disabled SELinux box, but the kernel is preventing the placing of labels.
>>>>>
>>>>> We want this functionality so that Fedora Build machines can be allowed
>>>>> to create different kinds of images and do not want to require all
>>>>> machines to enable SELinux.
>>>>>
>>>>> Currently these images are being built with SELinux disabled because of
>>>>> this.
>>>>>
>>>>> strace shows
>>>>>
>>>>> lsetxattr("/root/whatever/", "security.selinux",
>>>>> "system_u:object_r:root_t:s0", 28, 0) = -1 EOPNOTSUPP (Operation not
>>>>> supported)
>>>>>
>>>>>
>>>>> eparis says this code is causing the problem.
>>>>>
>>>>> static int cap_inode_setsecurity(struct inode *inode, const char *name,
>>>>> const void *value, size_t size, int flags)
>>>>> {
>>>>> return -EOPNOTSUPP;
>>>>> }
>>>>>
>>>>> I think we should allow this if you have a capability like sys_admin or
>>>>> dac_override.
>>>>
>>>> Perhaps I don't understand, but inode_setsecurity() is only called if
>>>> the filesystem does not support xattrs; otherwise it gets handled via
>>>> the filesytem's ->setxattr handler, and that should work regardless of
>>>> SELinux-disabled (and always has in the past).
>>>>
>>>> I think we need more details, like kernel version, filesystem type, etc.
>>>>
>>>
>>> 2.6.32.11-99.fc12.x86_64; ext4
>
> Oh, this is the dracut bug that isn't really disabling SELinux (just
> leaving it permissive with no policy loaded). Ala FC2 days. Didn't
> that get fixed?
>
> grep selinuxfs /proc/filesystems
>
I believe it is fixed in F13. Not in F12.
Looks like Harald is just about to push F13 dracut into F12.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvNz5gACgkQrlYvE4MpobOosgCcCFUmcMJzNGs7zDlvmmytLf6b
5o0AoOEGAxjtVb/9AVJ5AAlxFcpxaZNF
=uFWS
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-04-20 16:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-04-20 14:21 Setting labels on a disabled SELinux box Daniel J Walsh
2010-04-20 14:45 ` Stephen Smalley
2010-04-20 15:00 ` Daniel J Walsh
2010-04-20 15:05 ` Eric Paris
2010-04-20 15:12 ` Stephen Smalley
2010-04-20 16:00 ` Daniel J Walsh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.