Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Alice Mynona]

Hello,

during the developing of a SELinux module for an antivirus software an additional question arised:

There a two boolean variables named "boolean_a" and "boolean_b". The SELinux module should automatically set "boolean_a" to true, if "boolean_b" has been set to true an set it to false if "boolean_b" has been deactived. Is there a way to realize this?

Thanks in advance.

Best regards,
Alice

-- 
+ Alice Mynona
+ Email: Alice_Mynona@bian-fu.net





--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Alice Mynona]

Hello,

during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"

...
libsepol.context_from_record: type antivirus_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.context_from_string: could not create context structure
libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid

"antivirus_t" is a domain I have defined in my module:

type antivirus_t;
domain_type(antivirus_t)

I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 

I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.

Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.

I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".

Thanks in advance.

Best regards,
Alice

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Xavier Toth]

Can you post you te file?

Ted

On Thu, Jun 24, 2010 at 10:01 AM, Alice Mynona <alice_mynona@bian-fu.net> wrote:
> Hello,
>
> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
>
> ...
> libsepol.context_from_record: type antivirus_t is not defined
> libsepol.context_from_record: could not create context structure
> libsepol.context_from_string: could not create context structure
> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
>
> "antivirus_t" is a domain I have defined in my module:
>
> type antivirus_t;
> domain_type(antivirus_t)
>
> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists.
>
> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
>
> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
>
> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
>
> Thanks in advance.
>
> Best regards,
> Alice
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 513 bytes --]

On 06/24/2010 05:01 PM, Alice Mynona wrote:
> I have also taken a look at "file_contexts" (cd
/etc/selinux/targeted/modules/active && grep antivirus_t
file_contexts*), but there's no "antivirus_t" anymore.

antivirus_t is defined a domain type so you wont find it in the list of
file contexts because those are file types.

does sesearch --allow -s antivirus_t return anything or sesearch --allow
-t antivirus_t?

and:

semanage fcontext -l | grep antivirus

and

semodule -l | grep antivirus


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 261 bytes --]

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Alice Mynona]

Thanks for your answer.

Dominick Grift schrieb am 24.06.2010 18:14 Uhr:
> On 06/24/2010 05:01 PM, Alice Mynona wrote:
>> I have also taken a look at "file_contexts" (cd
> /etc/selinux/targeted/modules/active && grep antivirus_t
> file_contexts*), but there's no "antivirus_t" anymore.
> 
> antivirus_t is defined a domain type so you wont find it in the list of
> file contexts because those are file types.
>

stupid ;-) It's late. Of course, you are right.
 
> does sesearch --allow -s antivirus_t return anything

ERROR: could not find datum for type antivirus_t

> or sesearch --allow -t antivirus_t?

ERROR: could not find datum for type antivirus_t

> 
> and:
> 
> semanage fcontext -l | grep antivirus

No matches.

> 
> and
> 
> semodule -l | grep antivirus
> 

No matches.

It's funny, isn't it?

Best regards,

Alice

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Alice Mynona]

Thanks for your answer.

Xavier Toth schrieb am 24.06.2010 17:35 Uhr:
> Can you post you te file?
>

Unfortunately not. I was just testing something. After the removal of the module, I have deleted the files. I have noticed the error described in my last posting a few hours later. Next time I will backup files for testing purposes, too.

Best regards,

Alice
 
> Ted
> 
> On Thu, Jun 24, 2010 at 10:01 AM, Alice Mynona <alice_mynona@bian-fu.net> wrote:
>> Hello,
>>
>> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
>>
>> ...
>> libsepol.context_from_record: type antivirus_t is not defined
>> libsepol.context_from_record: could not create context structure
>> libsepol.context_from_string: could not create context structure
>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
>>
>> "antivirus_t" is a domain I have defined in my module:
>>
>> type antivirus_t;
>> domain_type(antivirus_t)
>>
>> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists.
>>
>> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
>>
>> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
>>
>> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
>>
>> Thanks in advance.
>>
>> Best regards,
>> Alice
>>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Stephen Smalley]

On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
> Hello,
> 
> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
> 
> ...
> libsepol.context_from_record: type antivirus_t is not defined
> libsepol.context_from_record: could not create context structure
> libsepol.context_from_string: could not create context structure
> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> 
> "antivirus_t" is a domain I have defined in my module:
> 
> type antivirus_t;
> domain_type(antivirus_t)
> 
> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
> 
> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
> 
> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
> 
> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".

Sounds like the -l option to audit2allow isn't working correctly, so
that instead of only processing audit messages since the last policy
reload, you are still processing the audit messages from when that
policy module was installed, and unsurprisingly it cannot map those
contexts since you removed the module.  That would be a bug in
audit2allow/sepolgen.

Workaround would be to use ausearch to select the desired range of
messsages specifically, e.g.
/sbin/ausearch -m AVC -ts today | audit2allow

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Stephen Smalley]

On Thu, 2010-06-24 at 13:12 -0400, Stephen Smalley wrote:
> On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
> > Hello,
> > 
> > during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
> > 
> > ...
> > libsepol.context_from_record: type antivirus_t is not defined
> > libsepol.context_from_record: could not create context structure
> > libsepol.context_from_string: could not create context structure
> > libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> > 
> > "antivirus_t" is a domain I have defined in my module:
> > 
> > type antivirus_t;
> > domain_type(antivirus_t)
> > 
> > I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
> > 
> > I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
> > 
> > Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
> > 
> > I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
> 
> Sounds like the -l option to audit2allow isn't working correctly, so
> that instead of only processing audit messages since the last policy
> reload, you are still processing the audit messages from when that
> policy module was installed, and unsurprisingly it cannot map those
> contexts since you removed the module.  That would be a bug in
> audit2allow/sepolgen.
> 
> Workaround would be to use ausearch to select the desired range of
> messsages specifically, e.g.
> /sbin/ausearch -m AVC -ts today | audit2allow

Dan - looks like you pushed the audit2why analyze calls down into
sepolgen while it is parsing the messages.  But this means that all
messages will be analyzed even if the user specified -l.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Alice Mynona]

Stephen Smalley schrieb am 24.06.2010 19:33 Uhr:
> On Thu, 2010-06-24 at 13:12 -0400, Stephen Smalley wrote:
>> On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
>>> Hello,
>>>
>>> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
>>>
>>> ...
>>> libsepol.context_from_record: type antivirus_t is not defined
>>> libsepol.context_from_record: could not create context structure
>>> libsepol.context_from_string: could not create context structure
>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
>>>
>>> "antivirus_t" is a domain I have defined in my module:
>>>
>>> type antivirus_t;
>>> domain_type(antivirus_t)
>>>
>>> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
>>>
>>> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
>>>
>>> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
>>>
>>> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
>>
>> Sounds like the -l option to audit2allow isn't working correctly, so
>> that instead of only processing audit messages since the last policy
>> reload, you are still processing the audit messages from when that
>> policy module was installed, and unsurprisingly it cannot map those
>> contexts since you removed the module.  That would be a bug in
>> audit2allow/sepolgen.
>>
>> Workaround would be to use ausearch to select the desired range of
>> messsages specifically, e.g.
>> /sbin/ausearch -m AVC -ts today | audit2allow
>

I did a reload today at 08:36:00 a.m. (semodule -R). Round about two and half hours later I checked the auditlog:

ausearch -m AVC --start 25.06.2010 08:36:00 --end 25.06.2010 11:00:00

Only messages from ssh_t (success=yes). Fine. But "audit2allow -a -l" still throws error messages:

...
libsepol.context_from_record: type antivirus_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.context_from_string: could not create context structure
libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
...

> Dan - looks like you pushed the audit2why analyze calls down into
> sepolgen while it is parsing the messages.  But this means that all
> messages will be analyzed even if the user specified -l.
> 

I will wait for Dan's answer :-).

Problem solved. @All: Thanks for your help.

Best regards,

Alice

p.s.:
I still don't know how to debug sepol-messages. Can you give me a hint?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 3843 bytes --]

On 06/25/2010 12:11 PM, Alice Mynona wrote:
> Stephen Smalley schrieb am 24.06.2010 19:33 Uhr:
>> On Thu, 2010-06-24 at 13:12 -0400, Stephen Smalley wrote:
>>> On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
>>>> Hello,
>>>>
>>>> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
>>>>
>>>> ...
>>>> libsepol.context_from_record: type antivirus_t is not defined
>>>> libsepol.context_from_record: could not create context structure
>>>> libsepol.context_from_string: could not create context structure
>>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
>>>>
>>>> "antivirus_t" is a domain I have defined in my module:
>>>>
>>>> type antivirus_t;
>>>> domain_type(antivirus_t)
>>>>
>>>> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
>>>>
>>>> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
>>>>
>>>> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
>>>>
>>>> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
>>>
>>> Sounds like the -l option to audit2allow isn't working correctly, so
>>> that instead of only processing audit messages since the last policy
>>> reload, you are still processing the audit messages from when that
>>> policy module was installed, and unsurprisingly it cannot map those
>>> contexts since you removed the module.  That would be a bug in
>>> audit2allow/sepolgen.
>>>
>>> Workaround would be to use ausearch to select the desired range of
>>> messsages specifically, e.g.
>>> /sbin/ausearch -m AVC -ts today | audit2allow
>>
> 
> I did a reload today at 08:36:00 a.m. (semodule -R). Round about two and half hours later I checked the auditlog:
> 
> ausearch -m AVC --start 25.06.2010 08:36:00 --end 25.06.2010 11:00:00
> 
> Only messages from ssh_t (success=yes). Fine. But "audit2allow -a -l" still throws error messages:
> 
> ...
> libsepol.context_from_record: type antivirus_t is not defined
> libsepol.context_from_record: could not create context structure
> libsepol.context_from_string: could not create context structure
> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> ...
> 
>> Dan - looks like you pushed the audit2why analyze calls down into
>> sepolgen while it is parsing the messages.  But this means that all
>> messages will be analyzed even if the user specified -l.
>>
> 
> I will wait for Dan's answer :-).
> 
> Problem solved. @All: Thanks for your help.
> 
> Best regards,
> 
> Alice
> 
> p.s.:
> I still don't know how to debug sepol-messages. Can you give me a hint?

I think it is not just with the -l option as i had similar output today
by using plain ausearch -m avc -ts recent | audit2allow:

libsepol.context_from_record: invalid security context:
"staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
libsepol.context_from_record: could not create context structure
libsepol.context_from_string: could not create context structure
libsepol.sepol_context_to_sid: could not convert
staff_u:staff_r:mozilla_t:s0-s0:c0.c1023 to sid
libsepol.context_from_record: invalid security context:
"staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"


> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 261 bytes --]

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Daniel J Walsh]

On 06/25/2010 06:30 AM, Dominick Grift wrote:
> On 06/25/2010 12:11 PM, Alice Mynona wrote:
>> Stephen Smalley schrieb am 24.06.2010 19:33 Uhr:
>>> On Thu, 2010-06-24 at 13:12 -0400, Stephen Smalley wrote:
>>>> On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
>>>>> Hello,
>>>>>
>>>>> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
>>>>>
>>>>> ...
>>>>> libsepol.context_from_record: type antivirus_t is not defined
>>>>> libsepol.context_from_record: could not create context structure
>>>>> libsepol.context_from_string: could not create context structure
>>>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
>>>>>
>>>>> "antivirus_t" is a domain I have defined in my module:
>>>>>
>>>>> type antivirus_t;
>>>>> domain_type(antivirus_t)
>>>>>
>>>>> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
>>>>>
>>>>> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
>>>>>
>>>>> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
>>>>>
>>>>> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
>>>>
>>>> Sounds like the -l option to audit2allow isn't working correctly, so
>>>> that instead of only processing audit messages since the last policy
>>>> reload, you are still processing the audit messages from when that
>>>> policy module was installed, and unsurprisingly it cannot map those
>>>> contexts since you removed the module.  That would be a bug in
>>>> audit2allow/sepolgen.
>>>>
>>>> Workaround would be to use ausearch to select the desired range of
>>>> messsages specifically, e.g.
>>>> /sbin/ausearch -m AVC -ts today | audit2allow
>>>
>>
>> I did a reload today at 08:36:00 a.m. (semodule -R). Round about two and half hours later I checked the auditlog:
>>
>> ausearch -m AVC --start 25.06.2010 08:36:00 --end 25.06.2010 11:00:00
>>
>> Only messages from ssh_t (success=yes). Fine. But "audit2allow -a -l" still throws error messages:
>>
>> ...
>> libsepol.context_from_record: type antivirus_t is not defined
>> libsepol.context_from_record: could not create context structure
>> libsepol.context_from_string: could not create context structure
>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
>> ...
>>
>>> Dan - looks like you pushed the audit2why analyze calls down into
>>> sepolgen while it is parsing the messages.  But this means that all
>>> messages will be analyzed even if the user specified -l.
>>>
>>
>> I will wait for Dan's answer :-).
>>
>> Problem solved. @All: Thanks for your help.
>>
>> Best regards,
>>
>> Alice
>>
>> p.s.:
>> I still don't know how to debug sepol-messages. Can you give me a hint?
> 
> I think it is not just with the -l option as i had similar output today
> by using plain ausearch -m avc -ts recent | audit2allow:
> 
> libsepol.context_from_record: invalid security context:
> "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
> libsepol.context_from_record: could not create context structure
> libsepol.context_from_string: could not create context structure
> libsepol.sepol_context_to_sid: could not convert
> staff_u:staff_r:mozilla_t:s0-s0:c0.c1023 to sid
> libsepol.context_from_record: invalid security context:
> "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
> 
> 
>>
>> --
>> This message was distributed to subscribers of the selinux mailing list.
>> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
>> the words "unsubscribe selinux" without quotes as the message.
> 
> 
Yes I want the analysis to show up in audit2allow, If libsemanage would
just shut up, we really should ignore the errors.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Stephen Smalley]

On Fri, 2010-06-25 at 16:18 -0400, Daniel J Walsh wrote:
> On 06/25/2010 06:30 AM, Dominick Grift wrote:
> > On 06/25/2010 12:11 PM, Alice Mynona wrote:
> >> Stephen Smalley schrieb am 24.06.2010 19:33 Uhr:
> >>> On Thu, 2010-06-24 at 13:12 -0400, Stephen Smalley wrote:
> >>>> On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
> >>>>> Hello,
> >>>>>
> >>>>> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
> >>>>>
> >>>>> ...
> >>>>> libsepol.context_from_record: type antivirus_t is not defined
> >>>>> libsepol.context_from_record: could not create context structure
> >>>>> libsepol.context_from_string: could not create context structure
> >>>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> >>>>>
> >>>>> "antivirus_t" is a domain I have defined in my module:
> >>>>>
> >>>>> type antivirus_t;
> >>>>> domain_type(antivirus_t)
> >>>>>
> >>>>> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
> >>>>>
> >>>>> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
> >>>>>
> >>>>> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
> >>>>>
> >>>>> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
> >>>>
> >>>> Sounds like the -l option to audit2allow isn't working correctly, so
> >>>> that instead of only processing audit messages since the last policy
> >>>> reload, you are still processing the audit messages from when that
> >>>> policy module was installed, and unsurprisingly it cannot map those
> >>>> contexts since you removed the module.  That would be a bug in
> >>>> audit2allow/sepolgen.
> >>>>
> >>>> Workaround would be to use ausearch to select the desired range of
> >>>> messsages specifically, e.g.
> >>>> /sbin/ausearch -m AVC -ts today | audit2allow
> >>>
> >>
> >> I did a reload today at 08:36:00 a.m. (semodule -R). Round about two and half hours later I checked the auditlog:
> >>
> >> ausearch -m AVC --start 25.06.2010 08:36:00 --end 25.06.2010 11:00:00
> >>
> >> Only messages from ssh_t (success=yes). Fine. But "audit2allow -a -l" still throws error messages:
> >>
> >> ...
> >> libsepol.context_from_record: type antivirus_t is not defined
> >> libsepol.context_from_record: could not create context structure
> >> libsepol.context_from_string: could not create context structure
> >> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> >> ...
> >>
> >>> Dan - looks like you pushed the audit2why analyze calls down into
> >>> sepolgen while it is parsing the messages.  But this means that all
> >>> messages will be analyzed even if the user specified -l.
> >>>
> >>
> >> I will wait for Dan's answer :-).
> >>
> >> Problem solved. @All: Thanks for your help.
> >>
> >> Best regards,
> >>
> >> Alice
> >>
> >> p.s.:
> >> I still don't know how to debug sepol-messages. Can you give me a hint?
> > 
> > I think it is not just with the -l option as i had similar output today
> > by using plain ausearch -m avc -ts recent | audit2allow:
> > 
> > libsepol.context_from_record: invalid security context:
> > "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
> > libsepol.context_from_record: could not create context structure
> > libsepol.context_from_string: could not create context structure
> > libsepol.sepol_context_to_sid: could not convert
> > staff_u:staff_r:mozilla_t:s0-s0:c0.c1023 to sid
> > libsepol.context_from_record: invalid security context:
> > "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
> > 
> > 
> >>
> >> --
> >> This message was distributed to subscribers of the selinux mailing list.
> >> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> >> the words "unsubscribe selinux" without quotes as the message.
> > 
> > 
> Yes I want the analysis to show up in audit2allow, If libsemanage would
> just shut up, we really should ignore the errors.

Then use semanage_msg_set_callback(hnd, NULL, NULL);

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Stephen Smalley]

On Fri, 2010-06-25 at 16:23 -0400, Stephen Smalley wrote:
> On Fri, 2010-06-25 at 16:18 -0400, Daniel J Walsh wrote:
> > On 06/25/2010 06:30 AM, Dominick Grift wrote:
> > > On 06/25/2010 12:11 PM, Alice Mynona wrote:
> > >> Stephen Smalley schrieb am 24.06.2010 19:33 Uhr:
> > >>> On Thu, 2010-06-24 at 13:12 -0400, Stephen Smalley wrote:
> > >>>> On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
> > >>>>> Hello,
> > >>>>>
> > >>>>> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
> > >>>>>
> > >>>>> ...
> > >>>>> libsepol.context_from_record: type antivirus_t is not defined
> > >>>>> libsepol.context_from_record: could not create context structure
> > >>>>> libsepol.context_from_string: could not create context structure
> > >>>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> > >>>>>
> > >>>>> "antivirus_t" is a domain I have defined in my module:
> > >>>>>
> > >>>>> type antivirus_t;
> > >>>>> domain_type(antivirus_t)
> > >>>>>
> > >>>>> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
> > >>>>>
> > >>>>> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
> > >>>>>
> > >>>>> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
> > >>>>>
> > >>>>> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
> > >>>>
> > >>>> Sounds like the -l option to audit2allow isn't working correctly, so
> > >>>> that instead of only processing audit messages since the last policy
> > >>>> reload, you are still processing the audit messages from when that
> > >>>> policy module was installed, and unsurprisingly it cannot map those
> > >>>> contexts since you removed the module.  That would be a bug in
> > >>>> audit2allow/sepolgen.
> > >>>>
> > >>>> Workaround would be to use ausearch to select the desired range of
> > >>>> messsages specifically, e.g.
> > >>>> /sbin/ausearch -m AVC -ts today | audit2allow
> > >>>
> > >>
> > >> I did a reload today at 08:36:00 a.m. (semodule -R). Round about two and half hours later I checked the auditlog:
> > >>
> > >> ausearch -m AVC --start 25.06.2010 08:36:00 --end 25.06.2010 11:00:00
> > >>
> > >> Only messages from ssh_t (success=yes). Fine. But "audit2allow -a -l" still throws error messages:
> > >>
> > >> ...
> > >> libsepol.context_from_record: type antivirus_t is not defined
> > >> libsepol.context_from_record: could not create context structure
> > >> libsepol.context_from_string: could not create context structure
> > >> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> > >> ...
> > >>
> > >>> Dan - looks like you pushed the audit2why analyze calls down into
> > >>> sepolgen while it is parsing the messages.  But this means that all
> > >>> messages will be analyzed even if the user specified -l.
> > >>>
> > >>
> > >> I will wait for Dan's answer :-).
> > >>
> > >> Problem solved. @All: Thanks for your help.
> > >>
> > >> Best regards,
> > >>
> > >> Alice
> > >>
> > >> p.s.:
> > >> I still don't know how to debug sepol-messages. Can you give me a hint?
> > > 
> > > I think it is not just with the -l option as i had similar output today
> > > by using plain ausearch -m avc -ts recent | audit2allow:
> > > 
> > > libsepol.context_from_record: invalid security context:
> > > "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
> > > libsepol.context_from_record: could not create context structure
> > > libsepol.context_from_string: could not create context structure
> > > libsepol.sepol_context_to_sid: could not convert
> > > staff_u:staff_r:mozilla_t:s0-s0:c0.c1023 to sid
> > > libsepol.context_from_record: invalid security context:
> > > "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
> > > 
> > > 
> > >>
> > >> --
> > >> This message was distributed to subscribers of the selinux mailing list.
> > >> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> > >> the words "unsubscribe selinux" without quotes as the message.
> > > 
> > > 
> > Yes I want the analysis to show up in audit2allow, If libsemanage would
> > just shut up, we really should ignore the errors.
> 
> Then use semanage_msg_set_callback(hnd, NULL, NULL);

Actually I think you want sepol_msg_set_callback() since audit2why is
directly using libsepol, right?

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Daniel J Walsh]

On 06/25/2010 04:25 PM, Stephen Smalley wrote:
> On Fri, 2010-06-25 at 16:23 -0400, Stephen Smalley wrote:
>> On Fri, 2010-06-25 at 16:18 -0400, Daniel J Walsh wrote:
>>> On 06/25/2010 06:30 AM, Dominick Grift wrote:
>>>> On 06/25/2010 12:11 PM, Alice Mynona wrote:
>>>>> Stephen Smalley schrieb am 24.06.2010 19:33 Uhr:
>>>>>> On Thu, 2010-06-24 at 13:12 -0400, Stephen Smalley wrote:
>>>>>>> On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
>>>>>>>>
>>>>>>>> ...
>>>>>>>> libsepol.context_from_record: type antivirus_t is not defined
>>>>>>>> libsepol.context_from_record: could not create context structure
>>>>>>>> libsepol.context_from_string: could not create context structure
>>>>>>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
>>>>>>>>
>>>>>>>> "antivirus_t" is a domain I have defined in my module:
>>>>>>>>
>>>>>>>> type antivirus_t;
>>>>>>>> domain_type(antivirus_t)
>>>>>>>>
>>>>>>>> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
>>>>>>>>
>>>>>>>> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
>>>>>>>>
>>>>>>>> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
>>>>>>>>
>>>>>>>> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
>>>>>>>
>>>>>>> Sounds like the -l option to audit2allow isn't working correctly, so
>>>>>>> that instead of only processing audit messages since the last policy
>>>>>>> reload, you are still processing the audit messages from when that
>>>>>>> policy module was installed, and unsurprisingly it cannot map those
>>>>>>> contexts since you removed the module.  That would be a bug in
>>>>>>> audit2allow/sepolgen.
>>>>>>>
>>>>>>> Workaround would be to use ausearch to select the desired range of
>>>>>>> messsages specifically, e.g.
>>>>>>> /sbin/ausearch -m AVC -ts today | audit2allow
>>>>>>
>>>>>
>>>>> I did a reload today at 08:36:00 a.m. (semodule -R). Round about two and half hours later I checked the auditlog:
>>>>>
>>>>> ausearch -m AVC --start 25.06.2010 08:36:00 --end 25.06.2010 11:00:00
>>>>>
>>>>> Only messages from ssh_t (success=yes). Fine. But "audit2allow -a -l" still throws error messages:
>>>>>
>>>>> ...
>>>>> libsepol.context_from_record: type antivirus_t is not defined
>>>>> libsepol.context_from_record: could not create context structure
>>>>> libsepol.context_from_string: could not create context structure
>>>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
>>>>> ...
>>>>>
>>>>>> Dan - looks like you pushed the audit2why analyze calls down into
>>>>>> sepolgen while it is parsing the messages.  But this means that all
>>>>>> messages will be analyzed even if the user specified -l.
>>>>>>
>>>>>
>>>>> I will wait for Dan's answer :-).
>>>>>
>>>>> Problem solved. @All: Thanks for your help.
>>>>>
>>>>> Best regards,
>>>>>
>>>>> Alice
>>>>>
>>>>> p.s.:
>>>>> I still don't know how to debug sepol-messages. Can you give me a hint?
>>>>
>>>> I think it is not just with the -l option as i had similar output today
>>>> by using plain ausearch -m avc -ts recent | audit2allow:
>>>>
>>>> libsepol.context_from_record: invalid security context:
>>>> "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
>>>> libsepol.context_from_record: could not create context structure
>>>> libsepol.context_from_string: could not create context structure
>>>> libsepol.sepol_context_to_sid: could not convert
>>>> staff_u:staff_r:mozilla_t:s0-s0:c0.c1023 to sid
>>>> libsepol.context_from_record: invalid security context:
>>>> "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
>>>>
>>>>
>>>>>
>>>>> --
>>>>> This message was distributed to subscribers of the selinux mailing list.
>>>>> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
>>>>> the words "unsubscribe selinux" without quotes as the message.
>>>>
>>>>
>>> Yes I want the analysis to show up in audit2allow, If libsemanage would
>>> just shut up, we really should ignore the errors.
>>
>> Then use semanage_msg_set_callback(hnd, NULL, NULL);
> 
> Actually I think you want sepol_msg_set_callback() since audit2why is
> directly using libsepol, right?
> 
Python does not have this binding...

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Developing a SELinux policy for antivirus - Activating a boolean variable when another has been actived

[Stephen Smalley]

On Fri, 2010-06-25 at 16:47 -0400, Daniel J Walsh wrote:
> On 06/25/2010 04:25 PM, Stephen Smalley wrote:
> > On Fri, 2010-06-25 at 16:23 -0400, Stephen Smalley wrote:
> >> On Fri, 2010-06-25 at 16:18 -0400, Daniel J Walsh wrote:
> >>> On 06/25/2010 06:30 AM, Dominick Grift wrote:
> >>>> On 06/25/2010 12:11 PM, Alice Mynona wrote:
> >>>>> Stephen Smalley schrieb am 24.06.2010 19:33 Uhr:
> >>>>>> On Thu, 2010-06-24 at 13:12 -0400, Stephen Smalley wrote:
> >>>>>>> On Thu, 2010-06-24 at 17:01 +0200, Alice Mynona wrote:
> >>>>>>>> Hello,
> >>>>>>>>
> >>>>>>>> during the developing of a SELinux module I got the following error messages when executing "audit2allow -a -l"
> >>>>>>>>
> >>>>>>>> ...
> >>>>>>>> libsepol.context_from_record: type antivirus_t is not defined
> >>>>>>>> libsepol.context_from_record: could not create context structure
> >>>>>>>> libsepol.context_from_string: could not create context structure
> >>>>>>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> >>>>>>>>
> >>>>>>>> "antivirus_t" is a domain I have defined in my module:
> >>>>>>>>
> >>>>>>>> type antivirus_t;
> >>>>>>>> domain_type(antivirus_t)
> >>>>>>>>
> >>>>>>>> I have already removed the module (semodule -r antivirus.pp && semodule -R) and did a file context repair afterwards (fixfiles restore). The error still exists. 
> >>>>>>>>
> >>>>>>>> I have reinstalled the policy (yum reinstall selinux-policy-*), but the problem remains. I have also taken a look at "file_contexts" (cd /etc/selinux/targeted/modules/active && grep antivirus_t file_contexts*), but there's no "antivirus_t" anymore.
> >>>>>>>>
> >>>>>>>> Can you help me to find the cause of the problem? I don't know how to debug libsepol-messages.
> >>>>>>>>
> >>>>>>>> I'm using "selinux-policy-targeted-3.6.32-118.fc12.noarch".
> >>>>>>>
> >>>>>>> Sounds like the -l option to audit2allow isn't working correctly, so
> >>>>>>> that instead of only processing audit messages since the last policy
> >>>>>>> reload, you are still processing the audit messages from when that
> >>>>>>> policy module was installed, and unsurprisingly it cannot map those
> >>>>>>> contexts since you removed the module.  That would be a bug in
> >>>>>>> audit2allow/sepolgen.
> >>>>>>>
> >>>>>>> Workaround would be to use ausearch to select the desired range of
> >>>>>>> messsages specifically, e.g.
> >>>>>>> /sbin/ausearch -m AVC -ts today | audit2allow
> >>>>>>
> >>>>>
> >>>>> I did a reload today at 08:36:00 a.m. (semodule -R). Round about two and half hours later I checked the auditlog:
> >>>>>
> >>>>> ausearch -m AVC --start 25.06.2010 08:36:00 --end 25.06.2010 11:00:00
> >>>>>
> >>>>> Only messages from ssh_t (success=yes). Fine. But "audit2allow -a -l" still throws error messages:
> >>>>>
> >>>>> ...
> >>>>> libsepol.context_from_record: type antivirus_t is not defined
> >>>>> libsepol.context_from_record: could not create context structure
> >>>>> libsepol.context_from_string: could not create context structure
> >>>>> libsepol.sepol_context_to_sid: could not convert unconfined_u:unconfined_r:antivirus_t:s0 to sid
> >>>>> ...
> >>>>>
> >>>>>> Dan - looks like you pushed the audit2why analyze calls down into
> >>>>>> sepolgen while it is parsing the messages.  But this means that all
> >>>>>> messages will be analyzed even if the user specified -l.
> >>>>>>
> >>>>>
> >>>>> I will wait for Dan's answer :-).
> >>>>>
> >>>>> Problem solved. @All: Thanks for your help.
> >>>>>
> >>>>> Best regards,
> >>>>>
> >>>>> Alice
> >>>>>
> >>>>> p.s.:
> >>>>> I still don't know how to debug sepol-messages. Can you give me a hint?
> >>>>
> >>>> I think it is not just with the -l option as i had similar output today
> >>>> by using plain ausearch -m avc -ts recent | audit2allow:
> >>>>
> >>>> libsepol.context_from_record: invalid security context:
> >>>> "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
> >>>> libsepol.context_from_record: could not create context structure
> >>>> libsepol.context_from_string: could not create context structure
> >>>> libsepol.sepol_context_to_sid: could not convert
> >>>> staff_u:staff_r:mozilla_t:s0-s0:c0.c1023 to sid
> >>>> libsepol.context_from_record: invalid security context:
> >>>> "staff_u:staff_r:mozilla_t:s0-s0:c0.c1023"
> >>>>
> >>>>
> >>>>>
> >>>>> --
> >>>>> This message was distributed to subscribers of the selinux mailing list.
> >>>>> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> >>>>> the words "unsubscribe selinux" without quotes as the message.
> >>>>
> >>>>
> >>> Yes I want the analysis to show up in audit2allow, If libsemanage would
> >>> just shut up, we really should ignore the errors.
> >>
> >> Then use semanage_msg_set_callback(hnd, NULL, NULL);
> > 
> > Actually I think you want sepol_msg_set_callback() since audit2why is
> > directly using libsepol, right?
> > 
> Python does not have this binding...

Ok, add it ;)

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.