From: Steve Lawrence <slawrence@tresys.com>
To: Eric Paris <eparis@parisplace.org>
Cc: Richard Haines <richard_c_haines@btinternet.com>,
<selinux@tycho.nsa.gov>
Subject: Re: CIL/SELinux Userspace Integration
Date: Wed, 7 Dec 2011 09:04:08 -0500 [thread overview]
Message-ID: <4EDF7258.2070800@tresys.com> (raw)
In-Reply-To: <CACLa4ptqS=hBZUYDp8bjwnLZeuU8yfprDFi5_dxRRDipT3Xtkg@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2309 bytes --]
On 12/07/2011 08:54 AM, Eric Paris wrote:
> On Wed, Dec 7, 2011 at 8:32 AM, Steve Lawrence<slawrence@tresys.com> wrote:
>> On 12/03/2011 11:30 AM, Richard Haines wrote:
>
>>> 5) I could not load a new policy that had a boolean and supporting
>>> statements in it. The actual binary policy was fine (using apol), but
>>> load_policy had problems. I started with a Fedora 16 base and added
>>> the new Integration code with no problems. Is it a known problem as
>>> if not I'll check further.
>>> The errors I had when running semodule with a boolean were (Note: I
>>> had already built a new base policy (SELINUXTYPE=rch-test1) with no
>>> problems):
>>
>>
>> Hmmm, this is interesting. Both seinfo and apol are fine with my
>> CIL-generated binary, but fails to load when I add booleans. I also
>> generated a similar mdp policy.conf, ran checkpolicy, and that failed to
>> load as well. sediff also shows the two binaries to be the same.
>>
>> I'll look into this more, but because of that, I'm thinking this is a kernel
>> bug. If anyone else wants to look at it, I've attached a simple file that is
>> the standard mdp.conf with a single boolean defined, and single conditional
>> statement using that boolean. This builds a binary fine, and apol/seinfo
>> have no problem with it, but fails to load with load_policy.
>>
>>>
>>> ------ Start --------------
>>> # semodule -i base.cil ext_gateway.cil int_gateway.cil move_file.cil
>>>
>>> SELinux: Could not load policy file
>>> /etc/selinux/rch-test1/policy/policy.26: No such file or directory
>>> /sbin/load_policy: Can't load policy: No such file or directory
>>>
>>> libsemanage.semanage_reload_policy: load_policy returned error code 2. (No
>>> such file or directory).
>>> SELinux: Could not load policy file
>>> /etc/selinux/rch-test1/policy/policy.26: No such file or directory
>>> /sbin/load_policy: Can't load policy: No such file or directory
>>>
>>> libsemanage.semanage_reload_policy: load_policy returned error code 2. (No
>>> such file or directory).
>>> semodule: Failed!
>>>
>>> ----- End -----------------
>
> If you send me the policy.X in question I'll spend a couple minutes
> figuring out what the kernel is upset about...
policy.24 attached. Thanks.
[-- Attachment #2: policy.24 --]
[-- Type: application/octet-stream, Size: 17312 bytes --]
next prev parent reply other threads:[~2011-12-07 14:04 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-12-03 16:30 CIL/SELinux Userspace Integration Richard Haines
2011-12-07 13:32 ` Steve Lawrence
2011-12-07 13:54 ` Eric Paris
2011-12-07 14:04 ` Steve Lawrence [this message]
2011-12-07 18:45 ` Eric Paris
2011-12-07 20:15 ` Eric Paris
2011-12-08 12:25 ` Richard Haines
2011-12-08 13:28 ` Stephen Smalley
-- strict thread matches above, loose matches on Subject: below --
2011-12-07 17:01 Richard Haines
2011-12-07 18:02 ` Steve Lawrence
2011-11-22 22:00 Steve Lawrence
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4EDF7258.2070800@tresys.com \
--to=slawrence@tresys.com \
--cc=eparis@parisplace.org \
--cc=richard_c_haines@btinternet.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.