Turn off "dontaudit" rules in monolithic policy

Turn off "dontaudit" rules in monolithic policy

[Hung Truong]

[-- Attachment #1: Type: text/plain, Size: 373 bytes --]

I have a custom monolithic build based on RHEL6 policy.
I get this error when try to turn off dontaudit rules:

$ semodule -DB


libsemanage.semanage_link_sandbox: Could not access sandbox base file
/etc/selinux/targeted/modules/bmp/base.pp. (No such file or directory)

Is there other way to turn off dontaudit rules in a monilithic policy?



Many thanks,

--Hung Truong

[-- Attachment #2: Type: text/html, Size: 2096 bytes --]

RE: Turn off "dontaudit" rules in monolithic policy

[Vu, Joseph]

[-- Attachment #1: Type: text/plain, Size: 763 bytes --]

Hung,

I have been trying to rebuild monolithic policy and was not able to.
What version of SELinux Policy and RHT are you using?

________________________________
From: owner-selinux@tycho.nsa.gov [mailto:owner-selinux@tycho.nsa.gov] On Behalf Of Hung Truong
Sent: Monday, January 21, 2013 11:25 AM
To: SELinux
Subject: Turn off "dontaudit" rules in monolithic policy


I have a custom monolithic build based on RHEL6 policy.
I get this error when try to turn off dontaudit rules:

$ semodule -DB

libsemanage.semanage_link_sandbox: Could not access sandbox base file /etc/selinux/targeted/modules/bmp/base.pp. (No such file or directory)

Is there other way to turn off dontaudit rules in a monilithic policy?

Many thanks,
--Hung Truong

[-- Attachment #2: Type: text/html, Size: 3683 bytes --]

RE: Turn off "dontaudit" rules in monolithic policy

[Hung Truong]

[-- Attachment #1: Type: text/plain, Size: 1010 bytes --]

I am using version 3.7.19-155el6.6.



*From:* Vu, Joseph [mailto:joseph.vu@boeing.com]
*Sent:* Tuesday, January 22, 2013 9:19 AM
*To:* Hung Truong; SELinux
*Subject:* RE: Turn off "dontaudit" rules in monolithic policy



Hung,



I have been trying to rebuild monolithic policy and was not able to.

What version of SELinux Policy and RHT are you using?


------------------------------

*From:* owner-selinux@tycho.nsa.gov
[mailto:owner-selinux@tycho.nsa.gov<owner-selinux@tycho.nsa.gov>]
*On Behalf Of *Hung Truong
*Sent:* Monday, January 21, 2013 11:25 AM
*To:* SELinux
*Subject:* Turn off "dontaudit" rules in monolithic policy



I have a custom monolithic build based on RHEL6 policy.
I get this error when try to turn off dontaudit rules:

$ semodule -DB


libsemanage.semanage_link_sandbox: Could not access sandbox base file
/etc/selinux/targeted/modules/bmp/base.pp. (No such file or directory)

Is there other way to turn off dontaudit rules in a monilithic policy?



Many thanks,

--Hung Truong

[-- Attachment #2: Type: text/html, Size: 4949 bytes --]

Re: Turn off "dontaudit" rules in monolithic policy

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On 01/22/2013 09:31 AM, Hung Truong wrote:
> I am using version 3.7.19-155el6.6.
> 
> 
> 
> *From:*Vu, Joseph [mailto:joseph.vu@boeing.com
> <mailto:joseph.vu@boeing.com>] *Sent:* Tuesday, January 22, 2013 9:19 AM 
> *To:* Hung Truong; SELinux *Subject:* RE: Turn off "dontaudit" rules in
> monolithic policy
> 
> 
> 
> Hung,
> 
> 
> 
> I have been trying to rebuild monolithic policy and was not able to.
> 
> What version of SELinux Policy and RHT are you using?
> 
> 
> 
> --------------------------------------------------------------------------------
>
>  *From:*owner-selinux@tycho.nsa.gov <mailto:owner-selinux@tycho.nsa.gov> 
> [mailto:owner-selinux@tycho.nsa.gov] *On Behalf Of *Hung Truong *Sent:*
> Monday, January 21, 2013 11:25 AM *To:* SELinux *Subject:* Turn off
> "dontaudit" rules in monolithic policy
> 
> 
> 
> I have a custom monolithic build based on RHEL6 policy. I get this error
> when try to turn off dontaudit rules:
> 
> $ semodule -DB
> 
> 
> libsemanage.semanage_link_sandbox: Could not access sandbox base file 
> /etc/selinux/targeted/modules/bmp/base.pp. (No such file or directory)
> 
> Is there other way to turn off dontaudit rules in a monilithic policy?
> 
> 
> 
> Many thanks,
> 
> --Hung Truong
> 
Why not compile two policies one with and one without dontaudit rules?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlD+rAEACgkQrlYvE4MpobMNDgCfaLNiljkPI6ilm65DgUSBCHmP
W10An1cOKmfs7qCG8xEKaEwjVguLMLZU
=MkCV
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Turn off "dontaudit" rules in monolithic policy

[Hung Truong]

Could you tell me how to compile a policy without dontaudit rules?  Thanks.


Hung Truong | Trident Systems Incorporated
Sr. Embedded Engineer, Software System Engineering Group
10201 Fairfax Boulevard | Suite 300 | Fairfax, VA 22030
d: 703.267.6746 | f: 703.273.6608
e: hung.truong@tridsys.com | www.tridsys.com



Notice: The information contained in this email message is considered
confidential and proprietary to the sender and is intended solely for review
and use by the named recipient.  Any unauthorized review, use or
distribution is strictly prohibited. If you have received this message in
error, please advise the sender by reply email and delete the message.


-----Original Message-----
From: Daniel J Walsh [mailto:dwalsh@redhat.com]
Sent: Tuesday, January 22, 2013 10:11 AM
To: Hung Truong
Cc: Vu, Joseph; SELinux
Subject: Re: Turn off "dontaudit" rules in monolithic policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



On 01/22/2013 09:31 AM, Hung Truong wrote:
> I am using version 3.7.19-155el6.6.
>
>
>
> *From:*Vu, Joseph [mailto:joseph.vu@boeing.com
> <mailto:joseph.vu@boeing.com>] *Sent:* Tuesday, January 22, 2013 9:19
> AM
> *To:* Hung Truong; SELinux *Subject:* RE: Turn off "dontaudit" rules
> in monolithic policy
>
>
>
> Hung,
>
>
>
> I have been trying to rebuild monolithic policy and was not able to.
>
> What version of SELinux Policy and RHT are you using?
>
>
>
> ----------------------------------------------------------------------
> ----------
>
>  *From:*owner-selinux@tycho.nsa.gov
> <mailto:owner-selinux@tycho.nsa.gov>
> [mailto:owner-selinux@tycho.nsa.gov] *On Behalf Of *Hung Truong
> *Sent:* Monday, January 21, 2013 11:25 AM *To:* SELinux *Subject:*
> Turn off "dontaudit" rules in monolithic policy
>
>
>
> I have a custom monolithic build based on RHEL6 policy. I get this
> error when try to turn off dontaudit rules:
>
> $ semodule -DB
>
>
> libsemanage.semanage_link_sandbox: Could not access sandbox base file
> /etc/selinux/targeted/modules/bmp/base.pp. (No such file or directory)
>
> Is there other way to turn off dontaudit rules in a monilithic policy?
>
>
>
> Many thanks,
>
> --Hung Truong
>
Why not compile two policies one with and one without dontaudit rules?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlD+rAEACgkQrlYvE4MpobMNDgCfaLNiljkPI6ilm65DgUSBCHmP
W10An1cOKmfs7qCG8xEKaEwjVguLMLZU
=MkCV
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Turn off "dontaudit" rules in monolithic policy

[Hung Truong]

This works!!! BTW, there was a typo.  The command should be:

make enableaudit

I really appreciate your help.

Hung Truong | Trident Systems Incorporated
Sr. Embedded Engineer, Software System Engineering Group
10201 Fairfax Boulevard | Suite 300 | Fairfax, VA 22030
d: 703.267.6746 | f: 703.273.6608
e: hung.truong@tridsys.com | www.tridsys.com



Notice: The information contained in this email message is considered
confidential and proprietary to the sender and is intended solely for review
and use by the named recipient.  Any unauthorized review, use or
distribution is strictly prohibited. If you have received this message in
error, please advise the sender by reply email and delete the message.


-----Original Message-----
From: Daniel J Walsh [mailto:dwalsh@redhat.com]
Sent: Tuesday, January 22, 2013 10:23 AM
To: Hung Truong
Subject: Re: Turn off "dontaudit" rules in monolithic policy

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/22/2013 10:14 AM, Hung Truong wrote:
> Could you tell me how to compile a policy without dontaudit rules?
> Thanks.
>
make enabelaudit

I believe.
>
> Hung Truong | Trident Systems Incorporated Sr. Embedded Engineer,
> Software System Engineering Group 10201 Fairfax Boulevard | Suite 300
> | Fairfax, VA
> 22030 d: 703.267.6746 | f: 703.273.6608 e: hung.truong@tridsys.com |
> www.tridsys.com
>
>
>
> Notice: The information contained in this email message is considered
> confidential and proprietary to the sender and is intended solely for
> review and use by the named recipient.  Any unauthorized review, use
> or distribution is strictly prohibited. If you have received this
> message in error, please advise the sender by reply email and delete the
> message.
>
>
> -----Original Message----- From: Daniel J Walsh
> [mailto:dwalsh@redhat.com]
> Sent: Tuesday, January 22, 2013 10:11 AM To: Hung Truong Cc: Vu,
> Joseph; SELinux Subject: Re: Turn off "dontaudit" rules in monolithic
> policy
>
>
>
> On 01/22/2013 09:31 AM, Hung Truong wrote:
>> I am using version 3.7.19-155el6.6.
>
>
>
>> *From:*Vu, Joseph [mailto:joseph.vu@boeing.com
>> <mailto:joseph.vu@boeing.com>] *Sent:* Tuesday, January 22, 2013 9:19
>> AM
>> *To:* Hung Truong; SELinux *Subject:* RE: Turn off "dontaudit" rules
>> in monolithic policy
>
>
>
>> Hung,
>
>
>
>> I have been trying to rebuild monolithic policy and was not able to.
>
>> What version of SELinux Policy and RHT are you using?
>
>
>
>> ---------------------------------------------------------------------
>> -
>> ----------
>
>> *From:*owner-selinux@tycho.nsa.gov
>> <mailto:owner-selinux@tycho.nsa.gov>
>> [mailto:owner-selinux@tycho.nsa.gov] *On Behalf Of *Hung Truong
>> *Sent:* Monday, January 21, 2013 11:25 AM *To:* SELinux *Subject:*
>> Turn off "dontaudit" rules in monolithic policy
>
>
>
>> I have a custom monolithic build based on RHEL6 policy. I get this
>> error when try to turn off dontaudit rules:
>
>> $ semodule -DB
>
>
>> libsemanage.semanage_link_sandbox: Could not access sandbox base file
>> /etc/selinux/targeted/modules/bmp/base.pp. (No such file or
>> directory)
>
>> Is there other way to turn off dontaudit rules in a monilithic policy?
>
>
>
>> Many thanks,
>
>> --Hung Truong
>
> Why not compile two policies one with and one without dontaudit rules?
>
> -- This message was distributed to subscribers of the selinux mailing
> list. If you no longer wish to subscribe, send mail to
> majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without
> quotes as the message.
>
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlD+ruEACgkQrlYvE4MpobPNkACggndNE6JYVYFJIWRJ4UAjHEIw
WnQAn1iAHwPv3UtoiTt3MOSYOgnLtGOv
=/+7i
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Turn off "dontaudit" rules in monolithic policy

[Christopher J. PeBenito]

To clarify terminology, if you're using semodule, you're using a modular policy, not a monolithic policy.  A monolithic policy would be fully compiled on the development machine, and the policy.27 would be deployed to the running machine.  A modular policy deploys the *.pp files to the running machine and links them together to make a policy.27.

On 01/21/13 12:25, Hung Truong wrote:
> I have a custom monolithic build based on RHEL6 policy.
> I get this error when try to turn off dontaudit rules:
> 
> $ semodule -DB
> 
> 
> libsemanage.semanage_link_sandbox: Could not access sandbox base file /etc/selinux/targeted/modules/bmp/base.pp. (No such file or directory)
> 
> Is there other way to turn off dontaudit rules in a monilithic policy?
> 
>  
> 
> Many thanks,
> 
> --Hung Truong
> 


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

RE: Turn off "dontaudit" rules in monolithic policy

[Hung Truong]

Thanks for the clarification.  I thought the "semodule -DB" could be used
for monolithic policy as well.

Daniel Walsh gave a solution by compiling a policy without dontaudit rules
and that worked perfectly fine for me.  But, just curious if there is an
equivalent command to turn off dontaudit for monolithic policy at runtime?


--Hung Truong


-----Original Message-----
From: Christopher J. PeBenito [mailto:cpebenito@tresys.com]
Sent: Tuesday, January 22, 2013 1:03 PM
To: Hung Truong
Cc: SELinux
Subject: Re: Turn off "dontaudit" rules in monolithic policy

To clarify terminology, if you're using semodule, you're using a modular
policy, not a monolithic policy.  A monolithic policy would be fully
compiled on the development machine, and the policy.27 would be deployed
to the running machine.  A modular policy deploys the *.pp files to the
running machine and links them together to make a policy.27.

On 01/21/13 12:25, Hung Truong wrote:
> I have a custom monolithic build based on RHEL6 policy.
> I get this error when try to turn off dontaudit rules:
>
> $ semodule -DB
>
>
> libsemanage.semanage_link_sandbox: Could not access sandbox base file
/etc/selinux/targeted/modules/bmp/base.pp. (No such file or directory)
>
> Is there other way to turn off dontaudit rules in a monilithic policy?
>
>
>
> Many thanks,
>
> --Hung Truong
>


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Turn off "dontaudit" rules in monolithic policy

[Christopher J. PeBenito]

No, a monolithic policy can't be managed like that at run time.  The policy is supposed to be static.  You'd have to use make enableaudit when you build it, as Dan previously mentioned, and redeploy the policy.

On 01/22/13 13:12, Hung Truong wrote:
> Thanks for the clarification.  I thought the "semodule -DB" could be used
> for monolithic policy as well.
> 
> Daniel Walsh gave a solution by compiling a policy without dontaudit rules
> and that worked perfectly fine for me.  But, just curious if there is an
> equivalent command to turn off dontaudit for monolithic policy at runtime?
> 
> 
> --Hung Truong
> 
> 
> -----Original Message-----
> From: Christopher J. PeBenito [mailto:cpebenito@tresys.com]
> Sent: Tuesday, January 22, 2013 1:03 PM
> To: Hung Truong
> Cc: SELinux
> Subject: Re: Turn off "dontaudit" rules in monolithic policy
> 
> To clarify terminology, if you're using semodule, you're using a modular
> policy, not a monolithic policy.  A monolithic policy would be fully
> compiled on the development machine, and the policy.27 would be deployed
> to the running machine.  A modular policy deploys the *.pp files to the
> running machine and links them together to make a policy.27.
> 
> On 01/21/13 12:25, Hung Truong wrote:
>> I have a custom monolithic build based on RHEL6 policy.
>> I get this error when try to turn off dontaudit rules:
>>
>> $ semodule -DB
>>
>>
>> libsemanage.semanage_link_sandbox: Could not access sandbox base file
> /etc/selinux/targeted/modules/bmp/base.pp. (No such file or directory)
>>
>> Is there other way to turn off dontaudit rules in a monilithic policy?
>>
>>
>>
>> Many thanks,
>>
>> --Hung Truong
>>
> 
> 


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.