* got some problems with the type_transition rules
@ 2015-09-07 11:22 kuangjiou
2015-09-07 16:14 ` Dominick Grift
0 siblings, 1 reply; 6+ messages in thread
From: kuangjiou @ 2015-09-07 11:22 UTC (permalink / raw)
To: 'selinux@tycho.nsa.gov'
[-- Attachment #1: Type: text/plain, Size: 1215 bytes --]
Hello,everyone!
I am trying to use the optional file name feature in type_transition rules , And I test it in my OS (with kernel 3.0.76 and selinux userspace 2.1.0 ),
1. I add the type_tansition rule in my policy like this : filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123"), It can be compiled and installed successfully
But , every files that I creat in the tpm_dentry_t dentry , I will get the stmfile_lst_t type, not just the file named 123
2. I add two type_tansition rules in my policy like this :
filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123")
filetrans_pattern(unconfined_t,tpm_dentry_t,trust_log_t,file,"456")
It can be conpiled successfully, But got some error when install
libsepol.expand_terule_helper: conflicting TE rule for (unconfined_t, tpm_dentry_t:file): old was stmfile_lst_t, new is trust_log_t
libsepol.expand_module: Error during expand
libsemanage.semanage_expand_sandbox: Expand module failed
semodule: Failed!
Can anyone help me with this problem, Thank you!
pS: I got the selinux userspace 2.1.0 from here
https://github.com/SELinuxProject/selinux/wiki/Releases
[-- Attachment #2: Type: text/html, Size: 6719 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: got some problems with the type_transition rules
2015-09-07 11:22 got some problems with the type_transition rules kuangjiou
@ 2015-09-07 16:14 ` Dominick Grift
2015-09-08 2:07 ` kuangjiou
0 siblings, 1 reply; 6+ messages in thread
From: Dominick Grift @ 2015-09-07 16:14 UTC (permalink / raw)
To: kuangjiou; +Cc: 'selinux@tycho.nsa.gov'
[-- Attachment #1: Type: text/plain, Size: 1937 bytes --]
On Mon, Sep 07, 2015 at 11:22:26AM +0000, kuangjiou wrote:
> Hello,everyone!
>
> I am trying to use the optional file name feature in type_transition rules , And I test it in my OS (with kernel 3.0.76 and selinux userspace 2.1.0 ),
>
>
> 1. I add the type_tansition rule in my policy like this : filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123"), It can be compiled and installed successfully
>
>
>
> But , every files that I creat in the tpm_dentry_t dentry , I will get the stmfile_lst_t type, not just the file named 123
>
>
>
> 2. I add two type_tansition rules in my policy like this :
> filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123")
>
> filetrans_pattern(unconfined_t,tpm_dentry_t,trust_log_t,file,"456")
>
>
>
> It can be conpiled successfully, But got some error when install
>
I would have a look at applicable type_transition rules with sesearch to
see what is there.
sesearch -ASCT -s unconfined_t | grep type_transition | grep tpm_dentry_t
>
>
>
> libsepol.expand_terule_helper: conflicting TE rule for (unconfined_t, tpm_dentry_t:file): old was stmfile_lst_t, new is trust_log_t
> libsepol.expand_module: Error during expand
> libsemanage.semanage_expand_sandbox: Expand module failed
>
> semodule: Failed!
>
>
>
>
> Can anyone help me with this problem, Thank you!
>
>
> pS: I got the selinux userspace 2.1.0 from here
>
> https://github.com/SELinuxProject/selinux/wiki/Releases
>
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
--
02DFF788
4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
[-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: got some problems with the type_transition rules
2015-09-07 16:14 ` Dominick Grift
@ 2015-09-08 2:07 ` kuangjiou
2015-09-08 7:14 ` Dominick Grift
0 siblings, 1 reply; 6+ messages in thread
From: kuangjiou @ 2015-09-08 2:07 UTC (permalink / raw)
To: Dominick Grift; +Cc: 'selinux@tycho.nsa.gov'
I got this message when I input "sesearch -ASCT -s unconfined_t | grep type_transition | grep tpm_dentry_t"
type_transition unconfined_t tpm_dentry_t : file stmfile_lst_t;
does it mean the kernel 3.0.76 don't support for optional file name in type_transition rules?
-----邮件原件-----
发件人: Dominick Grift [mailto:dac.override@gmail.com]
发送时间: 2015年9月8日 0:15
收件人: kuangjiou
抄送: 'selinux@tycho.nsa.gov'
主题: Re: got some problems with the type_transition rules
On Mon, Sep 07, 2015 at 11:22:26AM +0000, kuangjiou wrote:
> Hello,everyone!
>
> I am trying to use the optional file name feature in type_transition
> rules , And I test it in my OS (with kernel 3.0.76 and selinux
> userspace 2.1.0 ),
>
>
> 1. I add the type_tansition rule in my policy like this : filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123"), It can be compiled and installed successfully
>
>
>
> But , every files that I creat in the tpm_dentry_t dentry , I will get
> the stmfile_lst_t type, not just the file named 123
>
>
>
> 2. I add two type_tansition rules in my policy like this :
> filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123")
>
> filetrans_pattern(unconfined_t,tpm_dentry_t,trust_log_t,file,"456")
>
>
>
> It can be conpiled successfully, But got some error when install
>
I would have a look at applicable type_transition rules with sesearch to see what is there.
sesearch -ASCT -s unconfined_t | grep type_transition | grep tpm_dentry_t
>
>
>
> libsepol.expand_terule_helper: conflicting TE rule for (unconfined_t,
> tpm_dentry_t:file): old was stmfile_lst_t, new is trust_log_t
> libsepol.expand_module: Error during expand
> libsemanage.semanage_expand_sandbox: Expand module failed
>
> semodule: Failed!
>
>
>
>
> Can anyone help me with this problem, Thank you!
>
>
> pS: I got the selinux userspace 2.1.0 from here
>
> https://github.com/SELinuxProject/selinux/wiki/Releases
>
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
--
02DFF788
4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: got some problems with the type_transition rules
2015-09-08 2:07 ` kuangjiou
@ 2015-09-08 7:14 ` Dominick Grift
2015-09-08 9:06 ` 答复: " kuangjiou
0 siblings, 1 reply; 6+ messages in thread
From: Dominick Grift @ 2015-09-08 7:14 UTC (permalink / raw)
To: kuangjiou; +Cc: 'selinux@tycho.nsa.gov'
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Tue, Sep 08, 2015 at 02:07:26AM +0000, kuangjiou wrote:
> I got this message when I input "sesearch -ASCT -s unconfined_t | grep type_transition | grep tpm_dentry_t"
> type_transition unconfined_t tpm_dentry_t : file stmfile_lst_t;
>
> does it mean the kernel 3.0.76 don't support for optional file name in type_transition rules?
Not necessarely but in your case i think it does, yes.
>
> -----邮件原件-----
> 发件人: Dominick Grift [mailto:dac.override@gmail.com]
> 发送时间: 2015年9月8日 0:15
> 收件人: kuangjiou
> 抄送: 'selinux@tycho.nsa.gov'
> 主题: Re: got some problems with the type_transition rules
>
> On Mon, Sep 07, 2015 at 11:22:26AM +0000, kuangjiou wrote:
> > Hello,everyone!
> >
> > I am trying to use the optional file name feature in type_transition
> > rules , And I test it in my OS (with kernel 3.0.76 and selinux
> > userspace 2.1.0 ),
> >
> >
> > 1. I add the type_tansition rule in my policy like this : filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123"), It can be compiled and installed successfully
> >
> >
> >
> > But , every files that I creat in the tpm_dentry_t dentry , I will get
> > the stmfile_lst_t type, not just the file named 123
> >
> >
> >
> > 2. I add two type_tansition rules in my policy like this :
> > filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123")
> >
> > filetrans_pattern(unconfined_t,tpm_dentry_t,trust_log_t,file,"456")
> >
> >
> >
> > It can be conpiled successfully, But got some error when install
> >
>
> I would have a look at applicable type_transition rules with sesearch to see what is there.
>
> sesearch -ASCT -s unconfined_t | grep type_transition | grep tpm_dentry_t
>
> >
> >
> >
> > libsepol.expand_terule_helper: conflicting TE rule for (unconfined_t,
> > tpm_dentry_t:file): old was stmfile_lst_t, new is trust_log_t
> > libsepol.expand_module: Error during expand
> > libsemanage.semanage_expand_sandbox: Expand module failed
> >
> > semodule: Failed!
> >
> >
> >
> >
> > Can anyone help me with this problem, Thank you!
> >
> >
> > pS: I got the selinux userspace 2.1.0 from here
> >
> > https://github.com/SELinuxProject/selinux/wiki/Releases
> >
> >
>
> > _______________________________________________
> > Selinux mailing list
> > Selinux@tycho.nsa.gov
> > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>
>
> --
> 02DFF788
> 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
> http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
> Dominick Grift
- --
02DFF788
4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQGcBAEBCgAGBQJV7orfAAoJENAR6kfG5xmc6OMMAMGKfsN1i92ElfceThau8MUe
XzyH0tt1RDaM5Mb3US26sy8PkCqU8MWHI4ISMFtij9eMKO2oy0lsK1naqdZb6wSt
DmJkFfa9RTlP9DQaTDZs6A6qHoTbffnGqFL6/WasphfDbeoSrmNePQ6ldhyX4xB7
Pz0UkJLYWoUOaV0gip9mFPQl/Mv5WNY9aiS1jeWuD68vcEdXFjR5uCB9PbMpmneu
PCn0sT9UG6SHE36Y20iqazQfLjzwXtiJ9DqTgzOvl3zaZImRe4i2eLvJYIImzn7X
0uLNuBcoe9eb97r9eSHTEIjabq/TYn78EalVCQq6cNaGHQqYy3sgpogbIlhXkUQZ
pL5CuDFiuLfOwUt1Rno6Cn3SHFeFJ5LbA4K+2ryQ7wh6hLei80UHlnkmKMZEK63T
tIiCn5/5/wB457mtifiHHZ4WaumOuRcnb6gTcTPF2JIIw22b+kd+IjBZtri7nJaX
AhAey2K9jVSTA499VKGVVQQhuhXDtUooIDRP8wZsNA==
=EvU7
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 6+ messages in thread
* 答复: got some problems with the type_transition rules
2015-09-08 7:14 ` Dominick Grift
@ 2015-09-08 9:06 ` kuangjiou
2015-09-08 14:58 ` Stephen Smalley
0 siblings, 1 reply; 6+ messages in thread
From: kuangjiou @ 2015-09-08 9:06 UTC (permalink / raw)
To: Dominick Grift; +Cc: 'selinux@tycho.nsa.gov', Stephen Smalley
According to this webpage，
http://selinuxproject.org/page/TypeRules
Policy versions 25 and above also support a 'name transition' rule
But the policy versions of my os is 26，I don't know why the type_trasition rule didn't work
-----邮件原件-----
发件人: Dominick Grift [mailto:dac.override@gmail.com]
发送时间: 2015年9月8日 15:15
收件人: kuangjiou
抄送: 'selinux@tycho.nsa.gov'
主题: Re: got some problems with the type_transition rules
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Tue, Sep 08, 2015 at 02:07:26AM +0000, kuangjiou wrote:
> I got this message when I input "sesearch -ASCT -s unconfined_t | grep type_transition | grep tpm_dentry_t"
> type_transition unconfined_t tpm_dentry_t : file stmfile_lst_t;
>
> does it mean the kernel 3.0.76 don't support for optional file name in type_transition rules?
Not necessarely but in your case i think it does, yes.
>
> -----邮件原件-----
> 发件人: Dominick Grift [mailto:dac.override@gmail.com]
> 发送时间: 2015年9月8日 0:15
> 收件人: kuangjiou
> 抄送: 'selinux@tycho.nsa.gov'
> 主题: Re: got some problems with the type_transition rules
>
> On Mon, Sep 07, 2015 at 11:22:26AM +0000, kuangjiou wrote:
> > Hello,everyone!
> >
> > I am trying to use the optional file name feature in type_transition
> > rules , And I test it in my OS (with kernel 3.0.76 and selinux
> > userspace 2.1.0 ),
> >
> >
> > 1. I add the type_tansition rule in my policy like this : filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123"), It can be compiled and installed successfully
> >
> >
> >
> > But , every files that I creat in the tpm_dentry_t dentry , I will
> > get the stmfile_lst_t type, not just the file named 123
> >
> >
> >
> > 2. I add two type_tansition rules in my policy like this :
> > filetrans_pattern(unconfined_t,tpm_dentry_t,stmfile_lst_t,file,"123"
> > )
> >
> > filetrans_pattern(unconfined_t,tpm_dentry_t,trust_log_t,file,"456")
> >
> >
> >
> > It can be conpiled successfully, But got some error when install
> >
>
> I would have a look at applicable type_transition rules with sesearch to see what is there.
>
> sesearch -ASCT -s unconfined_t | grep type_transition | grep
> tpm_dentry_t
>
> >
> >
> >
> > libsepol.expand_terule_helper: conflicting TE rule for
> > (unconfined_t,
> > tpm_dentry_t:file): old was stmfile_lst_t, new is trust_log_t
> > libsepol.expand_module: Error during expand
> > libsemanage.semanage_expand_sandbox: Expand module failed
> >
> > semodule: Failed!
> >
> >
> >
> >
> > Can anyone help me with this problem, Thank you!
> >
> >
> > pS: I got the selinux userspace 2.1.0 from here
> >
> > https://github.com/SELinuxProject/selinux/wiki/Releases
> >
> >
>
> > _______________________________________________
> > Selinux mailing list
> > Selinux@tycho.nsa.gov
> > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>
>
> --
> 02DFF788
> 4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
> http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
> Dominick Grift
- --
02DFF788
4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQGcBAEBCgAGBQJV7orfAAoJENAR6kfG5xmc6OMMAMGKfsN1i92ElfceThau8MUe
XzyH0tt1RDaM5Mb3US26sy8PkCqU8MWHI4ISMFtij9eMKO2oy0lsK1naqdZb6wSt
DmJkFfa9RTlP9DQaTDZs6A6qHoTbffnGqFL6/WasphfDbeoSrmNePQ6ldhyX4xB7
Pz0UkJLYWoUOaV0gip9mFPQl/Mv5WNY9aiS1jeWuD68vcEdXFjR5uCB9PbMpmneu
PCn0sT9UG6SHE36Y20iqazQfLjzwXtiJ9DqTgzOvl3zaZImRe4i2eLvJYIImzn7X
0uLNuBcoe9eb97r9eSHTEIjabq/TYn78EalVCQq6cNaGHQqYy3sgpogbIlhXkUQZ
pL5CuDFiuLfOwUt1Rno6Cn3SHFeFJ5LbA4K+2ryQ7wh6hLei80UHlnkmKMZEK63T
tIiCn5/5/wB457mtifiHHZ4WaumOuRcnb6gTcTPF2JIIw22b+kd+IjBZtri7nJaX
AhAey2K9jVSTA499VKGVVQQhuhXDtUooIDRP8wZsNA==
=EvU7
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: 答复: got some problems with the type_transition rules
2015-09-08 9:06 ` 答复: " kuangjiou
@ 2015-09-08 14:58 ` Stephen Smalley
0 siblings, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2015-09-08 14:58 UTC (permalink / raw)
To: kuangjiou, Dominick Grift; +Cc: 'selinux@tycho.nsa.gov'
On 09/08/2015 05:06 AM, kuangjiou wrote:
> According to this webpage，
> http://selinuxproject.org/page/TypeRules
>
> Policy versions 25 and above also support a 'name transition' rule
>
> But the policy versions of my os is 26，I don't know why the type_trasition rule didn't work
To see what version is supported by your kernel:
cat /selinux/policyvers or
cat /sys/fs/selinux/policyvers
(depending on where you have selinuxfs mounted)
Make sure you don't have CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX
set in your kernel .config. That was a legacy option for backward
compatibility with Fedora 3 and 4, and forces the kernel to an old
policy version. You don't want it.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-09-08 14:58 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-09-07 11:22 got some problems with the type_transition rules kuangjiou
2015-09-07 16:14 ` Dominick Grift
2015-09-08 2:07 ` kuangjiou
2015-09-08 7:14 ` Dominick Grift
2015-09-08 9:06 ` 答复: " kuangjiou
2015-09-08 14:58 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.