From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from jazzband.ncsc.mil (jazzband.ncsc.mil [144.51.5.4]) by tycho.ncsc.mil (8.12.8/8.12.8) with ESMTP id i3AHSJRb001163 for ; Sat, 10 Apr 2004 13:28:19 -0400 (EDT) Received: from jazzband.ncsc.mil (localhost [127.0.0.1]) by jazzband.ncsc.mil with ESMTP id i3AHSImw022782 for ; Sat, 10 Apr 2004 17:28:18 GMT Received: from omta08.mta.everyone.net (sitemail2.everyone.net [216.200.145.36]) by jazzband.ncsc.mil with ESMTP id i3AHSF4w022779 for ; Sat, 10 Apr 2004 17:28:15 GMT Received: from pmta07.mta.everyone.net (bigip3-snat [216.200.145.27]) by omta08.mta.everyone.net (Postfix) with ESMTP id 0C9F13FCD4 for ; Sat, 10 Apr 2004 10:28:15 -0700 (PDT) Date: Sun, 11 Apr 2004 01:28:01 +0800 Subject: Re: booting in enforcing mode Message-ID: MIME-Version: 1.0 (Generated by Pantomime 1.1.2) From: Rogelio Serrano To: selinux@tycho.nsa.gov In-Reply-To: Content-Type: text/plain; charset="us-ascii"; format="flowed" Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov On 2004-04-10 22:53:17 +0800 Rogelio Serrano wrote: > On 2004-04-10 22:22:59 +0800 Russell Coker > wrote: > >> On Sat, 10 Apr 2004 17:10, Rogelio Serrano >> wrote: >>> I can boot in enforcing mode now but there seem to be too >>> many >>> denials in my log. Which denials can be considered harmless? >>> i >>> can see a lot of ioctl, sys_tty_config and getattr. >> >> Show us a sample of the messages. >> >> When determining whether the denials are harmless it's >> usually a matter of >> the scontext and tcontext. >> >> As for sys_tty_config, in the transition to kernel 2.6.x the >> handling of >> this changed and lots of applications need it. I've >> considered having the >> daemon_base_domain() macro allow or dontaudit it. Most >> applications that >> request it don't seem to really need it (they work fine >> without it). >> > > I see. I think i have to remove some of those that i added. > the hotplug > scripts are the noisiest. i will fix /bin/login first. its the > login fom > util-linux 2.12 and im not using PAM. i need to label the tty > properly. i can > login but not into /User/Admin. login drops me into / then i > can just "cd" > and im in sysadm_home_dir. all home directories are in /Users > and admins home > dir is /Users/Admin alongside the other users. The context for > /Users is > system_u:object_r:file_t. Is that ok? Shouldnt it be root_t? > Or should i > create a totally new type. > > > > -- > This message was distributed to subscribers of the selinux > mailing list. > If you no longer wish to subscribe, send mail to > majordomo@tycho.nsa.gov with > the words "unsubscribe selinux" without quotes as the message. > The problem was fixed by setting /Users to system_u:object_r:home_root_t. The denials are all harmless. Im rebuilding the system from scratch in enforcing mode now. This will be a good test of the policy. I rewrote mount, syslogd, and klogd to have the bare minimum priviledges. Im going to rewrite init next. im looking for a bash replacement its incredibly noisy. maybe its time to stop using boot scripts. -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.