Re: [gentoo-hardened] selinux 2004.1

[Emre]

portage-2.0.51_pre9 is still masked, it is not stable. I ebuild merged it 
however it doesn't work, and I can't emerge anything else. Unfortunately old 
buildpkg'ed portage binary is missing too, I'm in trouble ...

----------- ( a desperate effort to remerge old portage ) :
ebuild portage-2.0.50-r6.ebuild merge
>>> Downloading
http://gentoo.oregonstate.edu/distfiles/portage-2.0.50-r6.tar.bz2
Traceback (most recent call last):
  File "/usr/sbin/ebuild", line 42, in ?
    a=portage.doebuild(pargs[0],x,getroot(),tmpsettings,debug=debug,cleanup=cleanup)
  File "/usr/lib/portage/pym/portage.py", line 2670, in doebuild
    if not fetch(fetchme, mysettings, listonly, fetchonly):
  File "/usr/lib/portage/pym/portage.py", line 2079, in fetch
    selinux.setexec(con)
  File "/local/python-selinux/selinux.prx", line 196, in selinux.setexec
OSError: setexec: Failed setting exec context.
-------------------


On Wednesday 26 May 2004 01:01 pm, Chris PeBenito wrote:
> > I have the latest portage 2.0.50-r6.
>
> Unfortunately that version has broken stacked profile support :(  It
> looks like portage-2.0.51_pre9 has been marked stable.  Merge that, and
> it should all work again.


>
> > 4. Is there a graphical tool to create custom .fc, .te? Any pointer to
> > sample policy creation? I will go ahead try to vi some, but it would be
> > nice to have one guide. Any directions to posting new custom security
> > policies, or obtaining test-versions from a pool would also help.
>
> The only graphical SELinux tools in portage are app-admin/setools, but
> the policy editor that package has (sepcut), is at it's heart, just a
> text editor.  If you're looking for policy thats not in portage, you can
> check out the NSA example policy or the Russell Coker's debian policy.
> You can submit policies for inclusion in portage, see our project page
> for details.  There really isn't any documentation on policy creation
> beyond the very dry NSA policy whitepaper.
>
> http://www.nsa.gov/selinux/code/download5.cfm
> http://www.coker.com.au/selinux/policy.tgz
>
> > 5. How much overhead labeling create on a filesystem with millions of
> > files ? If I ever want to remove those xattrs from a filesystem, how can
> > I unlabel those millions of files, if there is any way to reclaim space
> > those extended atrributes sits on?
>
> On ext[23], xattrs are stored in a block.  So each label takes a block.
> However, for space savings, the xattr blocks that have the same label
> are shared.  So if you have 1 million files with the same label, it will
> have a 1 block overhead.  Basically, there is an overhead of 1 block per
> different label, per fs.
>
> On XFS, the inode size should be increased to 512 (from 256), so that
> the label can fit in the inode.  Then there is no overhead, though
> inodes will be a little larger.  If the inode size is not increased,
> then there will be a 1 block per file overhead (i.e. huge waste) because
> the label will not fit in the inode, and a performance hit.
>
> As long as you are in a kernel with selinux enabled, you will not be
> able to unlabel a file.  It will be denied regardless of
> permissive/enforcing.  If you wanted to remove selinux, you could use
> rmfilecon (in a non-selinux kernel), which I will be adding in
> policycoreutils.  Time permitting I will put a chapter in the quickstart
> guide for removing selinux.

--
gentoo-hardened@g.o mailing list