Re: [gentoo-hardened] final polish

[Petre Rodan]

On Fri, Aug 29, 2003 at 08:41:52PM +0200, Christian Sch?fer wrote:
> hi,
>
> this morning my little box turn fully grown. ;-)
> I did make relabel and now I'm through with the installation-guide.
> btw: I would appreciate some sort of advices at the beginning of this
> guide. like 'don't use reiserfs, since it is not fully stable with
> selinux'..
>
> anyway, I do use reiserfs.
> at the end of this mail you'll find my current dmesg output.
> no errors really but a few lines that i don't like, but don't know how
> to handle either.. may there be help. :D
> '### ' mark the lines of wuestion.
> I either don't know what they mean and/or what to do to avoid them.
>
> the last lines with these avc: denied... thingies are uncorrect
> labeled files right? a relabel does not help, what shall I do?
>
> anyway, what is a good procedure to carry on? do i have to label any
> emerge now?
> maybe someone of you knows a good basic read, from a users view.
> I already read a lot about policies and such. but nithing gave me a
> clue on how to administrate things.
>
> thanks a lot!
>
> regards
> /christian

here are a few pointers:

http://www.nsa.gov/selinux/faq.html
http://www.nsa.gov/selinux/policy2-abs.html
http://sourceforge.net/docman/display_doc.php?docid=14882&group_id=21266
http://www.samag.com/documents/s=7835/sam0303a/0303a.htm

in order to understand those "avc:  denied" lines you should read and understand the selinux docs.
a good helper is the newrules.pl script, but sometimes is generates much to permissive rules.

you can get it from here:

cvs -d:pserver:anonymous@×××××××××××××××××××××××.net:/cvsroot/selinux login
cvs -z3 -d:pserver:anonymous@×××××××××××××××××××××××.net:/cvsroot/selinux co nsa/selinux/scripts

cvs pass is empty.

have fun,
peter


--
gentoo-hardened@g.o mailing list