[gentoo-hardened] conversion to selinux fails

[Julien Mercay]

All,

I converted my Gentoo X86 to selinux, using the QuickStart guide, but 
have the following problems when booting with the policies enabled. The 
init script can only mount my root filesystem, and drop my to a shell. 
Even more strange, my root fs is wrong on the mount table:

# mount
/dev/ROOT on / type xfs (rw,noatime)
none on /selinux type selinuxfs (rw)
none on /proc type proc (rw)

But my root fs is ext3 on /dev/md0 !

I can then mount the other fs manually and start a few services. Looking 
a the logs, I see a lot a access denied, but don't understand why they 
are not part of the default policies. Here are a few lines of my logs:

May 13 11:20:39 fez avc:  denied  { getattr } for  pid=1 exe=/sbin/init 
name=initctl dev=09:00 ino=23257 scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:file_t tclass=fifo_file
May 13 11:21:24 fez avc:  denied  { getattr } for  pid=1 exe=/sbin/init 
name=initctl dev=09:00 ino=23257 scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:file_t tclass=fifo_file
May 13 11:21:44 fez avc:  denied  { read } for  pid=1 exe=/sbin/init 
path=/dev/initctl dev=09:00 ino=23257 
scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t 
tclass=fifo_file
May 13 11:21:44 fez avc:  denied  { write } for  pid=1 exe=/sbin/init 
name=log dev=09:00 ino=23258 scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:unlabeled_t tclass=sock_file
May 13 11:33:39 fez avc:  denied  { getattr } for  pid=1 exe=/sbin/init 
name=initctl dev=09:00 ino=23257 scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:file_t tclass=fifo_file
May 13 11:33:49 fez avc:  denied  { getattr } for  pid=1 exe=/sbin/init 
name=initctl dev=09:00 ino=23257 scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:initctl_t tclass=fifo_file
May 13 11:38:21 fez avc:  denied  { read } for  pid=1 exe=/sbin/init 
path=/dev/initctl dev=09:00 ino=23257 
scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:initctl_t 
tclass=fifo_file
May 13 11:38:21 fez avc:  denied  { append } for  pid=1 exe=/sbin/init 
name=wtmp dev=09:03 ino=466844 scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:wtmp_t tclass=file
May 13 11:38:21 fez avc:  denied  { write } for  pid=1 exe=/sbin/init 
name=wtmp dev=09:03 ino=466844 scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:wtmp_t tclass=file
May 13 11:38:21 fez avc:  denied  { lock } for  pid=1 exe=/sbin/init 
path=/var/log/wtmp dev=09:03 ino=466844 
scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:wtmp_t 
tclass=file
May 13 11:31:01 fez avc:  denied  { relabelto } for  pid=2714 
exe=/usr/sbin/setfiles name=mount dev=09:03 ino=305931 
scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:mount_exec_t tclass=file
May 13 11:31:01 fez avc:  denied  { getattr } for  pid=3966 
exe=/usr/bin/python2.3 name=mount dev=09:03 ino=305931 
scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:mount_exec_t tclass=file
May 13 11:31:01 fez avc:  denied  { read } for  pid=3966 
exe=/usr/bin/python2.3 name=mount dev=09:03 ino=305931 
scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:mount_exec_t tclass=file
May 13 11:31:01 fez avc:  denied  { unlink } for  pid=3966 
exe=/usr/bin/python2.3 name=mount dev=09:03 ino=305931 
scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:mount_exec_t tclass=file
May 13 11:33:47 fez avc:  denied  { relabelto } for  pid=6300 
exe=/usr/sbin/setfiles name=mount dev=09:00 ino=20095 
scontext=system_u:system_r:kernel_t 
tcontext=system_u:object_r:mount_exec_t tclass=file

And my emerge info for good measure:

Portage 2.0.50-r6 (x86, gcc-3.3.2, glibc-2.3.2-r9, 2.4.25-selinux-r2)
=================================================================
System uname: 2.4.25-selinux-r2 i686 Intel(R) Pentium(R) 4 CPU 3.20GHz
Gentoo Base System version 1.4.10
Autoconf: sys-devel/autoconf-2.58-r1
Automake: sys-devel/automake-1.8.3
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CFLAGS="-O2 -march=pentium4 -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
COMPILER="gcc3"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config 
/usr/share/config /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=pentium4 -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoaddcvs ccache loadpolicy sandbox sfperms strict"
GENTOO_MIRRORS="ftp://ftp.ucsb.edu/pub/mirrors/linux/gentoo/"
MAKEOPTS="-j 3"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY=""
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="apache2 berkdb crypt cups ldap ncurses pam python readline selinux 
slpi ssl tcpd x86 zlib"



Thanks a lot!
Julien

--
gentoo-hardened@g.o mailing list