Re: [gentoo-hardened] SELinux Issues

[gOA-pSY]

Hi Chris,

# pwd
/etc/security/selinux/src/policy

# ls -sail types/
total 80
2179429    8 drwxr-xr-x    2 root     root         4096 Jan  3 21:46 .
2179427    8 drwxr-xr-x    8 root     root         4096 Jan  3 21:46 ..
 574179    8 -rw-r--r--    1 root     root         2819 Jan  5 12:21 device.te
 574184    8 -rw-r--r--    1 root     root          382 Jan  5 12:21 devpts.te
 574185   12 -rw-r--r--    1 root     root         6869 Jan  5 12:21 file.te
 574186   12 -rw-r--r--    1 root     root         6098 Jan  5 12:21 network.te
2179421    8 -rw-r--r--    1 root     root          447 Jan  5 12:21 nfs.te
 574188    8 -rw-r--r--    1 root     root         1235 Jan  5 12:21 procfs.te
 574189    8 -rw-r--r--    1 root     root          814 Jan  5 12:21 security.te

# make load
mkdir -p /etc/security/selinux
/usr/bin/checkpolicy -o /etc/security/selinux/policy.15 /etc/security/selinux/src/policy.conf
/usr/bin/checkpolicy:  loading policy configuration from /etc/security/selinux/src/policy.conf
security:  3 users, 6 roles, 364 types
security:  30 classes, 22938 rules
assertion on line 37286 violated by allow devfsd_t etc_t:lnk_file { setattr relabelto };
assertion on line 37285 violated by allow devfsd_t etc_t:dir { setattr };
make: *** [/etc/security/selinux/policy.15] Error 1

# make reload
mkdir -p /etc/security/selinux
/usr/bin/checkpolicy -o /etc/security/selinux/policy.15 /etc/security/selinux/src/policy.conf
/usr/bin/checkpolicy:  loading policy configuration from /etc/security/selinux/src/policy.conf
security:  3 users, 6 roles, 364 types
security:  30 classes, 22938 rules
assertion on line 37286 violated by allow devfsd_t etc_t:lnk_file { setattr relabelto };
assertion on line 37285 violated by allow devfsd_t etc_t:dir { setattr };
make: *** [/etc/security/selinux/policy.15] Error 1

i remerged selinux-base-policy-20031225 and portage reports no files
to be updated with etc-update, so all files should be up2date... :-(

CP> It looks like you either didn't merge the changes in the types directory
CP> of your policy (file.te and device.te), or you didn't load the policy
CP> after merging the changes.  These contexts are new in the 20031225
CP> policy.

-- 
greetz,
 gOA-pSY                            mailto:goa-psy@×××.net


--
gentoo-hardened@g.o mailing list