Re: [gentoo-hardened] selinux.20 on x86 - problems

[Christophe Choumert]

On Sunday 11 December 2005 13:06, Chris PeBenito wrote:
> Did you use the portage ebuilds to get these versions of SELinux utils,
> or did you install them by hand?  There is evidence below which seems to
> point to you installing it by hand, in which case you should use the
> ebuilds, as I can't reproduce your problems.

I had all the packages emerged. 

> > 1) When trying to "make load" :
> >
> >  * Compiling and installing policy.20
> > /usr/bin/checkpolicy:  loading policy configuration
> > from /etc/security/selinux/src/policy.conf
> > domains/staff.te:4:ERROR 'unknown type xdm_t' at token ';' on line
> > 29328:
> > allow staff_mount_t xdm_t:fd use;
> > #line 4
> > /usr/bin/checkpolicy:  error(s) encountered while parsing configuration
> >
> > So I pulled the two relevant lines around macros/user_macros.te:231
> > inside the "ifdef('xdm.te'" that followed and the error disappeared.
> > (there a 2 pairs of 2 lines there that look really similar ?).
> > There is no xdm_t with gentoo's policy : doesn't there exists one ? or
> > is it not mature enough ?
>
> There is an XDM policy, but not supported by Gentoo.  We are not
> supporting desktops with the strict policy.  Support for desktops is on
> the horizon, with the targeted policy.  Since the rules you removed was
> in an ifdef(`xdm.te', this leads me to believe you have an xdm.te file,
> which means you had to have added it.

It was gentoo's package, so no xdm.te. I probably wasn't clear enough the 
first time.
This problem is still there; the relevant lines in macros/user_macros are 
(starting at l.219) :
:::
ifdef(`user_can_mount', `
<snip>
allow $1_mount_t xdm_t:fd use;
allow $1_mount_t xdm_t:fifo_file write;
ifdef(`xdm.te', `
allow $1_mount_t xdm_t:fd use;
allow $1_mount_t xdm_t:fifo_file { read write };
<snip>
:::
So the problem only appears when the corresponding tunable "user_can_mount" is 
set to true. I believe this is a bug ? The first two xdm_t lines should still 
be enclosed in a "ifdef('xdm.te',...".

> > 2) When I try again to "make load", it errors out with
> >
> >  * Building file_contexts
> > Usage: /usr/sbin/genhomedircon.old [ -d selinuxdir ] [-n | --nopasswd]
> > [-t selinuxtype ]
> > make: *** [file_contexts/file_contexts] Erreur 1
>
> Can't reproduce this.

Strange... I reemerged all the libraries, the policycoreutils and the 
base-policy and now it's gone ?? So I can't reproduce it either :(

> > Executing it a second time :
<snip>
>
> When labeling, the bind mounts are ignored.  Only the "real" files are
> labeled.  So your real /root is in /home, so its labeled as it
> was /home/root.  Since your home dir is most likely set for /root, the
> directory gets mislabeled.  You should either set root's home dir
> to /home/root, or don't use a bind mount.

That explains it, thanks.

> > Also, /dev is shown as device_t, not tmpfs_t in
> > http://www.gentoo.org/proj/en/hardened/selinux/selinux-x86-handbook.xml?p
> >art=4&chap=1 . I have of course tried to "make relabel" but it stays the
> > same.
>
> This is wrong, try remerging init and udev to make sure /dev is set up
> right on boot.  Make relabel won't do anything to /dev since its
> filesystem isn't persistent (ext[23], etc).  Use 'restorecon /dev'.

Now, after a restorecon, dev is correctly labeled.

> > 3) Moreover,
> > - the processes I start myself as krys are "system_u:system_r:sysadm_t"
> > - amavisd has "system_u:system_r:crond_t"
> > - the processes launched by kdm and other kde applications are
> > "system_u:system_r:init_t"
>
> Again, desktops not currently supported.  Your X server isn't
> transitioning into a reasonable domain, so once that happens everything
> else that you run from X won't transition right.

Ok. Which lists should I follow to test things ? 

> > -# sestatus -v
> > SELinux status:                 enabled
> > SELinuxfs mount:                /selinux
> > Current mode:                   permissive
> > Mode from config file:          error (No such file or directory)
>
> Here is more evidence that you installed the SELinux userland stuff by
> hand, our sestatus does not have the "config file" lines.

And now my sestatus doesn't have this line ?! Well, that's for the better.

Thanks for your help,
Christophe Choumert
-- 
gentoo-hardened@g.o mailing list