Re: [gentoo-hardened] SELinux + vixie-cron

[Stefan SF]

> We need more info.  The last part of the merge doesn't tell us
> anything.  A log of the entire merge would be best.

OK, so here es the full emerge log:

>>> Unpacking source...
>>> Unpacking vixie-cron-3.0.1.tar.bz2 to /var/tmp/portage/vixie-cron-3.0.1-r4/work
Applying vixie-cron-3.0.1-gentoo.patch...
Applying vixie-cron-3.0.1-close_stdin.diff...
Applying crontab.5.diff...
selinux
Applying vixie-cron-3.0.1-selinux.diff.bz2...
>>> Source unpacked.
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o cron.o cron.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o database.o database.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o user.o user.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o entry.o entry.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o job.o job.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o do_command.o do_command.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o misc.o misc.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o env.o env.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o popen.o popen.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o compat.o compat.c
gcc -O2 -march=i686 -fomit-frame-pointer -I. -DPOSIX -s -DWITH_SELINUX   -c -o crontab.o crontab.c
gcc -s -o cron cron.o database.o user.o entry.o job.o do_command.o misc.o env.o popen.o compat.o -lselinux
gcc -s -o crontab crontab.o misc.o entry.o env.o compat.o -lselinux

>>> Install vixie-cron-3.0.1-r4 into /var/tmp/portage/vixie-cron-3.0.1-r4/image/ category sys-apps
install: invalid group `root'
install: invalid group `root'
man:
prepallstrip:
strip:
strip:
usr/bin/crontab
>>> Completed installing into /var/tmp/portage/vixie-cron-3.0.1-r4/image/

>>> Merging sys-apps/vixie-cron-3.0.1-r4 to /
sfperms
>>> SetUID: [chmod go-r] /var/tmp/portage/vixie-cron-3.0.1-r4/image//usr/bin/crontab ...
selinux
>>> Setting SELinux security labels
/usr/sbin/setfiles:  read 671 specifications
/usr/sbin/setfiles:  labeling files, pretending /var/tmp/portage/vixie-cron-3.0.1-r4/image is /
/usr/sbin/setfiles:  labeling files under /var/tmp/portage/vixie-cron-3.0.1-r4/image/
/usr/sbin/setfiles:  hash table stats: 32 elements, 32/65536 buckets used, longest chain length 1
/usr/sbin/setfiles:  Done.
--- /var/
--- /var/spool/
--- /var/spool/cron/
--- /var/spool/cron/crontabs/
>>> /var/spool/cron/crontabs/.keep
--- /usr/
--- /usr/share/
--- /usr/share/man/
--- /usr/share/man/man1/
>>> /usr/share/man/man1/crontab.1.gz
--- /usr/share/man/man5/
>>> /usr/share/man/man5/crontab.5.gz
--- /usr/share/man/man8/
>>> /usr/share/man/man8/cron.8.gz
--- /usr/share/doc/
--- /usr/share/doc/vixie-cron-3.0.1-r4/
>>> /usr/share/doc/vixie-cron-3.0.1-r4/CHANGES.gz
>>> /usr/share/doc/vixie-cron-3.0.1-r4/FEATURES.gz
>>> /usr/share/doc/vixie-cron-3.0.1-r4/CONVERSION.gz
>>> /usr/share/doc/vixie-cron-3.0.1-r4/MAIL.gz
>>> /usr/share/doc/vixie-cron-3.0.1-r4/MANIFEST.gz
>>> /usr/share/doc/vixie-cron-3.0.1-r4/README.gz
>>> /usr/share/doc/vixie-cron-3.0.1-r4/THANKS.gz
>>> /usr/share/doc/vixie-cron-3.0.1-r4/crontab.gz
--- /usr/sbin/
--- /usr/bin/
>>> /usr/bin/crontab
--- /etc/
--- /etc/cron.d/
>>> /etc/cron.d/.keep
--- /etc/init.d/
>>> /etc/init.d/vixie-cron
>>> Safely unmerging already-installed instance...
--- !mtime obj /var/spool/cron/crontabs/.keep
--- !mtime obj /usr/share/man/man8/cron.8.gz
--- !mtime obj /usr/share/man/man5/crontab.5.gz
--- !mtime obj /usr/share/man/man1/crontab.1.gz
--- !mtime obj /usr/share/doc/vixie-cron-3.0.1-r4/crontab.gz
--- !mtime obj /usr/share/doc/vixie-cron-3.0.1-r4/THANKS.gz
--- !mtime obj /usr/share/doc/vixie-cron-3.0.1-r4/README.gz
--- !mtime obj /usr/share/doc/vixie-cron-3.0.1-r4/MANIFEST.gz
--- !mtime obj /usr/share/doc/vixie-cron-3.0.1-r4/MAIL.gz
--- !mtime obj /usr/share/doc/vixie-cron-3.0.1-r4/FEATURES.gz
--- !mtime obj /usr/share/doc/vixie-cron-3.0.1-r4/CONVERSION.gz
--- !mtime obj /usr/share/doc/vixie-cron-3.0.1-r4/CHANGES.gz
--- !mtime obj /usr/bin/crontab
--- cfgpro obj /etc/init.d/vixie-cron
--- cfgpro dir /etc/init.d
--- cfgpro obj /etc/cron.d/.keep
--- cfgpro dir /etc/cron.d
--- !empty dir /var/spool/cron/crontabs
--- !empty dir /var/spool/cron
--- !empty dir /var/spool
--- !empty dir /var
--- !empty dir /usr/share/man/man8
--- !empty dir /usr/share/man/man5
--- !empty dir /usr/share/man/man1
--- !empty dir /usr/share/man
--- !empty dir /usr/share/doc/vixie-cron-3.0.1-r4
--- !empty dir /usr/share/doc
--- !empty dir /usr/share
--- !empty dir /usr/sbin
--- !empty dir /usr/bin
--- !empty dir /usr
--- !empty dir /etc
>>> original instance of package unmerged safely.
Caching service dependencies...
>>> sys-apps/vixie-cron-3.0.1-r4 merged.
=== (1 of 1) Post-Build Cleaning (sys-apps/vixie-cron-3.0.1-r4::/usr/portage/sys-apps/vixie-cron/vixie-cron-3.0.1-r4.ebuild)
>>> AUTOCLEAN: sys-apps/vixie-cron
>>> clean: No packages selected for removal.

--- AUTOCLEAN: Nothing unmerged.
completed emerge (1 of 1) sys-apps/vixie-cron-3.0.1-r4 to /
*** Finished. Cleaning up...
>>> Auto-cleaning packages ...

>>> No outdated packages were found on your system.


*** exiting successfully. GNU info directory index is up-to-date.

*** terminating.

root #


I've merged a lot and found a (hopefull only temporarely) way: after compiling, when emerge wants to install the programm, break the merge process and go to /var/tmp/portage/vixie-cron-3.0.1-r4 and copy manually the cron-binary to /usr/sbin. I now it is very roughly, but it works for me and I can concentrade on the selinux-learning-phase ;-)

ciao, Stefan