| 1 |
this: |
| 2 |
grep -v devfsd policy.15 >newpolicy |
| 3 |
worked for me ;) |
| 4 |
The hardened profile uses static dev files. |
| 5 |
|
| 6 |
There is might (likely) be a better solution. |
| 7 |
|
| 8 |
mulc |
| 9 |
|
| 10 |
Michael Velten writes: |
| 11 |
|
| 12 |
> Hi, |
| 13 |
> |
| 14 |
> I made an update as well and had the same problem. Because I did not do many |
| 15 |
> changes to the default policy I solved it as followed: |
| 16 |
> |
| 17 |
> delete old policy: |
| 18 |
> rm /etc/security/selinux/policy.15 |
| 19 |
> rm -rf /etc/security/selinux/src/ |
| 20 |
> |
| 21 |
> remerge base policy: |
| 22 |
> emerge selinux-base-policy |
| 23 |
> |
| 24 |
> Reload policy and it works. Hope it will help you.. |
| 25 |
> |
| 26 |
> On Wednesday 07 January 2004 21:18, gOA-pSY wrote: |
| 27 |
>> Hi Chris, |
| 28 |
>> |
| 29 |
>> # pwd |
| 30 |
>> /etc/security/selinux/src/policy |
| 31 |
>> |
| 32 |
>> # ls -sail types/ |
| 33 |
>> total 80 |
| 34 |
>> 2179429 8 drwxr-xr-x 2 root root 4096 Jan 3 21:46 . |
| 35 |
>> 2179427 8 drwxr-xr-x 8 root root 4096 Jan 3 21:46 .. |
| 36 |
>> 574179 8 -rw-r--r-- 1 root root 2819 Jan 5 12:21 |
| 37 |
>> device.te 574184 8 -rw-r--r-- 1 root root 382 Jan 5 |
| 38 |
>> 12:21 devpts.te 574185 12 -rw-r--r-- 1 root root 6869 Jan |
| 39 |
>> 5 12:21 file.te 574186 12 -rw-r--r-- 1 root root 6098 Jan |
| 40 |
>> 5 12:21 network.te 2179421 8 -rw-r--r-- 1 root root 447 |
| 41 |
>> Jan 5 12:21 nfs.te 574188 8 -rw-r--r-- 1 root root 1235 |
| 42 |
>> Jan 5 12:21 procfs.te 574189 8 -rw-r--r-- 1 root root |
| 43 |
>> 814 Jan 5 12:21 security.te |
| 44 |
>> |
| 45 |
>> # make load |
| 46 |
>> mkdir -p /etc/security/selinux |
| 47 |
>> /usr/bin/checkpolicy -o /etc/security/selinux/policy.15 |
| 48 |
>> /etc/security/selinux/src/policy.conf /usr/bin/checkpolicy: loading policy |
| 49 |
>> configuration from /etc/security/selinux/src/policy.conf security: 3 |
| 50 |
>> users, 6 roles, 364 types |
| 51 |
>> security: 30 classes, 22938 rules |
| 52 |
>> assertion on line 37286 violated by allow devfsd_t etc_t:lnk_file { setattr |
| 53 |
>> relabelto }; assertion on line 37285 violated by allow devfsd_t etc_t:dir { |
| 54 |
>> setattr }; make: *** [/etc/security/selinux/policy.15] Error 1 |
| 55 |
>> |
| 56 |
>> # make reload |
| 57 |
>> mkdir -p /etc/security/selinux |
| 58 |
>> /usr/bin/checkpolicy -o /etc/security/selinux/policy.15 |
| 59 |
>> /etc/security/selinux/src/policy.conf /usr/bin/checkpolicy: loading policy |
| 60 |
>> configuration from /etc/security/selinux/src/policy.conf security: 3 |
| 61 |
>> users, 6 roles, 364 types |
| 62 |
>> security: 30 classes, 22938 rules |
| 63 |
>> assertion on line 37286 violated by allow devfsd_t etc_t:lnk_file { setattr |
| 64 |
>> relabelto }; assertion on line 37285 violated by allow devfsd_t etc_t:dir { |
| 65 |
>> setattr }; make: *** [/etc/security/selinux/policy.15] Error 1 |
| 66 |
>> |
| 67 |
>> i remerged selinux-base-policy-20031225 and portage reports no files |
| 68 |
>> to be updated with etc-update, so all files should be up2date... :-( |
| 69 |
>> |
| 70 |
>> CP> It looks like you either didn't merge the changes in the types |
| 71 |
>> directory CP> of your policy (file.te and device.te), or you didn't load |
| 72 |
>> the policy CP> after merging the changes. These contexts are new in the |
| 73 |
>> 20031225 CP> policy. |
| 74 |
> |
| 75 |
> |
| 76 |
> -- |
| 77 |
> gentoo-hardened@g.o mailing list |
| 78 |
> |
| 79 |
|
| 80 |
|
| 81 |
-- |
| 82 |
gentoo-hardened@g.o mailing list |
Archives