Re: [gentoo-hardened] SELinux module compile error: unknown type

[Dominik J. Fischer]

Thanks Bill, that worked - at least for consoletype_t and some other
types - I am using an amd64 system and have the same problem with
symlinks (the labellers seem to have problems with them... replace /lib
with /lib(64)? in file_contexts).

Unfortunately, I am still facing some error messages in which case the
file type is correct:

vmdefault # dmesg | grep avc               

audit(1191161059.993:4): avc:  denied  { read } for  pid=16909
comm="mount" name="urandom" dev=tmpfs ino=2443
scontext=system_u:system_r:mount_t
tcontext=system_u:object_r:urandom_device_t tclass=chr_file

When trying to write a policy_module

vmdefault # files_manage_urandom_seed(mount_t)

the compile error stops me again:

Compiling strict local module
/usr/bin/checkmodule:  loading policy configuration from tmp/local.tmp
local.te:11:ERROR 'unknown type mount_t' at token ';' on line 78190:
        allow mount_t var_t:dir { getattr search };
#line 11
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [tmp/local.mod] Error 1

Also I don't manage to install the base policy from the Tresys guys (I
think they have more types compiled in??)

vmdefault # make
vmdefault # semodule -v -b policy.21

Attempting to install base module 'policy.21':
libsepol.module_package_read_offsets: wrong magic number for module
package:  expected 4185718671, got 4185718668
libsemanage.parse_base_headers: Could not parse base module data.
semodule:  Failed on policy.21!

How to change the magic number?
Do you have some input for me?

Dominik

On Fri, 2007-09-28 at 18:00 -0400, Bill Sharer wrote:
> Actually what you have there is a mislabeled file.  Here's the relevant
> poop:
>
> # cd /etc/selinux/strict/contexts/files
>
> # grep ld.so.cache file_contexts
> /etc/ld\.so\.cache      --      system_u:object_r:ld_so_cache_t
> /etc/ld\.so\.preload    --      system_u:object_r:ld_so_cache_t
>
> # ls -Z /etc/ld.so.cache
> -rw-r--r--  root root root:object_r:ld_so_cache_t      /etc/ld.so.cache
>
> See if this does the trick:
>
> # restorecon -v /etc/ld.so.cache
>
> If that doesn't change it, your system is not firing the rule properly
> or else it is missing from the file_contexts file for some reason.  I've
> had some rules fail to fire on an x86_64 box because there were issues
> matching the /lib symlink to the /lib64 target and so forth.Also, have
> you done an rlpkg to relabel your filesystem lately?
>
> Dominik J. Fischer wrote:
> > Dear list,
> >
> > I am running a freshly intalled SELinux system with
> > sec-policy/selinux-base-policy 20070329 in strict/permissive mode.
> >
> > When I try to write a TE module for my avc denials the compiler doesn't
> > resolve the necesary types. For example, considerung the following avc
> > entry for type consoletype:
> >
> > vmdefault # dmesg | grep avc
> > audit(1190988750.096:3): avc:  denied  { read } for  pid=26115
> > comm="consoletype" name="ld.so.cache" dev=sda1 ino=336323476
> > scontext=system_u:system_r:consoletype_t tcontext=root:object_r:etc_t
> > tclass=file
> > audit(1190988750.096:4): avc:  denied  { getattr } for  pid=26115
> > comm="consoletype" name="ld.so.cache" dev=sda1 ino=336323476
> > scontext=system_u:system_r:consoletype_t tcontext=root:object_r:etc_t
> > tclass=file
> >
> > My policy module looks like this:
> >
> > policy_module(local,1.0.0)
> > type local_t;
> > files_read_etc_files(consoletype_t)
> >
> > When I try to compile, the compiler gives me an unknown type error:
> >
> > vmdefault include # make -f /usr/share/selinux/strict/include/Makefile
> > Compiling strict local module
> > /usr/bin/checkmodule:  loading policy configuration from tmp/local.tmp
> > local.te:11:ERROR 'unknown type consoletype_t' at token ';' on line
> > 78133:
> >         allow consoletype_t etc_t:dir { getattr search read lock
> > ioctl };
> > #line 11
> > /usr/bin/checkmodule:  error(s) encountered while parsing configuration
> > make: *** [tmp/local.mod] Error 1
> >
> > Seems to me that the compiler does not resolve the types against the
> > base policy.
> >
> > Any ideas? Comments are highly appreciated.
> >
> > Dominik
> >
> >
>

-- 
gentoo-hardened@g.o mailing list