Re: [gentoo-hardened] conversion to selinux fails

[Joshua Brindle]

It seems like your fstab is not correct, can you check that?

Joshua Brindle

Julien Mercay wrote:
> All,
>
> I converted my Gentoo X86 to selinux, using the QuickStart guide, but
> have the following problems when booting with the policies enabled. The
> init script can only mount my root filesystem, and drop my to a shell.
> Even more strange, my root fs is wrong on the mount table:
>
> # mount
> /dev/ROOT on / type xfs (rw,noatime)
> none on /selinux type selinuxfs (rw)
> none on /proc type proc (rw)
>
> But my root fs is ext3 on /dev/md0 !
>
> I can then mount the other fs manually and start a few services. Looking
> a the logs, I see a lot a access denied, but don't understand why they
> are not part of the default policies. Here are a few lines of my logs:
>
> May 13 11:20:39 fez avc:  denied  { getattr } for  pid=1 exe=/sbin/init
> name=initctl dev=09:00 ino=23257 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:file_t tclass=fifo_file
> May 13 11:21:24 fez avc:  denied  { getattr } for  pid=1 exe=/sbin/init
> name=initctl dev=09:00 ino=23257 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:file_t tclass=fifo_file
> May 13 11:21:44 fez avc:  denied  { read } for  pid=1 exe=/sbin/init
> path=/dev/initctl dev=09:00 ino=23257
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:file_t
> tclass=fifo_file
> May 13 11:21:44 fez avc:  denied  { write } for  pid=1 exe=/sbin/init
> name=log dev=09:00 ino=23258 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:unlabeled_t tclass=sock_file
> May 13 11:33:39 fez avc:  denied  { getattr } for  pid=1 exe=/sbin/init
> name=initctl dev=09:00 ino=23257 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:file_t tclass=fifo_file
> May 13 11:33:49 fez avc:  denied  { getattr } for  pid=1 exe=/sbin/init
> name=initctl dev=09:00 ino=23257 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:initctl_t tclass=fifo_file
> May 13 11:38:21 fez avc:  denied  { read } for  pid=1 exe=/sbin/init
> path=/dev/initctl dev=09:00 ino=23257
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:initctl_t
> tclass=fifo_file
> May 13 11:38:21 fez avc:  denied  { append } for  pid=1 exe=/sbin/init
> name=wtmp dev=09:03 ino=466844 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:wtmp_t tclass=file
> May 13 11:38:21 fez avc:  denied  { write } for  pid=1 exe=/sbin/init
> name=wtmp dev=09:03 ino=466844 scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:wtmp_t tclass=file
> May 13 11:38:21 fez avc:  denied  { lock } for  pid=1 exe=/sbin/init
> path=/var/log/wtmp dev=09:03 ino=466844
> scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:wtmp_t
> tclass=file
> May 13 11:31:01 fez avc:  denied  { relabelto } for  pid=2714
> exe=/usr/sbin/setfiles name=mount dev=09:03 ino=305931
> scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:mount_exec_t tclass=file
> May 13 11:31:01 fez avc:  denied  { getattr } for  pid=3966
> exe=/usr/bin/python2.3 name=mount dev=09:03 ino=305931
> scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:mount_exec_t tclass=file
> May 13 11:31:01 fez avc:  denied  { read } for  pid=3966
> exe=/usr/bin/python2.3 name=mount dev=09:03 ino=305931
> scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:mount_exec_t tclass=file
> May 13 11:31:01 fez avc:  denied  { unlink } for  pid=3966
> exe=/usr/bin/python2.3 name=mount dev=09:03 ino=305931
> scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:mount_exec_t tclass=file
> May 13 11:33:47 fez avc:  denied  { relabelto } for  pid=6300
> exe=/usr/sbin/setfiles name=mount dev=09:00 ino=20095
> scontext=system_u:system_r:kernel_t
> tcontext=system_u:object_r:mount_exec_t tclass=file
>
> And my emerge info for good measure:
>
> Portage 2.0.50-r6 (x86, gcc-3.3.2, glibc-2.3.2-r9, 2.4.25-selinux-r2)
> =================================================================
> System uname: 2.4.25-selinux-r2 i686 Intel(R) Pentium(R) 4 CPU 3.20GHz
> Gentoo Base System version 1.4.10
> Autoconf: sys-devel/autoconf-2.58-r1
> Automake: sys-devel/automake-1.8.3
> ACCEPT_KEYWORDS="x86"
> AUTOCLEAN="yes"
> CFLAGS="-O2 -march=pentium4 -pipe -fomit-frame-pointer"
> CHOST="i686-pc-linux-gnu"
> COMPILER="gcc3"
> CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3/share/config
> /usr/share/config /var/qmail/control"
> CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
> CXXFLAGS="-O2 -march=pentium4 -pipe -fomit-frame-pointer"
> DISTDIR="/usr/portage/distfiles"
> FEATURES="autoaddcvs ccache loadpolicy sandbox sfperms strict"
> GENTOO_MIRRORS="ftp://ftp.ucsb.edu/pub/mirrors/linux/gentoo/"
> MAKEOPTS="-j 3"
> PKGDIR="/usr/portage/packages"
> PORTAGE_TMPDIR="/var/tmp"
> PORTDIR="/usr/portage"
> PORTDIR_OVERLAY=""
> SYNC="rsync://rsync.gentoo.org/gentoo-portage"
> USE="apache2 berkdb crypt cups ldap ncurses pam python readline selinux
> slpi ssl tcpd x86 zlib"
>
>
>
> Thanks a lot!
> Julien
>
> --
> gentoo-hardened@g.o mailing list
>
>


--
gentoo-hardened@g.o mailing list