Re: initrc, md0, mapper
by Russell Coker
On Saturday 04 December 2004 03:34, Tom London <selinux(a)gmail.com> wrote:
> Running strict/enforcing, latest rawhide
> (selinux-policy-strict-1.19.10-1)
>
> Booting produces following avc:
It seems that you never got a reply to this one.
> Dec 3 08:23:45 fedora kernel: audit(1102090997.316:0): avc: denied
> { create } for pid=1348 exe=/sbin/nash name=md0
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:device_t tclass=blk_file Dec 3 08:23:45
> fedora kernel: device-mapper: 4.1.0-ioctl (2003-12-10) initialised:
> dm(a)uk.sistina.com
This is something that still needs a good solution. We don't want initrc_t to
be able to do such things in the strict policy, so udev seems to be the best
way of doing it. Maybe getting it added to /sbin/start_udev would be the
best solution? start_udev already creates a bunch of other device nodes that
are too inconvenient to do in other ways.
Of course due to the usual shell script issues udev_t isn't safe from
initrc_t. But it's a start at isolating it, we can improve later.
> Dec 3 08:23:45 fedora kernel: audit(1102090997.383:0): avc: denied
> { create } for pid=1354 exe=/sbin/nash name=mapper
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:device_t tclass=dir
That one should have been fixed quite some time ago, before your message was
posted. Either you hadn't updated to all the latest packages or there is a
corner case we missed. In either case let me know if it still happens with
the latest rawhide.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
19 years, 4 months
rawhide report: 20041227 changes
by Build System
Updated Packages:
firefox-0:1.0-7
---------------
* Sat Dec 25 2004 Christopher Aillon <caillon(a)redhat.com> 0:1.0-7
- Make sure we get a URL passed in to firefox (#138861)
- Mark some generated files as ghost (#136015)
nedit-5.5-1
-----------
* Mon Dec 27 2004 Jindrich Novy <jnovy(a)redhat.com> 5.5-1
- new version 5.5
rpmdb-fedora-1:4-0.20041227
---------------------------
tetex-2.0.2-27
--------------
* Wed Dec 22 2004 Jindrich Novy <jnovy(a)redhat.com> 2.0.2-27
- xmas security xpdf buffer overflow fix (CAN-2004-1125)
19 years, 4 months
rawhide report: 20041217 changes
by Build System
Updated Packages:
cups-1:1.1.22-5
---------------
* Thu Dec 16 2004 Tim Waugh <twaugh(a)redhat.com> 1.1.22-5
- Fixed STR #1023 (part of bug #143086).
- Fixed STR #1024 (rest of bug #143086).
* Thu Dec 09 2004 Tim Waugh <twaugh(a)redhat.com>
- Not all files in the doc directory are pure documentation (bug #67337).
* Thu Dec 09 2004 Tim Waugh <twaugh(a)redhat.com>
- Fixed ioctl parameter size in usb backend. Spotted by David A. Marlin.
desktop-printing-0.18-1
-----------------------
* Thu Dec 16 2004 Colin Walters <walters(a)redhat.com> 0.18-1
- New upstream version
- Drop upstreamed patch int-gsize
- Drop upstreamed patch no-help
- Drop upstreamed patch use-usb-if-null
- Drop upstreamed patch use-printer-uri
dump-0.4b37-2
-------------
* Thu Dec 09 2004 Dan Walsh <dwalsh(a)redhat.com> 0.4b37-2
- Added experimental dump patch from upstream to allow dump/restore of xattr.
exim-4.43-3
-----------
* Thu Dec 16 2004 David Woodhouse <dwmw2(a)redhat.com> 4.43-3
- Demonstrate SASL auth configuration in default config file
- Enable TLS and provide certificate if necessary
- Don't reject all GB2312 charset mail by default
firefox-0:1.0-6
---------------
* Wed Dec 15 2004 Christopher Aillon <caillon(a)redhat.com> 0:1.0-6
- Don't have downloads "disappear" when downloading to desktop (#139015)
- Add RPM version to the useragent
- BuildRequires pango-devel
inn-2.4.1-1
-----------
* Wed Dec 15 2004 Martin Stransky <stransky(a)redhat.com> 2.4.1-1
- diff patch (fix obsolete version of diff parameter) #137342
- posix/warnings patch #110825
* Mon Dec 13 2004 Martin Stransky <stransky(a)redhat.com> 2.4.1-1
- update to INN 2.4.1
- Thanks to Jochen Schmitt <Jochen(a)herr-schmitt.de>
kernel-2.6.9-1.1037_FC4
-----------------------
* Thu Dec 16 2004 Dave Jones <davej(a)redhat.com>
- Better version of the PCI Posting fixes for AGPGART.
- Add missing cache flush to the AGP code.
- Drop netdump and common crashdump code.
* Mon Dec 13 2004 Dave Jones <davej(a)redhat.com>
- Drop diskdump. Aiming for a better kexec based solution for FC4.
kudzu-1.1.103-1
---------------
* Thu Dec 16 2004 Bill Nottingham <notting(a)redhat.com> - 1.1.103-1
- tweak network device detection algorithm (#141338)
* Tue Nov 30 2004 Bill Nottingham <notting(a)redhat.com> - 1.1.101-1
- clear out driver on new usb interfaces (#141358)
* Wed Nov 24 2004 Bill Nottingham <notting(a)redhat.com> - 1.1.100-1
- clear out device on new usb interfaces (#130805)
libgsf-1.11.1-1
---------------
* Thu Dec 16 2004 Caolan McNamara <caolanm(a)redhat.com> 1.11.1-1
- upgrade to 1.11.1
libungif-4.1.3-2
----------------
* Thu Dec 16 2004 Matthias Clasen <mclasen(a)redhat.com> 4.1.3-2
- Remove Obsoletes: giflib (#140952)
libwmf-0.2.8.3-7
----------------
* Thu Dec 16 2004 Caolan McNamara <caolanm(a)redhat.com> 0.2.8.3-7
- RH#143096# No need for extra X libs to be linked against
mozilla-37:1.7.3-20
-------------------
* Wed Dec 15 2004 Christopher Aillon <caillon(a)redhat.com> 37:1.7.3-20
- Enable smooth scrolling and system colors by default.
- Add RPM version to useragent
- Some specfile cleanup
postgresql-7.4.6-3
------------------
* Thu Dec 16 2004 Tom Lane <tgl(a)redhat.com> 7.4.6-3
- Update to PyGreSQL 3.6 (to fix bug #142711)
- Adjust a few file permissions (bug #142431)
- Assign %{_libdir}/pgsql to base package instead of -server (bug #74003)
rpmdb-fedora-1:4-0.20041217
---------------------------
selinux-policy-strict-1.19.14-2
-------------------------------
* Thu Dec 16 2004 Dan Walsh <dwalsh(a)redhat.com> 1.19-14-2
- Changes to increase the number of daemons in targeted policy
* Thu Dec 16 2004 Dan Walsh <dwalsh(a)redhat.com> 1.19-14-1
- Update latest from NSA
selinux-policy-targeted-1.19.14-1
---------------------------------
* Thu Dec 16 2004 Dan Walsh <dwalsh(a)redhat.com> 1.19-14-1
- Update latest from NSA
thunderbird-0:1.0-2
-------------------
* Thu Dec 16 2004 Christopher Aillon <caillon(a)redhat.com> 1.0-2
- Add RPM version to useragent
* Thu Dec 16 2004 Christopher Blizzard <blizzard(a)redhat.com>
- Port over pango patches from firefox
udev-048-2
----------
* Thu Dec 16 2004 Harald Hoyer <harald(a)redhat.com> - 048-2
- fixed a case where reading /proc/ide/hd?/media returns EIO
(bug rh#142713)
- changed all device node permissions of group "disk" to 0640
(bug rh#110197)
- remove $udev_db with -fr in case of a directory (bug rh#142962)
xcdroast-0.98a15-8
------------------
* Thu Dec 16 2004 Harald Hoyer <harald(a)redhat.com> - 0.98a15-8
- fixed frozen progress bars with patch from Didier Heyden (bug #134334)
* Mon Sep 20 2004 Harald Hoyer <harald(a)redhat.com> - 0.98a15-7
- only add /dev/cdrom*
- enable prodvd mode for our cdrecord
19 years, 4 months
RE: Compilation errors due to spin_locks
by Srinivas G.
>
> On Fri, 2004-12-24 at 17:00 +0530, Srinivas G. wrote:
> > Dear All,
> >
> > I am new to this Fedora Linux. I worked on SuSE and Red Hat Linux.
> > Now I am using Fedora Core 3 with 2.6.9-1.667 kernel version.
> >
> > I got a problem while compiling a module, but the same module is
> > working under SuSE 9.1 with 2.6.5 and 2.6.6 kernel versions
>
> how are you compiling the module? Can you provide an URL to the source
> and makefile ?
Dear Arjan,
Please find the attached Makefile which I am using it on Fedora Core 3
with 2.6.9-1.667 kernel version. The same Makefile I used previously on
SuSE 9.1 with 2.6.6, 2.6.8 and 2.6.9 kernel versions. It works fine
under SuSE 9.1
Please correct me if any thing wrong in the Makefile.
Thanks and regards,
Srinivas G
19 years, 4 months
request for member magic in something not a structure or union
by Srinivas G.
Dear All,
I am new to this Fedora Linux. I worked on SuSE and Red Hat Linux. Now I am using Fedora Core 3 with 2.6.9-1.667 kernel version.
I got a problem while compiling a module, but the same module is
working under SuSE 9.1 with 2.6.5 and 2.6.6 kernel versions.
I understood that the error messages are related to spin_lock_irqsave and
spin_lock_init only. If I comment those two lines the compilation is OK.
Please find the attached txt file for error messages that are occurred.
Please any help greatly appreciated.
Thanks in advance.
Regards,
Srinivas G
19 years, 4 months
Compilation errors due to spin_locks
by Srinivas G.
Dear All,
I am new to this Fedora Linux. I worked on SuSE and Red Hat Linux.
Now I am using Fedora Core 3 with 2.6.9-1.667 kernel version.
I got a problem while compiling a module, but the same module is
working under SuSE 9.1 with 2.6.5 and 2.6.6 kernel versions.
I understood that the error messages are related to spin_lock_irqsave
and
spin_lock_init only. If I comment those two lines the compilation is OK.
Please find the attached txt files for error messages that are occur.
Please any help greatly appreciated.
Thanks in advance.
Regards,
Srinivas G
19 years, 4 months
CD burner that Just Works
by Florin Andrei
Well, K3B is nice and all, but it's a KDE application. While there's
nothing wrong with KDE per se, if you're using Gnome there's a
noticeable delay before starting any KDE application, while all those
components get initialized and so on. Plus, while most applications work
flawlessly in their native environment, there are all kinds of strange
bugs that get uncovered when using them in other environments (this goes
for both KDE and Gnome apps).
In fact, K3B is the only KDE application that must be used on a Gnome
desktop currently. All other basic tasks can be accomplished by native
applications (or by apps that are merely GTK-based, not full Gnome apps,
which is fine).
So... how about including Graveman in Fedora?
http://scresto.site.voila.fr/gravemanuk.html
- It Just Works.
- It has a no-nonsense interface that, to me at least, seems much better
than any other CD burner for Linux. In fact, i think this is The CD-
Burner GUI Metaphor that everyone should look at and learn from. Really.
Any "dummy user" could use it, while it does not step on advanced users'
toes.
- It's GTK-based.
Please?
--
Florin Andrei
http://florin.myip.org/
19 years, 4 months