Re: autoreconf fails in setools of revision 4290
by NZzi
J. Tang wrote:
> On Wed, 2007-04-18 at 10:06 +0800, Ken YANG wrote:
>> the build tools i use are:
>>
>> automake-1.10-5
>> autoconf-2.61-8.fc7
>> make-3.81-6.fc7
>
> Hello Ken.
>
> I was able to reproduce your issue on a Rawhide system. The reason is
> due to automake. Fedora Core 6 (which is what SETools was tested upon)
> ships with automake 1.9; Rawhide has automake 1.10. This newer version
> of automake now considers GNU make extensions to be fatal errors,
> whereas previous versions of automake ignored them.
>
> Quick Answer: From SVN checkout, do this as the first step:
>
> $ autoreconf -Wno-portability -i
>
>> as i mentioned before, the 3.1 tags in svn also failed with this error
>> but the 3.1 version of fc7 can be built without any errors:
>
> This is because the source RPM contains the distributed, post-automake
> files. That is, it has the result of a 'make dist'.
thanks very much for your guiding.
>
>> apol had "segmentation fault" errors in analyzing "all base" policy,
>> i.e. all modules in "module.conf" are changed into "base"
>
> There is a critical error in libsepol-2.0.2 that prevents SETools from
> opening source policies. Unfortunately, recompiling SETools against
> libsepol-2.0.3 is not sufficient; it also requires a fix that is only in
> the development branch of SETools.
>
>> "setools(a)tresys.com" is the mailing list of setools? if yes, i will send
>
> Yes.
if i have some setools problems(maybe bugs) in future, where can i send?
i can not find "subscribe" of setools mailing list, but i find the
"Active Tickets" in setools wiki. actually, i don't know what this mean.
i find there are bug and feature.
if the setools mailing list is private, i will send problem/bug to the
fedora-selinux mailing list in future, ok?
>
17 years
ANN: SELinux Policy IDE (SLIDE) version 1.1
by David Sugar
Version 1.1 of the SELinux Policy IDE (SLIDE) from Tresys is now
available for download from the Tresys Open Source website at
http://oss.tresys.com.
SLIDE is an Eclipse plug-in that integrates with the SELinux Reference
Policy to provide a development environment for building SELinux policy.
SLIDE features:
* A graphical user interface for policy development, including policy
syntax highlighting, context suggestions, and integrated compilation.
* Integration with SELinux Reference Policy, including quick lookup and
documentation for interfaces.
* Wizards and easy to use templates to automate common tasks from
creating a new SELinux policy to adding an interface into an existing
module.
* Integrated remote policy installation and audit log monitoring, to
facilitate policy testing.
* Seamless integration with the power of standard Eclipse.
Version 1.1 highlights:
* Disabled interfaces indicated in module editor.
* Improved documentation on the open source web site.
* Updates to SLIDERemote to work with SETools version 3.1.
* Support for new fields in build.conf editor.
* Fixed problems with the Console output.
If you would like to contribute, currently the best help would be to
test and provide feedback on the SLIDE plugin and SLIDE Remote.
17 years
rawhide update errors
by Richard Hally
from todays yum update from rawhide:
Updating : selinux-policy-strict ##################### [ 29/121]
Updating : selinux-policy-mls ##################### [ 30/121]
Updating : selinux-policy-targeted ##################### [ 31/121]
/sbin/fixfiles: line 62: 17611 Done sed -r -e 's,:s0,
,g' $FC
17612 | sort -u
17613 Done(1) | /usr/bin/diff -b ${PREFCTEMPFILE} -
17614 | grep '^[<>]'
17615 | cut -c3-
17616 | grep ^/
17617 | egrep -v '(^/home|^/root|^/tmp|^/dev)'
17618 | sed -r -e 's,[[:blank:]].*,,g' -e
's|\(([/[:alnum:]]+)\)\?|{\1,}|g' -e 's|([/[:alnum:]])\?|{\1,}|g' -e
's|\?.*|*|g' -e 's|\(.*|*|g' -e 's|\[.*|*|g' -e 's|\.\*.*|*|g' -e
's|\.\+.*|*|g'
17619 | sort -u
17620 | sort -d
17621 | while read pattern; do
if ! echo "$pattern" | grep -q -f ${TEMPFILE} 2> /dev/null; then
echo "$pattern"; case "$pattern" in
*"*")
echo "$pattern" | sed 's,\*$,,g' >> ${TEMPFILE}
;;
esac;
fi;
done
17622 Done(1) | while read pattern; do
find $pattern ! \( -fstype ext2 -o -fstype ext3 -o -fstype jfs -o
-fstype xfs \) -prune -o \( -wholename /home -o -wholename /root -o
-wholename /tmp -wholename /dev \) -prune -o -print;
done 2> /dev/null
17623 Segmentation fault | ${RESTORECON} $2 -v -f -
Updating : selinux-policy-devel ##################### [ 32/121]
Updating : policycoreutils-gui ##################### [ 33/121]
Updating : libsepol-devel ##################### [ 34/121]
Richard
17 years
Re: autoreconf fails in setools of revision 4290
by NZzi
Jeremy A. Mowery wrote:
> On Tuesday 17 April 2007 04:46, you wrote:
>> hi all,
>>
>> i use autoconf-2.61-8.fc7 in fc7 rawhide
>>
>> autoreconf of this version fails in building setools of
>> revision 4290.
>>
>> i also test setools 3.1 tags, it fails with the same errors:
>>
>> ......
>> sediff/Makefile.am:45: notdir $@: non-POSIX variable name
>> sediff/Makefile.am:45: (probably a GNU make extension)
>> sediff/Makefile.am:48: notdir $@: non-POSIX variable name
>> sediff/Makefile.am:48: (probably a GNU make extension)
>> sediff/Makefile.am:51: notdir $@: non-POSIX variable name
>> sediff/Makefile.am:51: (probably a GNU make extension)
>> autoreconf: automake failed with exit status: 1
>>
> We were unable to reproduce this error.
> We are currently building with:
> autoconf (GNU Autoconf) 2.59
> automake (GNU automake) 1.9.6
> GNU Make 3.80
>
> Could you send further information about the build tools you are using?
the build tools i use are:
automake-1.10-5
autoconf-2.61-8.fc7
make-3.81-6.fc7
as i mentioned before, the 3.1 tags in svn also failed with this error
but the 3.1 version of fc7 can be built without any errors:
setools-3.1-3.fc7.src.rpm
by the way, when i use the setools in fc7 rawhide:
setools-3.1-4.fc7.src.rpm
apol had "segmentation fault" errors in analyzing "all base" policy,
i.e. all modules in "module.conf" are changed into "base"
the same errors occured in setools-3.1-3.fc7.src.rpm.
but apol from setools-3.1-3.src.rpm can analyze the same base.pp without
any errors.
i forget where i got this srpm, maybe from tresys website, but i am sure
that it is not from fc repos.
finally, it seems that this problem is not belong to selinux list, so i
CC to fedora-selinux list.
"setools(a)tresys.com" is the mailing list of setools? if yes, i will send
similar problems to this list.
>
> - Jeremy A. Mowery
>> thanks in advance
>>
>> Ken YANG
>
17 years
Targeted policy does not allow lvm output redirection ?
by Davide Bolcioni
Greetings,
I tried the following:
lvm vgs -o vg_name,vg_extent_size --units=k | cat > /tmp/vgs2
lvm vgs -o vg_name,vg_extent_size --units=k > /tmp/vgs1
and obtained
-rw-r--r-- 1 root root 0 Apr 15 11:49 /tmp/vgs1
-rw-r--r-- 1 root root 28 Apr 15 11:49 /tmp/vgs2
but as you can see in the attached /var/log/audit.d/audit.log fragment,
writing from an executable running in the lvm_t context to an object labeled
with the tmp_t context is not allowed by the targeted policy.
My setup:
libselinux-1.33.4-2.fc6
selinux-policy-targeted-2.4.6-49.fc6
selinux-policy-2.4.6-49.fc6
Should I open a Bugzilla for this ?
Thank you for your consideration,
Davide Bolcioni
--
There is no place like /home.
17 years
setrans.conf
by Ivan Makale
I'm studying SELinux and I'd like to find a clear explanation of the
syntax used in the setrans.conf file. Have anybody a web resource to
suggest?
So to give an example,
s0-s0:c0.c1023=SystemLow-SystemHigh
s0:c0.c1023=SystemHigh
Is '-' indicating a range between sensitivity levels and the ''.' a
range between categories? What's the difference between "s0" only and
"s0-s0"? And so on...
Thank you, Ivan Makale
17 years
Latest selinux update & ping
by Jouni Viikari
Hi,
After the latest selinux updates I get a lot of these messages at my
log:
SELinux is preventing /bin/ping (ping_t) "search" to locale (locale_t)
or audit log:
denied { search } for pid=16255 comm="ping" name="locale" dev=dm-0
ino=3113039 scontext=system_u:system_r:ping_t:s0
tcontext=system_u:object_r:locale_t:s0 tclass=dir
type=SYSCALL msg=audit(1176300990.257:65255): arch=40000003 syscall=5
success=no exit=-13 a0=bf91d6e0 a1=0 a2=1b6 a3=8816018 items=0
ppid=18973 pid=18974 auid=4294967295 uid=507 gid=507 euid=0 suid
=0 fsuid=0 egid=507 sgid=507 fsgid=507 tty=(none) comm="ping"
exe="/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null)
type=AVC msg=audit(1176300990.257:65256): avc: denied { search } for
pid=18974 comm="ping" name="locale" dev=dm-0 ino=3113039
scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:loca
le_t:s0 tclass=dir
The last line repeats itself many times.
The pings are run by Big Brother which as a one task pings my network to
see all is up.
Is this a local problem here, selinux problem or ping problem?
-Jouni
17 years, 1 month
Many to one translations in setrans.conf
by Joe Nall
We have been using /etc/selinux/mls/setrans.conf files that use
multiple equivalent translations to support common aliases. For example:
s2:c1.c225,c227.c253=CONFIDENTIAL//REL FU
s2:c1.c225,c227.c253=C O N F I D E N T I A L REL FU
s2:c1.c225,c227.c253=C O N F I D E N T I A L RELEASABLE TO FU
s2:c1.c225,c227.c253=CONFIDENTIAL//REL BAR
s2:c1.c225,c227.c253=C O N F I D E N T I A L REL BAR
s2:c1.c225,c227.c253=C O N F I D E N T I A L RELEASABLE TO BAR
This has the effect of mapping all of these labels to a common
context. This context maps back to the first translation
(CONFIDENTIAL//REL FU).
'semanage translation -a -T ...' has different behavior. When a
translation is added, it rewrites the file using the last (C O N F I
D E N T I A L RELEASABLE TO BAR) translation and deletes the other
translations. It also moves all of the comments to the top, moving
them away from the translation they are documenting.
Should we be using this many to one behavior to support aliases? Is
it broken in other ways that we have not discovered yet?
joe
17 years, 1 month
Re: denied avcs Rawhide how to troubleshoot
by Antonio Olivares
----- Original Message ----
From: Daniel J Walsh <dwalsh(a)redhat.com>
To: Antonio Olivares <olivares14031(a)yahoo.com>
Cc: fedora-selinux-list(a)redhat.com
Sent: Tuesday, April 10, 2007 12:46:29 PM
Subject: Re: denied avcs Rawhide how to troubleshoot
Antonio Olivares wrote:
Dear list,
> I am running rawhide and I get these denied avcs
>
> [olivares@localhost ~]$ cat /etc/fedora-release
> Fedora release 6.92 (Rawhide)
> [olivares@localhost ~]$
>
> There is a tool semanage, but I do not know how to use it. Is there any reference to this new tool.
> How do I fix this using chcon -? or other tools to troubleshoot this.
>
> audit(1176209974.281:4): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1440" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:5): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1680" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:6): avc: denied { create } for pid=991 comm="cIreate_floppy_d" name="fd0u1722" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:7): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1743" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:8): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1760" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:9): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1920" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:10): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1840" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:11): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1600" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:12): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u360" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:13): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u720" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:14): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u820" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:15): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u830" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:16): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1040" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:17): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u1120" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
> audit(1176209974.281:18): avc: denied { create } for pid=991 comm="create_floppy_d" name="fd0u800" scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:default_t:s0 tclass=blk_file
>
>
>
>
> Thanks,
>
> Antonio
>
>
>
>
>
> ____________________________________________________________________________________
> Don't pick lemons.
> See all the new 2007 cars at Yahoo! Autos.
> http://autos.yahoo.com/new_cars.html
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
Please submit this as a udev bug.
Done!
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235953
Regards,
Antonio
____________________________________________________________________________________
Don't pick lemons.
See all the new 2007 cars at Yahoo! Autos.
http://autos.yahoo.com/new_cars.html
17 years, 1 month