Package: selinux-policy-default Version: 2:0.0.20080702-6 Severity: important Tags: patch
Hi, If you use for example kvm to virtualize a lenny guest, you are encouraged to use virtio-disks for improved performance. But if you do so, installing selinux (and enabling it via selinux-activate and selinux-config-enforcing) renders the system unbootable, as early on in the boot process selinux denys mounting the root fs r/w. This is because /dev/vd-devices are not properly labelled, that is, they are not labelled like /dev/[hsmx]d-devices. I think this is a bug in refpolicy and will try to submit it upstream as well. I could fix the problem by applying this patch, rebuilding and installing the new version (afterwards, the system boots and /dev/vd-devices are labelled correctly): --- a/policy/modules/kernel/storage.fc +++ b/policy/modules/kernel/storage.fc @@ -5,7 +5,7 @@ /dev/n?osst[0-3].* -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?pt[0-9]+ -c gen_context(system_u:object_r:tape_device_t,s0) /dev/n?tpqic[12].* -c gen_context(system_u:object_r:tape_device_t,s0) -/dev/[shmx]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) +/dev/[shmxv]d[^/]* -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh) /dev/aztcd -b gen_context(system_u:object_r:removable_device_t,s0) /dev/bpcd -b gen_context(system_u:object_r:removable_device_t,s0) /dev/bsg/.+ -c gen_context(system_u:object_r:scsi_generic_device_t,s0) It would be nice, if this could be included in a stable update, as it happens to everybody who wants to deploy kvm-virtualized lenny-guests using the default options virt-manager and the like offer. Cheers, Mika Pflüger -- System Information: Debian Release: 5.0.5 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 2.6.26-2-amd64 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages selinux-policy-default depends on: ii libpam-modules 1.0.1-5+lenny1 Pluggable Authentication Modules f ii libselinux1 2.0.65-5 SELinux shared libraries ii libsepol1 2.0.30-2 Security Enhanced Linux policy lib ii policycoreutils 2.0.49-8 SELinux core policy utilities ii python 2.5.2-3 An interactive high-level object-o Versions of packages selinux-policy-default recommends: ii checkpolicy 2.0.16-1 SELinux policy compiler pn setools <none> (no description available) Versions of packages selinux-policy-default suggests: pn logcheck <none> (no description available) pn syslog-summary <none> (no description available) -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
