Thanks Bill, that worked - at least for consoletype_t and some other
types - I am using an amd64 system and have the same problem with
symlinks (the labellers seem to have problems with them... replace /lib
with /lib(64)? in file_contexts).
Unfortunately, I am still facing some error messages in which case the
file type is correct:
vmdefault # dmesg | grep avc
audit(1191161059.993:4): avc: denied { read } for pid=16909
comm="mount" name="urandom" dev=tmpfs ino=2443
scontext=system_u:system_r:mount_t
tcontext=system_u:object_r:urandom_device_t tclass=chr_file
When trying to write a policy_module
vmdefault # files_manage_urandom_seed(mount_t)
the compile error stops me again:
Compiling strict local module
/usr/bin/checkmodule: loading policy configuration from tmp/local.tmp
local.te:11:ERROR 'unknown type mount_t' at token ';' on line 78190:
allow mount_t var_t:dir { getattr search };
#line 11
/usr/bin/checkmodule: error(s) encountered while parsing configuration
make: *** [tmp/local.mod] Error 1
Also I don't manage to install the base policy from the Tresys guys (I
think they have more types compiled in??)
vmdefault # make
vmdefault # semodule -v -b policy.21
Attempting to install base module 'policy.21':
libsepol.module_package_read_offsets: wrong magic number for module
package: expected 4185718671, got 4185718668
libsemanage.parse_base_headers: Could not parse base module data.
semodule: Failed on policy.21!
How to change the magic number?
Do you have some input for me?
Dominik
On Fri, 2007-09-28 at 18:00 -0400, Bill Sharer wrote:
> Actually what you have there is a mislabeled file. Here's the relevant
> poop:
>
> # cd /etc/selinux/strict/contexts/files
>
> # grep ld.so.cache file_contexts
> /etc/ld\.so\.cache -- system_u:object_r:ld_so_cache_t
> /etc/ld\.so\.preload -- system_u:object_r:ld_so_cache_t
>
> # ls -Z /etc/ld.so.cache
> -rw-r--r-- root root root:object_r:ld_so_cache_t /etc/ld.so.cache
>
> See if this does the trick:
>
> # restorecon -v /etc/ld.so.cache
>
> If that doesn't change it, your system is not firing the rule properly
> or else it is missing from the file_contexts file for some reason. I've
> had some rules fail to fire on an x86_64 box because there were issues
> matching the /lib symlink to the /lib64 target and so forth.Also, have
> you done an rlpkg to relabel your filesystem lately?
>
> Dominik J. Fischer wrote:
> > Dear list,
> >
> > I am running a freshly intalled SELinux system with
> > sec-policy/selinux-base-policy 20070329 in strict/permissive mode.
> >
> > When I try to write a TE module for my avc denials the compiler doesn't
> > resolve the necesary types. For example, considerung the following avc
> > entry for type consoletype:
> >
> > vmdefault # dmesg | grep avc
> > audit(1190988750.096:3): avc: denied { read } for pid=26115
> > comm="consoletype" name="ld.so.cache" dev=sda1 ino=336323476
> > scontext=system_u:system_r:consoletype_t tcontext=root:object_r:etc_t
> > tclass=file
> > audit(1190988750.096:4): avc: denied { getattr } for pid=26115
> > comm="consoletype" name="ld.so.cache" dev=sda1 ino=336323476
> > scontext=system_u:system_r:consoletype_t tcontext=root:object_r:etc_t
> > tclass=file
> >
> > My policy module looks like this:
> >
> > policy_module(local,1.0.0)
> > type local_t;
> > files_read_etc_files(consoletype_t)
> >
> > When I try to compile, the compiler gives me an unknown type error:
> >
> > vmdefault include # make -f /usr/share/selinux/strict/include/Makefile
> > Compiling strict local module
> > /usr/bin/checkmodule: loading policy configuration from tmp/local.tmp
> > local.te:11:ERROR 'unknown type consoletype_t' at token ';' on line
> > 78133:
> > allow consoletype_t etc_t:dir { getattr search read lock
> > ioctl };
> > #line 11
> > /usr/bin/checkmodule: error(s) encountered while parsing configuration
> > make: *** [tmp/local.mod] Error 1
> >
> > Seems to me that the compiler does not resolve the types against the
> > base policy.
> >
> > Any ideas? Comments are highly appreciated.
> >
> > Dominik
> >
> >
>
--
[EMAIL PROTECTED] mailing list
