Bug#859003: systemd-container: strange permissions on /dev/pts/ptmx

2017-03-29 Thread Russell Coker
On Thu, 30 Mar 2017 01:00:33 AM Felipe Sateler wrote: > From the kernel documentation: > > As an option instead of placing a /dev/ptmx device node at /dev/ptmx > > it is possible to place a symlink to /dev/pts/ptmx at /dev/ptmx or > > to bind mount /dev/ptx/ptmx to /dev/ptmx. If you opt for using

Bug#859003: systemd-container: strange permissions on /dev/pts/ptmx

2017-03-29 Thread Russell Coker
Package: systemd-container Version: 232-22 Severity: normal # grep pts /proc/mounts devpts /dev/pts devpts rw,seclabel,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 # ls -l /dev/pts/ptmx c-. 1 root root 5, 2 Mar 20 21:51 /dev/pts/ptmx The above is from a regular Debian/unstable

Bug#858902: opendkim-tools: opendkim-testkey should support using a recursive DNS server

2017-03-28 Thread Russell Coker
Package: opendkim-tools Version: 2.11.0~alpha-9 Severity: important opendkim-testkey talks to DNS servers in the real world when verifying a key. The advantage of this is that you can get a full test and see what systems outside your control will see. The disadvantage of this is that you can't te

Bug#858335: systemd: should usr /run instead of /var/run

2017-03-22 Thread Russell Coker
On Tuesday, 21 March 2017 10:43:57 AM AEDT Felipe Sateler wrote: > > # strings /usr/lib/systemd/libsystemd-shared-232.so|grep var.run.dbus > > kernel:path=/sys/fs/kdbus/0-system/bus;unix:path=/var/run/dbus/system_bus_ > > socket > As you already know, this is the canonical address and has not been

Bug#858331: dpkg -S doesn't work properly with usrmerge

2017-03-21 Thread Russell Coker
On Wednesday, 22 March 2017 4:41:32 AM AEDT Guillem Jover wrote: > > > # dpkg -S /usr/lib/systemd/libsystemd-shared-232.so > > > dpkg-query: no path found matching pattern > > > /usr/lib/systemd/libsystemd-shared-232.so # dpkg -S > > > /lib/systemd/libsystemd-shared-232.so > > > systemd: /lib/syste

Bug#858341: sorry missed one

2017-03-21 Thread Russell Coker
--- /tmp/cups.socket2017-03-22 00:58:17.980111961 +1100 +++ /lib/systemd/system/cups.socket 2017-03-22 00:58:24.516507263 +1100 @@ -3,7 +3,7 @@ PartOf=cups.service [Socket] -ListenStream=/var/run/cups/cups.sock +ListenStream=/run/cups/cups.sock [Install] WantedBy=sockets.target Th

Bug#858341: cups-daemon: please usr /run instead of /var/run

2017-03-21 Thread Russell Coker
Package: cups-daemon Version: 2.2.1-8 Severity: normal Tags: patch /run has been around since 2011, I think it's time to stop using the /var/run symlink. Supporting the symlink in SE Linux means supporting both names for the contexts used in the initial creation of files and directories which I w

Bug#783321: more issues

2017-03-21 Thread Russell Coker
When a program like systemd creates a file and checks the SE Linux file_contexts for the initial context it will be based on the path used. So when systemd uses a path with /var/run we need a file contexts entry for that as well as for the /run version. In the past we have had a subst entry ma

Bug#858335: systemd: should usr /run instead of /var/run

2017-03-21 Thread Russell Coker
Package: systemd Version: 232-20 Severity: normal https://lists.fedoraproject.org/pipermail/devel/2011-March/150031.html The use of a /run tmpfs started in March 2011. I think it's time for all software to use /run directly not via the /var/run symlink. Among other things we have special code i

Bug#858331: dpkg -S doesn't work properly with usrmerge

2017-03-21 Thread Russell Coker
Package: dpkg Version: 1.18.23 Severity: normal # dpkg -S /usr/lib/systemd/libsystemd-shared-232.so dpkg-query: no path found matching pattern /usr/lib/systemd/libsystemd-shared-232.so # dpkg -S /lib/systemd/libsystemd-shared-232.so systemd: /lib/systemd/libsystemd-shared-232.so # ls -l /lib lrwx

Bug#858187: boinc-manager: boincmgr suddenly needs -d /etc/boinc-client

2017-03-19 Thread Russell Coker
Package: boinc-manager Version: 7.6.33+dfsg-10 Severity: normal When configuring a boinc-client on localhost (or tunneled through ssh) boincmgr stopped working recently. According to my records (looking at the timestamps on /etc/boinc-client/global_prefs_override.xml and comparing it to dpkg.log)

Bug#858074: auditd: fails to start with unusable error message

2017-03-17 Thread Russell Coker
Package: auditd Version: 1:2.6.7-1 Severity: normal The command "systemctl status auditd.service" reports the following: Mar 18 11:16:03 unicorn augenrules[3582]: failure 1 Mar 18 11:16:03 unicorn augenrules[3582]: pid 0 Mar 18 11:16:03 unicorn augenrules[3582]: rate_limit 0 Mar 18 11:16:03 unicor

Bug#856825: openssh-server: /usr/lib/tmpfiles.d/sshd.conf should use /run not /var/run

2017-03-04 Thread Russell Coker
Package: openssh-server Version: 1:7.4p1-6 Severity: normal /usr/lib/tmpfiles.d/sshd.conf should create /run/sshd not /var/run/sshd. /var/run has been a symlink to /run for years so apps should use the canonical name.

Bug#856824: screen: /usr/lib/tmpfiles.d/screen-cleanup.conf should use /run not /var/run

2017-03-04 Thread Russell Coker
Package: screen Version: 4.5.0-3 Severity: normal /usr/lib/tmpfiles.d/screen-cleanup.conf should create /run/screen not /var/run/screen. /var/run has been a symlink to /run for years so all configuration should use the canonical name.

Bug#856822: iodine: /usr/lib/tmpfiles.d/iodined.conf should use /run not /var/run

2017-03-04 Thread Russell Coker
Package: iodine Version: 0.7.0-7 Severity: normal As /var/run has been a symlink to /run for a long time configuration should point to /run. /usr/lib/tmpfiles.d/iodined.conf should create /run/iodine not /var/run/iodine .

Bug#856823: mon: /usr/lib/tmpfiles.d/mon.conf should use /run not /var/run

2017-03-04 Thread Russell Coker
Package: mon Version: 1.2.0-9+nmu4 Severity: normal /usr/lib/tmpfiles.d/mon.conf should create directory /run/mon not /var/run/mon.

Bug#856338: postfixadmin: wrong permissions on /usr/share/postfixadmin/templates_c

2017-02-27 Thread Russell Coker
Package: postfixadmin Version: 3.0.2-1 Severity: normal On my system /usr/share/postfixadmin/templates_c had mode 0777, I don't know how it got that. In the package it has mode 0755 with ownership root:root. I think that the correct mode might be 0775 or 0770 with ownership root:www-data. Apach

Bug#854475: postfix: systemd needs postfix@.service to have "After=network.target"

2017-02-07 Thread Russell Coker
Package: postfix Version: 3.1.4-4 Severity: important Tags: patch The file /lib/systemd/system/postfix@.service needs to have the line "After=network.target" to make sure that all the network interfaces are raised before it is started. Otherwise the startup will abort if Postfix is configured to

Bug#853852: gwenview: kde stores history when gwenview says it has been disabled

2017-02-01 Thread Russell Coker
Package: gwenview Version: 4:16.08.3-1 Severity: normal When gwenview has been configured via Settings, Configure Gwenview, Advanced and the History checkbox is deselected it will say "History has been disabled" when you start it with no parameters. Then if you view some images and exit gwenview

Bug#853291: mysql-server-5.7: need to call restorecon for SE Linux

2017-01-31 Thread Russell Coker
Package: mysql-server-5.7 Version: 5.7.16-2 Severity: normal Tags: patch https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801746 This is basically a repeat of the above bug for the latest mysql. While we have an install command to create a directory we need to have a SE Linux label assigned to

Bug#853207: bluez: bluetooth.service doesn't start with systemd

2017-01-30 Thread Russell Coker
Package: bluez Version: 5.43-1 Severity: grave Justification: renders package unusable # systemctl restart bluetooth.service # systemctl status bluetooth.service ● bluetooth.service - Bluetooth service Loaded: loaded (/lib/systemd/system/bluetooth.service; enabled; vendor preset Active: inac

Bug#852568: [DSE-Dev] Bug#852568: refpolicy: Update udevadm path

2017-01-25 Thread Russell Coker
close 852568 thanks On Wednesday, 25 January 2017 2:42:37 PM AEDT bi...@debian.org wrote: > According to codesearch [1] your package refpolicy does hard-code the > udevadm path as /sbin/udevadm. It has both /sbin and /bin names used for labelling, so whichever name is in use will get the label.

Bug#850116: [DSE-Dev] Bug#850116: SEGV is always a bug in app or library

2017-01-22 Thread Russell Coker
On Friday, 13 January 2017 7:26:38 PM AEDT Laurent Bigonville wrote: > Did you check the user_avc's too? I see some denials of dbus > communication here. No, my main test system isn't logging them for some reason. > With all the new allow rules in the attached files, I can get gdm > running and

Bug#851933: Work around

2017-01-19 Thread Russell Coker
If you can't fix the code before the Stretch freeze please call "restorecon /lib/udev/hwdb.bin" after running systemd-hwdb. -- Sent from my Nexus 6P with K-9 Mail.

Bug#851933: udev: /lib/udev/hwdb.bin gets wrong SE Linux label

2017-01-19 Thread Russell Coker
Package: udev Version: 232-12 Severity: normal The command "systemd-hwdb --usr update" as run from /var/lib/dpkg/info/udev.postinst creates the file /lib/udev/hwdb.bin and assigns it the SE Linux context "system_u:object_r:default_t:s0" when it should have "system_u:object_r:bin_t:s0" with the cur

Bug#851760: selinux-policy-default: policy operations give error libsemanage.add_user: user system_u not in password file

2017-01-18 Thread Russell Coker
Package: selinux-policy-default Version: 2:2.20161023.1-2 Severity: minor Tags: upstream libsemanage.add_user: user system_u not in password file Due to a combination of the way semanage now works and the way the policy is written we get the above error on most semanage operations. This is an an

Bug#851354: mon: /usr/lib/tmpfiles.d/mon.conf should be a file not a directory

2017-01-14 Thread Russell Coker
Package: mon Version: 1.2.0-9+nmu3 Severity: normal /usr/lib/tmpfiles.d/mon.conf should be a file, not a directory containing that file. -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-1-am

Bug#850116: SEGV is always a bug in app or library

2017-01-13 Thread Russell Coker
reassign 850116 gdm3 thanks I find it difficult to think of situations where a SEGV in a program is anything other than a bug in the program or a library it uses. If the program is prevented from doing something it wants to do (by SE Linux, Unix permissions, a filesystem error, lack of disk s

Bug#851236: torbrowser-launcher gives python errors and doesn't launch

2017-01-13 Thread Russell Coker
Package: torbrowser-launcher Version: 0.2.0-2 Severity: important Here is what I get when I run torbrowser-launcher on an Unstable AMD64 system, after displaying the following it pops up a window saying that it's downloading and installing torbrowser and appears to hang. Maybe there's a missing d

Bug#752598: please fix this

2017-01-12 Thread Russell Coker
It's been 2.5 years since I reported this and there is a patch. Could you please fix this in time for Stretch? -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#851143: systemd: doesn't use all the mount options from /etc/fstab when mounting on boot

2017-01-12 Thread Russell Coker
Package: systemd Version: 232-8 Severity: normal When I boot a server that mounts a filesystem via NFS it ignores the context= mount option to set a SE Linux context of the files. What I want is to use the type mail_spool_t for a NFS mounted mail spool instead of the default nfsd_rw_t (a generic

Bug#851141: opendkim: please set umask to something other than the default of 0022 in systemd serice

2017-01-12 Thread Russell Coker
Package: opendkim Version: 2.11.0~alpha-8 Severity: normal Tags: patch The below patch sets the umask to 0007 which permits the opendkim.conf umask directive to allow group access to the socket file. The default that systemd uses is 0022 which means that group write access is denied to the socke

Bug#851129: clamav-freshclam: call to restorecon isn't working, please consider this patch

2017-01-12 Thread Russell Coker
Package: clamav-freshclam Version: 0.99.2+dfsg-5 Severity: normal Tags: patch The below patch gives the directories the correct context on my system. Pathfind doesn't seem to work. --- clamav-freshclam.orig 2017-01-12 20:20:51.853784565 +1100 +++ clamav-freshclam2017-01-12 20:32:56.8877

Bug#850032: not that important

2017-01-09 Thread Russell Coker
severity 850032 normal thanks I don't think this bug is important. Few people will run the usrmerge package and I think it will be even less popular among SE Linux users because they are the people who don't tend to go for such exciting changes when they are optional. In addition I don't want

Bug#740685: policy will be fixed in 2.20161023.1-7

2017-01-09 Thread Russell Coker
Version 2.20161023.1-7 (which will be uploaded in 2-3 days) will fix the policy aspects of this, but it won't make resolvconf work as some changes are required in that package. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850783 The above bug report is now the one stopping resolvconf from

Bug#850783: resolvconf: needs to set correct SE Linux context on created directories and files

2017-01-09 Thread Russell Coker
Package: resolvconf Version: 1.79 Severity: normal Tags: patch https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740685 I've written SE Linux policy to fix the above bug, but also we need 2 minor changes to resolvconf. d /run/resolvconf 0755 root root - d /run/resolvconf/interface 0755 root root

Bug#817677: already fixed

2017-01-08 Thread Russell Coker
close 817677 thanks I fixed this in version 2.2.1-2 but forgot to put a closes: entry in the changelog. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#800258: already fixed

2017-01-08 Thread Russell Coker
close 800258 thanks This was fixed in 0.13e but I forgot to list it in the changelog. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#849787: probably best to just ignore this for Stretch

2017-01-07 Thread Russell Coker
priority 849787 wishlist thanks I've made selinux policy packages conflict with mcstrans so this shouldn't be a problem any more. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#850578: selinux-basics: wrong label on /dev/pts/ptmx

2017-01-07 Thread Russell Coker
Package: selinux-basics Version: 0.5.6 Severity: normal selinux-basics should run restorecon on /dev/pts/ptmx and/or have a systemd tmpfiles configuration entry for it to give it the correct context on boot. -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (

Bug#534687: libssl0.9.8: lh_retrieve modifies global data, bug in valgrind or OpenSSL?

2017-01-07 Thread Russell Coker
On Saturday, 7 January 2017 10:23:56 PM AEDT Sebastian Andrzej Siewior wrote: > I am tempted to close this. Can you still reproduce this with current > openssl & valgrind? RSA_new_method() is no longer using the class thingy > / lhash so your old testcase won't do. And then 1.1.0c is using > pthrea

Bug#849637: [DSE-Dev] Bug#849637: not policy bugs

2017-01-07 Thread Russell Coker
On Saturday, 7 January 2017 11:43:09 AM AEDT Laurent Bigonville wrote: > I'm using the refpolicy with this patch above it. > > kernel from unstable: Linux fornost 4.8.0-2-amd64 #1 SMP Debian 4.8.11-1 > (2016-12-02) x86_64 GNU/Linux > > I tried to load the policy from the initramfs to be sure not

Bug#849637: not policy bugs

2017-01-06 Thread Russell Coker
On Friday, 6 January 2017 2:09:13 PM AEDT Laurent Bigonville wrote: > I just retested myself and it's working with the kernel from unstable > (apparently you need >= 4.2) and the following line: > > genfscon sysfs /devices/system/cpu/online > gen_context(system_u:object_r:cpu_online_t,s0) > > So

Bug#849637: not policy bugs

2017-01-06 Thread Russell Coker
On Friday, 6 January 2017 2:09:13 PM AEDT Laurent Bigonville wrote: > I just retested myself and it's working with the kernel from unstable > (apparently you need >= 4.2) and the following line: > > genfscon sysfs /devices/system/cpu/online > gen_context(system_u:object_r:cpu_online_t,s0) I must

Bug#849637: not policy bugs

2017-01-06 Thread Russell Coker
reassign 849637 policycoreutils thanks This can't be fixed in policy. Policycoreutils should have an init script or systemd tmpfiles config file to set it. https://github.com/cgzones/debian-package-refpolicy/commit/ 3ba127468436334275398a824260383208ee58b1 Also the above patch is not likely to

Bug#830865: for the mailman lists

2017-01-06 Thread Russell Coker
On Friday, 6 January 2017 1:29:02 PM AEDT Alexander Wirt wrote: > On Fri, 06 Jan 2017, Russell Coker wrote: > > We use mailman for some (most? all?) of the Debian lists, it has ways of > > solving these problems. > > We don't use mailman for any debian lists. http://l

Bug#830865: for the mailman lists

2017-01-06 Thread Russell Coker
We use mailman for some (most? all?) of the Debian lists, it has ways of solving these problems. https://mail.python.org/pipermail/mailman-users/2011-October/072304.html First use "REMOVE_DKIM_HEADERS = Yes" in mm_cfg.py to remove the DKIM headers, this deals with systems that have signatures b

Bug#850274: usrmerge: created symlinks have the wrong SE Linux context

2017-01-05 Thread Russell Coker
On Thursday, 5 January 2017 11:09:49 PM AEDT Marco d'Itri wrote: > > After creating symlinks please test if /sbin/restorecon (or > > /usr/sbin/restorecon) exists, if it exists run "/sbin/restorecon $NAME" > > where $NAME is the newly created link. > > Do you mean the /{bin,sbin,lib/,...}/ links Y

Bug#850032: fixed in git

2017-01-05 Thread Russell Coker
I've checked in a fix for this to git, you can download from git if you want to test it immediately. While doing that I fixed some inconsistencies in labeling that also affect non-usrmerge systems so this was a good thing to get done before the release. -- My Main Blog http://etbe.coke

Bug#850274: usrmerge: created symlinks have the wrong SE Linux context

2017-01-05 Thread Russell Coker
Package: usrmerge Version: 13 Severity: normal After creating symlinks please test if /sbin/restorecon (or /usr/sbin/restorecon) exists, if it exists run "/sbin/restorecon $NAME" where $NAME is the newly created link. -- System Information: Debian Release: stretch/sid APT prefers unstable APT

Bug#781779: sddm

2017-01-04 Thread Russell Coker
I have sddm working and have checked the basic policy into git. Later today I will add some extra rules that are needed for full operation (such as deleting temporary files on user logout), but the basics work. I still can't get gdm3 to work, I've filed a bug report against it. If anyone here

Bug#850116: gdm3: gnome-session-f called from gdm3 SEGVs when run with SE Linux enforcing

2017-01-04 Thread Russell Coker
Source: gdm3 Severity: normal gdm3 fails to start when SE Linux is enforcing and the kernel message log has many messages like the ones below. To reproduce this, have a system running gdm3 and run the following commands: apt-get install selinux-policy-default selinux-basics selinux-activate reboo

Bug#850006: also sorta depends on #826214

2017-01-04 Thread Russell Coker
If you are running systemd and start sddm with "/etc/init.d/sddm start" then it won't use systemctl and will start in the same "session" as your shell and thus give this error message even if you have removed the pam_systemd lines from /etc/pam.d/sddm*. Until #826214 you have to use "systemctl

Bug#850006: sddm: pam_systemd errors in auth.log

2017-01-02 Thread Russell Coker
Package: sddm Version: 0.13.0-1 Severity: normal /etc/pam.d/{sddm,sddm-autologin,sddm-greeter} all have "session required pam_systemd.so" and they all also include common-session which has "session optionalpam_systemd.so". This leads to errors such as the following: Jan 3 12:23:28 unicor

Bug#781779: xdm and kdm work

2016-12-31 Thread Russell Coker
xdm (the original display manager) and kdm (which is only in Jessie but still works if you never uninstalled it) are supported in the current policy. I'm working on sddm and gdm3, I don't know if I will get them both going before stretch is frozen. Anyway xdm is supported and does everything yo

Bug#830472: can't reproduce, not serious

2016-12-30 Thread Russell Coker
severity 830472 normal thanks I can't reproduce this. Version 0.74 fixed all the GCC6 related bugs that occur on my system. Version 0.75 should stay in testing because the amd64 package I uploaded compiled without any serious warnings. I'll fix this bug if I can reproduce it, but it's not a r

Bug#849787: mcstrans: Running mcstrans triggers 849748 and is the most serious SE Linux problem

2016-12-30 Thread Russell Coker
Package: mcstrans Version: 2.6-2 Severity: critical Tags: upstream Justification: breaks unrelated software While mcstrans has no problems for what it does, it triggers bad interactions between systemd, dbus, and SE Linux. I don't think it is possible to properly solve these issues before the sid

Bug#849748: dbus is translating SE Linux contexts when it's not appropriate

2016-12-30 Thread Russell Coker
Package: dbus Version: 1.10.14-1 Severity: normal Tags: upstream Below is part of the SE Linux audit log on one of my test systems. These entries have a MCS context of "s0" which is being translated to "SystemLow" in a very similar way to translating a UID to a username. However the software whi

Bug#849719: O: cyclades-serial-client

2016-12-29 Thread Russell Coker
Package: wnpp Severity: normal The package cyclades-serial-client is designed to work with Cyclades terminal servers (which have not been manufactured for a while) and other devices using RFC 2217 (which probably includes some Cisco gear that's still in service). It has a shared object that takes

Bug#678367: bug has gone away

2016-12-28 Thread Russell Coker
close 678367 thanks The latest version of dirmngr doesn't have an init.d script, uses systemd to start, and doesn't have the directory in question.

Bug#849552: policycoreutils: semodule aborts on corrupted installation, how can user solve this?

2016-12-28 Thread Russell Coker
Package: policycoreutils Version: 2.6-2 Severity: normal After a system crash I found my policy database corrupted, here are some examples: # dpkg -i selinux-policy-default_2.20161023.1-5_all.deb (Reading database ... 244796 files and directories currently installed.) Preparing to unpack .../sel

Bug#765391: appears fixed

2016-12-28 Thread Russell Coker
close 765391 thanks We now load all the modules, so munin and apache are installed by default and it all seems to work. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#758083: workaround

2016-12-28 Thread Russell Coker
The tunable allow_execmem will make this work. It's not ideal and we need a better solution. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#757022: fixed upstream

2016-12-28 Thread Russell Coker
close 757022 thanks This bug was fixed upstream, presumably a merge from Fedora. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#739150: already fixed

2016-12-28 Thread Russell Coker
close 739150 thanks Version 2:2.20140421-16 of the policy in my private repository for Jessie which was also used to start the policy for Unstable doesn't have this problem. It was fixed some time ago. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com

Bug#738946: already fixed

2016-12-28 Thread Russell Coker
close 738946 thanks Fixed in 2:2.20140421-6. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#739050: fixed

2016-12-28 Thread Russell Coker
close 739050 thanks >From a quick examination these have been fixed already. Please file new bug reports if you have any further problems. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#690477: all fixed

2016-12-28 Thread Russell Coker
close 690477 thanks The issue with /var/lib labelling is fixed. The other things don't appear to be a problem at a quick test. Please file new separate bug reports if any of these things can be reproduced in Unstable. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghtt

Bug#738950: fixed

2016-12-27 Thread Russell Coker
close 738950 thanks This works for me on version 2:2.20140421-16 and I don't think there's been a regression. Please open a new report if it happens on 2:2.20140421-16 or later. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#781571: I think this was finally fixed in 2:2.20161023.1-3

2016-12-27 Thread Russell Coker
close 781571 thanks There were a number of changes related to DM device management. I think that update 2:2.20161023.1-3 fixed the last of the issues. Please install that version, relabel the relevant files (relabel everything if unsure), reboot, and try it again. -- My Main Blog ht

Bug#728950: how is this called?

2016-12-27 Thread Russell Coker
Is this a script you wrote or part of Samba? samba_read_config(dhcpc_t) The above policy allows dhclient to read the samba config. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#728950: not important

2016-12-27 Thread Russell Coker
severity 728950 normal thanks This is a regular policy issue. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#736909: where are we at with this?

2016-12-27 Thread Russell Coker
The lxc_contents file is in selinux-policy-default and a quick check indicates that the policy might be ok. What do we have to do to test it? I can provide root on a test system to anyone who wants to help test this. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp:

Bug#693449: closing as it's old and I can't reproduce

2016-12-25 Thread Russell Coker
close 693449 thanks If you have this happen on Jessie or newer then please save the data file that triggers it. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#849247: linux-image-4.8.0-2-amd64: module bochs_drm does not respect nomodeset

2016-12-23 Thread Russell Coker
Package: src:linux Version: 4.8.11-1 Severity: normal I am running a KVM server without X11 or VNC access, so I want a plain text console for all VMs. When running a Debian/Unstable Dom0 qemu provides the new bochs virtual hardware interface by default, the kernel loads the driver for that, ignor

Bug#757421: how should we do this?

2016-12-13 Thread Russell Coker
Please tell me a regex that would add the required "security=selinux" kernel option and I'll add it. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#776205: closing, I think it's resolved

2016-12-13 Thread Russell Coker
close 776205 thanks The problem here was apparently a misconfiguration. One could argue that it's a bug in dbus, but I'm sure it's not a bug in SE Linux. I think that Laurent addressed the configuration issue, so I think this issue is resolved. -- My Main Blog http://etbe.coker.com.a

Bug#765393: closing due to lack of response

2016-12-13 Thread Russell Coker
close 765393 thanks selinux-activate is not essential, anyone can edit the config files manually if they are using one of the less common boot loaders. Due to a lack of response as to how selinux-activate could work with pyGrub I'm closing this bug. Feel free to reopen if you can suggest how t

Bug#795518: closing due to lack of response

2016-12-13 Thread Russell Coker
close 795518 thanks This bug is against an old version, can't be reproduced, and the reporter hasn't answered a follow-up question in over a year. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#242878: background-color?

2016-12-12 Thread Russell Coker
http://www.w3schools.com/cssref/pr_background-color.asp The above URL says it's "background-color". I'll change it to that. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#847444: mon: ps.monitor should be in the base package and should handle scripts

2016-12-08 Thread Russell Coker
Package: mon Version: 1.2.0-9 Severity: normal Monitoring a list of processes on the local system is such a core component of monitoring that it should be included in the base package. Also ps.monitor in mon-contrib doesn't have "use strict;" and it also can't handle scripts properly (EG it regar

Bug#847441: mon: remote.monitor should be in the base package and should be fixed

2016-12-08 Thread Russell Coker
Package: mon Version: 1.2.0-9 Severity: normal The remote.monitor should be considered a core part of mon due to it's use of the mon protocol, it shouldn't be a contrib thing. Also it should have "use strict;" and be fixed to operate correctly with that. Finally it should have command-line optio

Bug#847437: mon: Please move local checks to a different directory for SE Linux and AppArmor

2016-12-08 Thread Russell Coker
Package: mon Version: 1.2.0-9 Severity: normal For SE Linux, AppArmor, and other security systems to easily give different levels of access to different programs they should be in different directories. There are 2 main categories of monitor scripts, local checks (EG running ps, df, reading /proc

Bug#821103: NMU delayed 6 days

2016-12-08 Thread Russell Coker
After almost 8 months with no response to this bug report I've uploaded an NMU to fix it to the 6 days delayed queue. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#834228: policy bug

2016-12-07 Thread Russell Coker
reassign 834228 selinux-policy-default thanks Turns out this was a policy bug. I'll fix it soon. -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#846484: policycoreutils-python-utils: Can't delete user with "semanage user -d"

2016-12-01 Thread Russell Coker
Package: policycoreutils-python-utils Version: 2.6-2 Severity: normal # semanage user -a -R user_r test2 libsemanage.add_user: user system_u not in password file # semanage user -d test2 ValueError: SELinux user test2 is not defined # I get the above when I try to add and delete a user. The syst

Bug#834228: more info

2016-11-18 Thread Russell Coker
~/systemd-tmpfiles --create /usr/lib/tmpfiles.d/systemd.conf I copied /bin/systemd-tmpfiles to /root (so I can give it a different context). When I run the above command after logging in as root:sysadm_r it sets the correct context. But when I delete /run/utmp and run it again it doesn't recr

Bug#834228: adding that line doesn't fix it

2016-11-17 Thread Russell Coker
Adding the line in question makes no difference. The way you see if it worked is you run restorecon and see if it reports doing anything, if everything is OK restorecon will do nothing. Below is an example. # restorecon -v /run/utmp restorecon reset /run/utmp context system_u:object_r:var_run

Bug#818519: maybe similar problem

2016-11-15 Thread Russell Coker
One of my relatives has a problem with kmail disappearing. Sometimes kmail disappears and won't reappear until "killall -9 mail" is run and it's lanched again. I tested on that system and it reported the state IsUnMapped when kmail is visible. I haven't yet run those X commands while kmail is

Bug#843342: plasma-workspace: plasmashell crashes after startup

2016-11-05 Thread Russell Coker
Package: plasma-workspace Version: 4:5.8.2-1 Severity: normal [ 1217.537000] plasmashell[9689]: segfault at 8 ip 7feaa766df37 sp 7fff0864a440 error 4 in libQt5Core.so.5.7.1[7feaa73b+4cd000] After upgrading a couple of systems to the latest Unstable I am seeing plasmashell crash after

Bug#839112: vim: please provide vim-legacy packages

2016-09-28 Thread Russell Coker
Package: vim Version: 2:7.4.488-7 Severity: wishlist Version 7.4 of vim works well for me. Version 8 breaks things in the following ways: 1) By default it doesn't accept system copy/paste operations. I can't copy text from one Xterm to vim in another because the paste operation is intercepted to

Bug#839037: warzone2100: D-Bug assertions when playing

2016-09-27 Thread Russell Coker
Package: warzone2100 Version: 3.2.1-1 Severity: normal When I launch warzone2100 from a terminal session I see the following errors on stdout/stderr. This is normally a bug in some application using the D-Bus library. process 28181: arguments to dbus_connection_unref() were incorrect, assertion

Bug#814248: more work done

2016-09-20 Thread Russell Coker
On Tuesday, 20 September 2016 1:37:41 PM AEST Markus Koschany wrote: > > I still think that a build-conflicts is the wrong option when you can make > > it build with both packages installed. My patch allows it to build > > regardles of any other packages installed. > > > > Why do you think that b

Bug#814248: more work done

2016-09-19 Thread Russell Coker
On Tuesday, 20 September 2016 1:55:14 AM AEST Markus Koschany wrote: > Confirmed. The same happens here on my machine. Unfortunately that's a > show-stopper. I think I will upload a new revision that Build-Conflicts > with automake and thus resolves #824011 and then I push my changes to > the SVN r

Bug#814248: more work done

2016-09-19 Thread Russell Coker
On Monday, 19 September 2016 8:01:03 PM AEST Markus Koschany wrote: > I have disabled the test suite to work around this issue. It probably > needs another CMake patch to fix this. I don't think it's a CMake issue as such, it's an issue of build flags for code relating to Qt libraries. If I knew

Bug#835910: warzone2100: FTBFS when newer automake is installed

2016-08-29 Thread Russell Coker
Package: warzone2100 Version: 3.1.1-3 Severity: serious Tags: upstream patch Justification: fails to build from source (but built successfully in the past) The warzone2100 build system insists on automake and aclocal version 1.11. If you have 1.15 installed it won't build. The following patch ma

Bug#814248: 3.2.0 is out

2016-08-27 Thread Russell Coker
On Wednesday, 24 August 2016 4:57:30 PM AEST Markus Koschany wrote: > yes, we are in dire need of active maintainers. > > The last thing that I remember about warzone2100 is that upstream's > source tarball doesn't ship "the preferred form for modification" for > all of its source files. I haven't

Bug#814248: 3.2.0 is out

2016-08-24 Thread Russell Coker
Version 3.2.0 has been released, could this be included for stretch? Is assistance needed in maintaining this package? -- My Main Blog http://etbe.coker.com.au/ My Documents Bloghttp://doc.coker.com.au/

Bug#834228: systemd: /run/utmp is created with the wrong SE Linux context

2016-08-13 Thread Russell Coker
Package: systemd Version: 231-1 Severity: normal Tags: upstream The file /run/utmp is created with the wrong type on SE Linux systems. The program that creates is should either run restorecon or have internal code to set the correct context (as most of systemd does). I think it's being created b

Bug#832331: libqpol1: doesn't give adequate information when there are conflicting type rules

2016-08-01 Thread Russell Coker
On Mon, 1 Aug 2016 11:03:38 PM Laurent Bigonville wrote: > Are you sure it's lib*q*pol1 and not libsepol1? > > Codesearch seems to tell me it's the later: > > https://codesearch.debian.net/search?q=Conflicting+type+rules I'm not sure. Sorry for the low quality bug report. I'm busy working on

<    1   2   3   4   5   6   7   8   9   10   >