Re: abnormal SELinux context labels

2016-06-22 Thread Bond Masuda
On 06/22/2016 11:54 AM, Stephen Smalley wrote: On 06/22/2016 02:05 PM, Bond Masuda wrote: I'm installing CentOS 7 in a chroot'd environment to build new images of CentOS 7 for a private cloud environment. I've done this successfully before with CentOS 6 (with help from this list) and we have a

Re: New rules on restrict kernel module loading

2016-06-22 Thread Stephen Smalley
On 06/22/2016 01:35 PM, Ravi Kumar wrote: > Hi team , > > I see some new changes both in kernel and sepolicy project on > restricting the load of kernel module . > > https://android-review.googlesource.com/#/c/213758/ -- kernel change on > check for moudle_load request by Jeff > https://an

Re: abnormal SELinux context labels

2016-06-22 Thread Stephen Smalley
On 06/22/2016 02:05 PM, Bond Masuda wrote: > I'm installing CentOS 7 in a chroot'd environment to build new images of > CentOS 7 for a private cloud environment. I've done this successfully > before with CentOS 6 (with help from this list) and we have an automated > process of doing that now. I'm n

Re: abnormal SELinux context labels

2016-06-22 Thread Bond Masuda
To add some more info, I did a search for SELinux labels that include "/" and found some more mislabels: # find . -context \*/\* ./etc/systemd/system ./usr/lib64 ./usr/local/lib64 ./run/lock # ls -lZd ./etc/systemd/system ./usr/lib64 ./usr/local/lib64/ ./run/lock drwxr-xr-x. 9 root root /usr/l

Re: sandbox - trying to use it / some bugs

2016-06-22 Thread Stephen Smalley
On 06/17/2016 04:54 PM, linseonn.20.md...@spamgourmet.com wrote: > There is a tool - sandbox - in policycoreutils. I wanted to use it > to provide a way to more safely possibly hostile files sent from > semi-"trusted" people. E.g. > >sandbox -X -i ~/myfile1.doc libreoffice ~/myfile1.doc >

Re: abnormal SELinux context labels

2016-06-22 Thread Bond Masuda
On 06/22/2016 11:30 AM, Simon Sekidde wrote: - Original Message - From: "Simon Sekidde" To: "Bond Masuda" Cc: selinux@tycho.nsa.gov Sent: Wednesday, June 22, 2016 2:22:18 PM Subject: Re: abnormal SELinux context labels - Original Message - From: "Bond Masuda" To: selinu

Re: abnormal SELinux context labels

2016-06-22 Thread Simon Sekidde
- Original Message - > From: "Simon Sekidde" > To: "Bond Masuda" > Cc: selinux@tycho.nsa.gov > Sent: Wednesday, June 22, 2016 2:22:18 PM > Subject: Re: abnormal SELinux context labels > > > > - Original Message - > > From: "Bond Masuda" > > To: selinux@tycho.nsa.gov > > Sent

Re: abnormal SELinux context labels

2016-06-22 Thread Bond Masuda
On 06/22/2016 11:22 AM, Simon Sekidde wrote: - Original Message - From: "Bond Masuda" To: selinux@tycho.nsa.gov Sent: Wednesday, June 22, 2016 2:05:17 PM Subject: abnormal SELinux context labels I'm installing CentOS 7 in a chroot'd environment to build new images of CentOS 7 for a

Re: abnormal SELinux context labels

2016-06-22 Thread Simon Sekidde
- Original Message - > From: "Bond Masuda" > To: selinux@tycho.nsa.gov > Sent: Wednesday, June 22, 2016 2:05:17 PM > Subject: abnormal SELinux context labels > > I'm installing CentOS 7 in a chroot'd environment to build new images of > CentOS 7 for a private cloud environment. I've don

abnormal SELinux context labels

2016-06-22 Thread Bond Masuda
I'm installing CentOS 7 in a chroot'd environment to build new images of CentOS 7 for a private cloud environment. I've done this successfully before with CentOS 6 (with help from this list) and we have an automated process of doing that now. I'm now porting our process to do similarly for Cent

New rules on restrict kernel module loading

2016-06-22 Thread Ravi Kumar
Hi team , I see some new changes both in kernel and sepolicy project on restricting the load of kernel module . https://android-review.googlesource.com/#/c/213758/ -- kernel change on check for moudle_load request by Jeff https://android-review.googlesource.com/#/c/214021/-- sepolicy change a