Hello Andras On 03/21/2011 11:47 PM, Horvath Andras wrote: > > > Traceback (most recent call last): > > File "./tomld.py", line 1316, in <module> > > d5 = os.readlink(d4) > > *OSError: [Errno 2] No such file or directory: '/proc/5113/fd/3' > > I've already fixed this in the recent version. Try v0.15. > I am running v0.15 and the issue was seen on this version.
> Thanks for the patch, i'll add it later, only i have to prepare to code > to make a difference between debian testing and stable, cause stable > still needs the linux-patch to be installed. > > BTW, good news testing's kernel has tomoyo, i didn't know that! > The current stable (Squeeze) also has tomoyo enabled in the kernel. > > Is there an equivalent of *setenforce* ? We should use something like > > that to easily switch it to learning mode until the user feels the > > full and final policy is ready. Another approach could be to run > > tomld right after init on first setup (during system start) in > > learning mode. That'll allow it to learn all services and other apps > > behavior and create the correct policy. > > All the access deny messages that you got are not supposed to happen. > Read my instructions here on the site from part "How to use": > http://log69.com/tomld_en.html > I think this section is where the problem is: - run it the 2nd time, now it will create domains for the processes automatically with learning mode - stop it now, cause the domains will stay in learning mode and the tomoyo module will collect all rules, even if the whole system is restarted When run the 2nd time, tomld runs in learning mode to create policies. This execution will typically happen from a desktop terminal. daemon's start-ups are not learnt by tomld at this stage. I just saw your videos. I guess the steps should be: * to switch to runlevel 1 (which will kill all processes) * Run tomld in screen * Switch to runlevel 2. (This will help all service rules to be learnt). * Stop when the user feels that he's done with almost all the tasks. > > * There should also be a '-u' switch which should allow addition of > > new learnt rules without discarding all the old rules. Or is it > > already there? > > This is all automatic and working already. The program should not > disturb already made rules. It will simply extend them. It even reduces > them. Hmmm!!! * Run tomld -c and run your apps * Stop it (It creates the first set of rules for all the apps). * Then I realized that I didn't trigger one core feature of one of the apps. * I again run tomld -c * The new rules are not added. What really happened on my box: * Ran tomld -c and ran ktorrent * Then ran apt-get upgrade which uninstalled ktorrent (the running version was still running) * tomoyo complained of "Invalid domain". * while tomld still running, re-installed ktorrent. * ktorrent was being restricted to access its data files. This is what I was able to pick-up from one of the domain policy files *<kernel> /usr/bin/ktorrent (deleted)* The other question I have is maybe more for tomoyo: allow_read/write /home/\*/.kde/share/apps/ktorrent/\* allow_unlink /home/\*/.kde/share/apps/ktorrent/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor0/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor1/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor2/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor24/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor25/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor26/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor27/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor3/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor30/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor31/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor4/\* allow_read /home/\*/.kde/share/apps/ktorrent/tor5/\* allow_read/write /home/\*/.kde/share/apps/ktorrent/tor6/\* allow_unlink /home/\*/.kde/share/apps/ktorrent/tor6/\* There are many more such entries. These are just data files. Why are these necessary to be part of domain policy ? What is more interesting is the following: allow_read/write /home/\*/.crypt/My_Data\* This is ktorrent's profile. Is it necessary to nick-pick each data file? Why I ask this is because the ktorrent failure I faced said that it couldn't write to one of the files inside My_Data/ folder. But the way I interpret this rules is that: *any inside home/?/.crypt/My_Data/ should be allowed r/w* Why an asterisk after /home/ ? Why did ktorrent fail? This is how the kernel deny looked: Mar 21 23:39:42 champaran kernel: [ 5582.664204] ERROR: Access read/write /home/rrs/.crypt/My_Data/MySecretData/SecretFile.txt denied for /usr/bin/ktorrent How does tomoyo deal when a file is deleted? In my case, ktorrent was purged and then later re-installed. Does purge on a file delete its domain policy ? Ritesh -- Ritesh Raj Sarraf RESEARCHUT - http://www.researchut.com "Necessity is the mother of invention."
signature.asc
Description: OpenPGP digital signature
_______________________________________________ tomoyo-users-en mailing list [email protected] http://lists.sourceforge.jp/mailman/listinfo/tomoyo-users-en
