Thankyou for your reply, and your patience in helping me "get up to speed" with SELinux.

I can live without X for this project, where we have to implement a root certification authority for a system using public key cryptography. I'm interested in using Linux for the registration service of the root CA, and SELinux appears to be ideal for this task. So, X is neither required, nor desirable if it bypasses the login choke-point.

I've applied the Makefile and stack patches you recommended, and edited the file_contexts as you suggested, but I'm still getting a variety of avc denied messages.

In reply to your questions:

1. My modified login does not work on my original SuSE (7.2 running a 2.4.4 kernel); I go through the motions of logging in, but just get returned to the login screen, as in SELinux.
2. The SuSE login uses PAM.
3. My /etc/security/default_context file is simply:

root:sysadm_r:sysadm_t
bishop:user_r:user_t

After running SELinux (no X), the following messages appear in /var/log/messages:

login: ROOT LOGIN ON tty1 USING root:sysadm_r:sysadm_t and
login: LOGIN ON tty1 BY bishop USING bishop:user_r:user_t

and after running SuSE 7.2, in runlevel 3 (no X), /var/log/messages contains

login: ROOT LOGIN ON tty1
and
login: LOGIN ON tty1 BY bishop

Looking through the login.c source, it appears to me that this message results from a successful login attempt. So either something goes wrong in forking the shell, or my code has a bug which just causes it to exit before normal completion (I'll just chuck in some printf's and see what happens...).

By the way, sshd is not working either, but that's not an issue right now.

Stephen Smalley wrote:

>On Fri, 5 Oct 2001, James Bishop wrote:
>
>>I had that feeling that it was too easy...
>>
>>When I boot selinux (or SuSE linux) into runlevel 3 (no X), I get the
>>login prompt, I enter username and password, and then answer the query
>>about choosing a new context (in selinux only). After replying "no", I'm
>>back at the login prompt again; not the shell prompt.
>>
>>So my modified login doesn't actually work - awareness dawns (somewhat
>>slowly). I had assumed that the same login binary was used for all
>>logins to the system, but apparently X, and / or Gnome, do things
>>differently. Is this really so?
>>
>
>Yes, the X Display Manager handles login separately from the login
>program. Likewise, sshd handles remote logins without ever running the
>login program.
>
>Does the modified login program still work when running the original SuSE
>kernel? It is supposed to function as usual when SELinux is not running.
>If it doesn't work on the SuSE kernel, then this suggests that your
>util-linux MCONFIG is wrong for SuSE. Does the SuSE login use PAM?
>
>If the modified login program does work when running the original SuSE
>kernel, then check /var/log/messages to see if there were any error
>messages from login. Did you remember to edit and install the
>/etc/security/default_context file?
>
>--
>Stephen D. Smalley, NAI Labs
>ssmalley@nai.com
>
>
>
>

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.