Skip top menus
National Security Agency and Central Security Service with agency logos.NSA/CSS Memorial Wall
Home    About NSA    Research    Business    Careers    Public Info    History
Introduction to Research    Security-Enhanced Linux    Information Assurance Research    Technology Transfer    Publications    Related Links

>>SELinux Mailing List: by thread

Search
What's new?
Contents
Overview
What's New
Frequently Asked Questions
Background
Documentation
License
Download
Participating
Mail List
Archive Summary
Archive by Thread
Archive by Author
Archive by Date
Archive by Subject
Remaining Work
Contributors
Related Work
Press Releases
  • Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ]
From: Howard Holm <hdholm_at_epoch.ncsc.mil>
subject: Updated release
Date: Tue, 16 Oct 2001 18:03:00 -0400 (EDT)
  • This message: [ Message body ]
  • Next message: Stephen Smalley: "Re: Updated release"
  • Previous message: James Bishop: "Re: Compiling for SuSE 7.2"
  • Next in thread: Stephen Smalley: "Re: Updated release"
  • Reply: Stephen Smalley: "Re: Updated release"


The SELinux web site <http://www.nsa.gov/selinux/> including the mail list archive has been updated. The site includes a new release of the LSM-based SELinux prototype. This release contains bug fixes and additional policy domains and permissions. The capability module may now be stacked with SELinux. The base for SELinux has been updated to the lsm-2001_10_11 patch against kernel 2.4.12.

--

Howard Holm <hdholm@epoch.ncsc.mil>
Secure Systems Research Office
National Security Agency

--

You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.

From: Stephen Smalley <sds_at_tislabs.com>
subject: Re: Updated release
Date: Wed, 17 Oct 2001 11:05:10 -0400 (EDT)
  • This message: [ Message body ]
  • Next message: J: "Re: Updated release"
  • Previous message: Howard Holm: "Updated release"
  • In reply to: Howard Holm: "Updated release"
  • Next in thread: J: "Re: Updated release"
  • Reply: J: "Re: Updated release"

A few additional notes about this release:

  1. A new run_init utility program and domain have been created to allow administrators to run the init scripts with the appropriate security context (e.g. to restart daemons) in a secure manner. This was requested by several SELinux users. See the updated README, utils/run_init, and utils/appconfig/initrc_context.
  2. Step 4 of the updated README discusses the issues in running X on SELinux, whether via startx after an ordinary login or via an X display manager like xdm, gdm, or kdm. You must uncomment certain allow statements in the policy to grant the X server the necessary permissions, as explained in the README. Mark Westerman's gdm policy has been merged into the example policy in order to ensure that it is consistent and kept up-to-date with the rest of the policy, but you will need to obtain his modified gdm program separately if you want to use gdm on SELinux.
  3. Download Options 4 and 5 were revised in response to the feedback from the Debian packagers. The SELinux kernel module is provided as a patch against the LSM kernel patch (which is identical to the lsm-2001_10_11 patch against 2.4.12 from lsm.immunix.org) rather than being part of the archive. The module Makefiles have been revised to ensure that the architecture-specific symbolic links are generated during the normal 'make dep'.

--

Stephen D. Smalley, NAI Labs
ssmalley@nai.com

--

You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.

From: J <jack_at_i2net.com>
subject: Re: Updated release
Date: 18 Oct 2001 02:11:15 -0700
  • This message: [ Message body ]
  • Next message: Stephen Smalley: "[PATCH] Bug fixes for non-PAM newrole and run_init (Was: Re: Updated release)"
  • Previous message: Stephen Smalley: "Re: Updated release"
  • In reply to: Stephen Smalley: "Re: Updated release"
  • Next in thread: Stephen Smalley: "[PATCH] Bug fixes for non-PAM newrole and run_init (Was: Re: Updated release)"
  • Reply: Stephen Smalley: "[PATCH] Bug fixes for non-PAM newrole and run_init (Was: Re: Updated release)"


On Wed, 2001-10-17 at 08:05, Stephen Smalley wrote:
>
> A few additional notes about this release:
>
> 1) A new run_init utility program and domain have been created to allow
> administrators to run the init scripts with the appropriate security
> context (e.g. to restart daemons) in a secure manner. This was requested
> by several SELinux users. See the updated README, utils/run_init, and
> utils/appconfig/initrc_context.

If you are not using PAM it didn't compile so I just moved #define CONTEXT_FILE .....
out of the ifdef PAM block. in run_init.c FYI.

Also newrole.c line 412 almost certanly has an error

I changed
if ( !authenticate_via_shadow_passwd(d p_passwd_line) ) { to
if ( !authenticate_via_shadow_passwd(p_passwd_line) ) {

Also, I have integrated this with a Slackware 8.0 filewall that is re-exporting nfs filesystems to samba for windows clients. It is also running dhcp. I have created iptables, dhcpd, and samba domains. I also had to change a huge amount of file_contexts. It is working fine as a production server. I am very pleased with selinux.

J

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
From: Stephen Smalley <sds_at_tislabs.com>
subject: [PATCH] Bug fixes for non-PAM newrole and run_init (Was: Re: Updated release)
Date: Thu, 18 Oct 2001 08:48:13 -0400 (EDT)
  • This message: [ Message body ]
  • Next message: James Bishop: "Patched SuSE 7.2 openssh-2.9p1 / Policy for SuSE 7.2?"
  • Previous message: J: "Re: Updated release"
  • In reply to: J: "Re: Updated release"

On 18 Oct 2001, J wrote:

> If you are not using PAM it didn't compile so I just moved
<snip>
> Also newrole.c line 412 almost certanly has an error
<snip>

Yes, sorry about that. The fixes for using run_init and newrole when not using PAM didn't make it in prior to cutting this release. The attached patch fixes these errors and makes a few other minor changes. To apply, save it to ~/shadow.patch, change to your selinux directory, and run 'patch -p1 < ~/shadow.patch'. This patch is relative to the sources in the release.

> Also, I have integrated this with a Slackware 8.0 filewall
> that is re-exporting nfs filesystems to samba for windows clients.
> It is also running dhcp. I have created iptables, dhcpd, and samba
> domains. I also had to change a huge amount of file_contexts. It is
> working fine as a production server. I am very pleased with selinux.

Glad to hear that SELinux is working well for you. If you are willing to share your policy customizations, we would be interested in seeing them. If they aren't too specific to your particular setup, we might roll them into the example policy in the distribution. Even if they are very specific to your setup, it might still be good to make them available for reference by others, perhaps on the sourceforge selinux project site.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com



-- You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.

  • TEXT/PLAIN attachment: shadow.patch
  • Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ]

This archive was generated by hypermail 2.2.0 on Wed 11 Jun 2008 - 08:10:54 EDT

Information Assurance | Signals & Intelligence        Links | Accessibility | Privacy & Security