When I did make install in module, it did not complete successfully because the makefile expected a directory to be named
/usr/src/selinux/module/selinux_plug/include/asm
and it was really
/usr/src/selinux/module/selinux_plug/include/asm-i386
When I moved asm-i386 to asm it worked and I was able to boot selinux.
Having done so, I received the following messages:
avc: denied { mounton } for pid=75 exe=/bin/mount path=/bus/usb dev=00:03 ino=4459
scontext=system_u:system_r:mount_t
tcontext=system_u:object_r:proc_t
tclass=dir
task_precondition: assigning context system_u:system_r:init_t to pid 2 exe=none
usb-uhci.c: v1.268:USB Universal Host Controller Interface driver
avc: denied { search } for pid=93 exe=/bin/cat dev=00:08 ino=1
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:unlabeled_t
tclass=dir
avc: denied { read } for pid=93 exe=/bin/cat path=/devices dev=00:08 ino=2
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:unlabeled_t
tclass=file
avc: denied { getattr } for pid=93 exe=/bin/cat path=/devices dev=00:08 ino=2
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:unlabeled_t
tclass=file
avc: denied { write } for pid=10 exe=/bin/bash path=/etc/mtab dev=03:01 ino=28440
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:file_t
tclass=file
(many times)
.................
avc: denied { create } for pid=296 exe=/sbin/ipchains
scontext=system_u:system_r:initrc_t
tcontext=system_u:system_r:initrc_t
tclass=rawip_socket
avc: denied { setopt } for pid=296 exe=/sbin/ipchains lport=255
scontext=system_u:system_r:initrc_t
tcontext=system_u:system_r:initrc_t
tclass=rawip_socket
avc: denied { unlink } for pid=752 exe=/bin/umount path=/etc/mtab dev=03:01 ino=28440
scontext=system_u:system_r:mount_t
tcontext=system_u:object_r:file_t
tclass=file
avc: denied { search } for pid=838 exe=/usr/sbin/httpd path=/www/tomcat dev=03:05 ino=336750
scontext=system_u:system_r:httpd_t
tcontext=system_u:object_r:httpd_user_script_rw_t
tclass=dir
(plus many messages connected with running the Gnome desktop)
-- -- You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.From: Stephen Smalley <sds_at_tislabs.com>
On 27 Nov 2001, Justin Smith wrote:
> When I did make install in module, it did not complete successfully
> because the makefile expected a directory to be named
<snip>
> When I moved asm-i386 to asm it worked and I was able to boot
> selinux.
include/asm and arch/machine are created by the 'make dep' in the BUILDING instructions. They are symbolic links that are automatically set to refer to the appropriate architecture. Of course, at present, we only support x86, but by using these symbolic links, we make it easier to add support for other architectures in the future. I'm not sure why your include/asm link was not set by the time you did the 'make install' in the module directory unless you did a 'make clean'.
> Having done so, I received the following messages:
>
> avc: denied { mounton } for pid=75 exe=/bin/mount path=/bus/usb
> dev=00:03 ino=4459
> scontext=system_u:system_r:mount_t
> tcontext=system_u:object_r:proc_t
> tclass=dir
Ok, so you are mounting another filesystem under /proc. Add a 'allow mount_t proc_t:dir mounton;' rule to policy/domains/system/mount.te.
> avc: denied { search } for pid=93 exe=/bin/cat dev=00:08 ino=1
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:unlabeled_t
> tclass=dir
>
> avc: denied { read } for pid=93 exe=/bin/cat path=/devices dev=00:08
> ino=2
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:unlabeled_t
> tclass=file
>
> avc: denied { getattr } for pid=93 exe=/bin/cat path=/devices
> dev=00:08 ino=2
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:unlabeled_t
> tclass=file
This indicates that you are using a filesystem type that isn't recognized by SELinux, so it is left unlabeled. This is most likely some kind of pseudo filesystem type, like usbdevfs. The handling for each pseudo filesystem type is specialized to provide reasonable security semantics for that type. At present, SELinux defines labeling behaviors for procfs, devpts, tmpfs and devfs. I haven't used usbdevfs or looked at its implementation, so I don't know whether it should just use the same labeling behavior as devfs or not.
> avc: denied { write } for pid=10 exe=/bin/bash path=/etc/mtab
> dev=03:01 ino=28440
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:object_r:file_t
> tclass=file
This is typical on the first boot of the SELinux kernel. Run setfiles again, as recommended by step 15 of the README.
> avc: denied { create } for pid=296 exe=/sbin/ipchains
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:system_r:initrc_t
> tclass=rawip_socket
>
> avc: denied { setopt } for pid=296 exe=/sbin/ipchains lport=255
> scontext=system_u:system_r:initrc_t
> tcontext=system_u:system_r:initrc_t
> tclass=rawip_socket
Ok, so you either need to grant these permissions to initrc_t if you want to allow this to run, or you need to define a separate domain for ipchains that can do this.
> avc: denied { search } for pid=838 exe=/usr/sbin/httpd
> path=/www/tomcat dev=03:05 ino=336750
> scontext=system_u:system_r:httpd_t
> tcontext=system_u:object_r:httpd_user_script_rw_t
> tclass=dir
I'm not sure why httpd_t doesn't have this permission. You can certainly add it.
> (plus many messages connected with running the Gnome desktop)
Did you follow the instructions in step 4 prior to trying to run GNOME?
-- Stephen D. Smalley, NAI Labs ssmalley@nai.com -- You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.
This archive was generated by hypermail 2.2.0 on Wed 11 Jun 2008 - 08:10:54 EDT