Created attachment 419762 [details] Build log I have been running a testsystem with the last stable packages, systemd and SELINUX=permissive, SELINUXTYPE=targeted, since systemd did not work well with selinux. However, trying to upgrade to latest policies to try out the new systemd-support I get the following error, and all other policy-packages after this fail by the same problem. Downgrading and the install/merge-error disappears. >>> Original instance of package unmerged safely. * Inserting the following modules, with base, into the strict module store: application authlogin bootloader clock consoletype cron dmesg fstools getty hostname hotplug init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork tmpfiles udev userdomain usermanage unprivuser xdg The --base option is deprecated. Use --install instead. Failed to resolve typeattributeset statement at 181 of /var/lib/selinux/strict/tmp/modules/400/init/cil Failed to resolve ast semodule: Failed! * ERROR: sec-policy/selinux-base-policy-2.20141203-r10::gentoo failed (postinst phase): * Failed to load in base and modules application authlogin bootloader clock consoletype cron dmesg fstools getty hostname hotplug init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork tmpfiles udev userdomain usermanage unprivuser xdg in the strict policy store * * Call stack: * ebuild.sh, line 90: Called pkg_postinst * environment, line 1797: Called die * The specific snippet of code: * semodule -s ${i} -b base.pp ${COMMAND} || die "Failed to load in base and modules ${MODS} in the $i policy store"; * * If you need support, post the output of `emerge --info '=sec-policy/selinux-base-policy-2.20141203-r10::gentoo'`, * the complete build log and the output of `emerge -pqv '=sec-policy/selinux-base-policy-2.20141203-r10::gentoo'`. * The complete build log is located at '/var/log/portage/sec-policy:selinux-base-policy-2.20141203-r10:20151219-112444.log.gz'. * The ebuild environment file is located at '/var/tmp/portage/sec-policy/selinux-base-policy-2.20141203-r10/temp/environment'. * Working directory: '/usr/share/selinux/strict' * S: '/var/tmp/portage/sec-policy/selinux-base-policy-2.20141203-r10/work/' * FAILED postinst: 1 >>> Failed to execute postinst for sec-policy/selinux-base-policy-2.20141203-r10, Log file: >>> '/var/log/portage/sec-policy:selinux-base-policy-2.20141203-r10:20151219-112444.log.gz' liten ~ # emerge --info sec-policy/selinux-base-policy Portage 2.2.24 (python 2.7.10-final-0, hardened/linux/amd64/no-multilib/selinux, gcc-4.9.3, glibc-2.21-r1, 4.1.7-hardened-r1 x86_64) ================================================================= System Settings ================================================================= System uname: Linux-4.1.7-hardened-r1-x86_64-Intel-R-_Atom-TM-_CPU_C2550_@_2.41GHz-with-gentoo-2.2 KiB Mem: 16405772 total, 303444 free KiB Swap: 7811068 total, 7807348 free Timestamp of repository gentoo: Sat, 19 Dec 2015 01:00:01 +0000 sh bash 4.3_p39 ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1 ccache version 3.1.9 [disabled] app-shells/bash: 4.3_p39::gentoo dev-lang/perl: 5.20.2::gentoo dev-lang/python: 2.7.10-r1::gentoo, 3.4.3::gentoo dev-util/ccache: 3.1.9-r4::gentoo dev-util/cmake: 3.3.1-r1::gentoo dev-util/pkgconfig: 0.28-r2::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.18.4::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.13::gentoo, 2.69::gentoo sys-devel/automake: 1.11.6-r1::gentoo, 1.14.1::gentoo, 1.15::gentoo sys-devel/binutils: 2.25.1-r1::gentoo sys-devel/gcc: 4.9.3::gentoo sys-devel/gcc-config: 1.7.3::gentoo sys-devel/libtool: 2.4.6::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 3.18::gentoo (virtual/os-headers) sys-libs/glibc: 2.21-r1::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 Mine location: /var/overlays/mine masters: gentoo priority: 0 ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=native -mtune=native -ggdb" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.6/ext-active/ /etc/php/cgi-php5.6/ext-active/ /etc/php/cli-php5.6/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-O2 -pipe -march=native -mtune=native -ggdb" DISTDIR="/usr/portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs buildpkg clean-logs compress-build-logs compressdebug config-protect-if-modified distlocks ebuild-locks fail-clean fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox selinux sesandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-O1 -Wl,--sort-common -Wl,--hash-style=gnu" MAKEOPTS="-j5" PKGDIR="/usr/portage/packages" PORTAGE_COMPRESS="xz" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" USE="acl acpi amd64 audit avahi bash-completion berkdb bzip2 caps city cli cpumining cracklib crypt curl cxx dbus device-mapper dri fam firewalld ftp gcrypt gd gdbm geoip gmp gudev hardened hwdb iconv idn ipv6 isc jpeg jpeg2k justify kerberos ldap lm_sensors logwatch lto lvm lz4 lzma lzo macvtap magic mbox mmx mmxext modules ncurses netlink nfs nfsdcld nfsidmap nfsv41 nls nptl offensive open_perms openldap openmp pam parted pax_kernel pcap pcre pgo pie png policykit qemu readline rpc scrypt seccomp selinux sensord session soap spice sse sse2 ssl ssp svg syslog systemd tcpd threads tiff tls tproxy transmission tty-helpers udev unconfined unicode urandom usb usbredir virt-network xattr xinetd xtpax zip zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="efi-64" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="sv" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4" QEMU_SOFTMMU_TARGETS="i386 x86_64 arm" RUBY_TARGETS="ruby20 ruby21" SANE_BACKENDS="niash" USERLAND="GNU" VIDEO_CARDS="fbdev glint intel mach64 mga nouveau nv r128 radeon savage sis tdfx trident vesa via vmware dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON ================================================================= Package Settings ================================================================= sec-policy/selinux-base-policy-2.20141203-r10::gentoo was built with the following: USE="unconfined" # emerge -pqv '=sec-policy/selinux-base-policy-2.20141203-r10::gentoo' [ebuild R ] sec-policy/selinux-base-policy-2.20141203-r10 USE="unconfined"
you're doing this upgrade in permissive mode still right? What happens if you do: cd /usr/share/selinux/targeted/ semodule -i *.pp
(In reply to Jason Zaman from comment #1) > you're doing this upgrade in permissive mode still right? > > What happens if you do: > cd /usr/share/selinux/targeted/ > semodule -i *.pp As commented: permissive, targeted. liten xake # cd /usr/share/selinux/targeted/ liten targeted # semodule -i *.pp Failed to resolve typeattributeset statement at 181 of /var/lib/selinux/targeted/tmp/modules/400/init/cil Failed to resolve ast semodule: Failed!
(In reply to Xake from comment #2) > liten xake # cd /usr/share/selinux/targeted/ > liten targeted # semodule -i *.pp > Failed to resolve typeattributeset statement at 181 of > /var/lib/selinux/targeted/tmp/modules/400/init/cil > Failed to resolve ast > semodule: Failed! What is on line 181? /var/lib/selinux/targeted/tmp/modules/400/init/cil will probably be gone so you can re-generate it with: /usr/libexec/selinux/hll/pp init.pp
Created attachment 420198 [details] Output from pp init.pp (typeattributeset cil_gen_require systemd_kmod_conf_t) If I read the output (attached) correctly.
It turned out to be a missing ebuild. After I created sec-policy/selinux-systemd and merged that all the error messages went away. So please add that ebuild to portage and make systemd depend on it when selinux is enabled.
(In reply to Xake from comment #5) > It turned out to be a missing ebuild. > After I created sec-policy/selinux-systemd and merged that all the error > messages went away. > > So please add that ebuild to portage and make systemd depend on it when > selinux is enabled. I tried this, but still get the following error: * Inserting the following modules into the strict module store: systemd Failed to resolve typeattributeset statement at 173 of /var/lib/selinux/strict/tmp/modules/400/systemd/cil Failed to resolve ast semodule: Failed! * SELinux module load failed. Trying full reload... The --base option is deprecated. Use --install instead. Failed to resolve typeattributeset statement at 39 of /var/lib/selinux/strict/tmp/modules/400/subsonic/cil Failed to resolve ast semodule: Failed! I created a simple selinux-systemd ebuild: # cat local/sec-policy/selinux-systemd/selinux-systemd-2.20141203-r10.ebuild # Copyright 1999-2015 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 # $Id$ EAPI="5" IUSE="" MODS="systemd" inherit selinux-policy-2 DESCRIPTION="SELinux policy for systemd" if [[ $PV == 9999* ]] ; then KEYWORDS="" else KEYWORDS="amd64 x86" fi And modified the systemd ebuild: # diff -u gentoo/sys-apps/systemd/systemd-226-r2.ebuild local/sys-apps/systemd/systemd-226-r2.ebuild --- gentoo/sys-apps/systemd/systemd-226-r2.ebuild 2016-01-10 12:31:02.000000000 +0100 +++ local/sys-apps/systemd/systemd-226-r2.ebuild 2016-01-11 17:32:10.350851484 +0100 @@ -54,7 +54,11 @@ pam? ( virtual/pam:= ) qrcode? ( media-gfx/qrencode:0= ) seccomp? ( sys-libs/libseccomp:0= ) - selinux? ( sys-libs/libselinux:0= ) + selinux? ( + sys-libs/libselinux:0= + sys-libs/libsepol:0= + sec-policy/selinux-systemd + ) sysv-utils? ( !sys-apps/systemd-sysv-utils !sys-apps/sysvinit ) Xake: How did you do this?
$ cat sec-policy/selinux-systemd/selinux-systemd-2.20141203-r10.ebuild # Copyright 1999-2015 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 # $Id$ EAPI="5" IUSE="" MODS="systemd" inherit selinux-policy-2 DESCRIPTION="SELinux policy for openrc" if [[ $PV == 9999* ]] ; then KEYWORDS="" else KEYWORDS="amd64 x86" fi ----------------------- After merging that and all other updates for sec-policy everything just started to work. $ qlist selinux-systemd /usr/share/selinux/strict/systemd.pp /usr/share/selinux/targeted/systemd.pp What do you get?
(In reply to Xake from comment #7) > $ qlist selinux-systemd > /usr/share/selinux/strict/systemd.pp > /usr/share/selinux/targeted/systemd.pp > > What do you get? # q list selinux-systemd /usr/share/selinux/strict/systemd.pp /usr/share/selinux/targeted/systemd.pp I did as the selinux-policy-2.eclass einfo told me and ran: # semodule -b base.pp -i $(ls *.pp | grep -v base.pp) The --base option is deprecated. Use --install instead. Failed to resolve typeattributeset statement at 39 of /var/lib/selinux/strict/tmp/modules/400/subsonic/cil Failed to resolve ast semodule: Failed! Since /var/lib/selinux/strict/tmp/modules/400/subsonic/cil does not exist, I did as suggested in comment #3 and ran: # /usr/libexec/selinux/hll/pp init.pp Line 39 of that is: (typeattributeset init_script_domain_type (initrc_t )) Random guess: Xake, do you have sec-policy/selinux-openrc installed?
(In reply to Dennis Schridde from comment #8) > Random guess: Xake, do you have sec-policy/selinux-openrc installed? Yes. I have not blocked out openrc, but let it install as the default says, and it also installs that policy.
Created attachment 422754 [details] init.cil (In reply to Dennis Schridde from comment #8) > Line 39 of that is: > (typeattributeset init_script_domain_type (initrc_t )) > > Random guess: Xake, do you have sec-policy/selinux-openrc installed? I have no idea how these policy files work, but a few lines later there is: (type initrc_t) So maybe it's just in the wrong order?
# q file subsonic.pp sec-policy/selinux-cgmanager (/usr/share/selinux/targeted/subsonic.pp)
Created attachment 422756 [details] subsonic.cil My bad... I was looking at the wrong policy file... This time I ran: # /usr/libexec/selinux/hll/pp subsonic.pp Line 39 of that is: (typeattributeset cil_gen_require java_domain)
(In reply to Dennis Schridde from comment #11) > # q file subsonic.pp > sec-policy/selinux-cgmanager (/usr/share/selinux/targeted/subsonic.pp) yeah, that was my bad. its fixed in the tree, just re-emerge it.
(In reply to Dennis Schridde from comment #6) > (In reply to Xake from comment #5) > > So please add that ebuild to portage and make systemd depend on it when > > selinux is enabled. > > I tried this, but still get the following error: > I created a simple selinux-systemd ebuild: This wont work as-is unfortunately. The init.pp modules depends on a systemd type. the call to the systemd interface needs to be inside an optional_policy() block. the problem is it tries to re-load init.pp and there is no systemd type and then later the selinux-systemd package tries to load systemd.pp and the types from init are missing. you should be able to load both together for now. cd /usr/share/selinux/strict/; semodule -i init.pp systemd.pp I need to send a patch upstream so they can be loaded separately before I can add the selinux-systemd policy package. I will send it in the next week or so, I have unfortunately been fairly busy. till then, loading them manually together the first time should work.
I can confirm this too. That's a bit unfortunate. I take it that you can't just have the ebuild postinstall do the loading?
The optional_policy() bit to fix this is merged into the repo now and I added sec-policy/selinux-systemd to the tree (only -9999 for now)
in ~arch
stable
