| Summary: | tcp-wrappers SELinux polic'ed fails to compile! | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Alexander Ivanchev <alexander> |
| Component: | Hardened | Assignee: | Chris PeBenito (RETIRED) <pebenito> |
| Status: | RESOLVED FIXED | ||
| Severity: | major | CC: | chris, jens, wschlich |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | x86 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
Alexander Ivanchev
2004-04-20 05:08:37 UTC
*** Bug 48452 has been marked as a duplicate of this bug. *** I can't reproduce this. It doesn't make sense, either, because nothing touches /proc/self/attr/fscreate in config-check. I need more information: denials, enforcing or permissive, etc. Yes, I concur, it does NOT make any sense ;-) BUT, it happens... i tried
emerge -eD tcp-wrappers waited for 2 hours, and still... same thing happens
Enforcing is NOT set (z.e.r.o.), here go denials...
avc: denied { syslog_mod } for pid=859 exe=/usr/sbin/syslog-ng scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system
avc: denied { rmdir } for pid=2611 exe=/usr/bin/python2.3 name=temp dev=hda4 ino=32444 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:portage_tmp_t tclass=dir
avc: denied { unlink } for pid=2628 exe=/bin/rm name=tcp-wrappers-7.6-r8.ebuild dev=hda4 ino=32474 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:portage_ebuild_t tclass=file
I'm really stumped...
Additionally here's what happens when SELinux is disabled:
dmz root # emerge tcp-wrappers
!!! SELinux not loaded: SELinux is not enabled.
Calculating dependencies ...done!
>>> emerge (1 of 1) sys-apps/tcp-wrappers-7.6-r8 to /
>>> md5 src_uri ;-) tcp_wrappers_7.6.tar.gz
>>> md5 src_uri ;-) tcp-wrappers-7.6-r7-patches.tar.bz2
>>> Unpacking source...
>>> Unpacking tcp_wrappers_7.6.tar.gz to /var/tmp/portage/tcp-wrappers-7.6-r8/work
>>> Unpacking tcp-wrappers-7.6-r7-patches.tar.bz2 to /var/tmp/portage/tcp-wrappers-7.6-r8/work
* Applying tcp-wrappers-7.6-makefile.patch.bz2... [ ok ]
* Applying various patches (bugfixes/updates)...
* 01_all_redhat-bug11881.patch.bz2... [ ok ]
* 02_all_redhat-bug17795.patch.bz2... [ ok ]
* 03_all_wildcard.patch.bz2... [ ok ]
* 04_all_fixgethostbyname.patch.bz2... [ ok ]
* 07_all_sig.patch.bz2... [ ok ]
* 08_all_strerror.patch.bz2... [ ok ]
* Done with patching
* Applying tcp-wrappers-7.6-shared.patch.bz2... [ ok ]
>>> Source unpacked.
cp: setting attribute `security.selinux' for `build-info/tcp-wrappers-7.6-r8.ebuild': Invalid argument
make[1]: Entering directory `/var/tmp/portage/tcp-wrappers-7.6-r8/work/tcp_wrappers_7.6'
blah blah compile completes...
You're in system_u:system_r:kernel_t, which is not correct. Is your policy being loaded on boot? I can confirm the problem.
Trying to install Gentoo from the latest available SELinux LiveCD:
livecd-2004.0-x86-selinux-nostages-20040227.iso
and with stage1-x86-selinux-20040211.tar.bz2 using
/usr/portage/profiles/selinux/2004.1/x86. Bootstrap done using
bootstrap-cascade.sh (had to "emerge --nodeps portage" before because
it was too old for cascaded profiles :-/).
While doing "emerge system":
--8<--
* Applying tcp-wrappers-7.6-ipv6-1.14.diff.bz2... [ ok ]
>>> Source unpacked.
ipv6
make: *** [config-check] Error 1
!!! ERROR: sys-apps/tcp-wrappers-7.6-r8 failed.
!!! Function src_compile, Line 53, Exitcode 2
!!! (no error message)
--------------------------- ACCESS VIOLATION SUMMARY ---------------------------
LOG FILE = "/tmp/sandbox-sys-apps_-_tcp-wrappers-7.6-r8-14183.log"
open_wr: /proc/self/attr/fscreate
--------------------------------------------------------------------------------
--8<--
The LiveCD kernel (2.6.3-gentoo-r1-livecd) was booted in permissive (!) mode. Well, FEATURES="-sandbox" does the trick. Ok, figured this one out finally. Its a broken coreutils patch; I'll close when seemant gets the fixed one out. This should be fixed in coreutils-5.2.1-r1, which should hopefully be stable soon. *** Bug 58704 has been marked as a duplicate of this bug. *** *** Bug 70346 has been marked as a duplicate of this bug. *** Hi. Just want to let you know that I got the same issue here after updating my Portage tree. Following Wolfram Schlich's suggestion of FEATURES="-sandbox" solved the issue. Thanks, Jorge. hseahserv99 http-replicator # cat /usr/portage/metadata/timestamp Sun Sep 24 01:39:24 UTC 2006 hseahserv99 http-replicator # qlist -Iv coreutils sys-apps/coreutils-5.94-r1 sys-apps/policycoreutils-1.30-r1 hseahserv99 http-replicator # cat /var/log/sandbox/sandbox-sys-apps_-_tcp-wrappers-7.6-r8-15244.log open_wr: /proc/self/attr/fscreate (symlink to /proc/15267/attr/fscreate) open_wr: /proc/self/attr/fscreate (symlink to /proc/15282/attr/fscreate) I get no relevant info from /var/log/avc.log I'm willing to do some tests here if it helps. I can also update the tree again to use some new version and see if the error persists. *** Bug 175326 has been marked as a duplicate of this bug. *** a fix has been applied to the selinux profiles for a while. closing. |
