Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing ListRe: Label Translation on Fedora 9
From: Daniel J Walsh <dwalsh_at_redhat.com>
Date: Mon, 03 Nov 2008 15:34:33 -0500
Paul Moore wrote: > On Monday 03 November 2008 8:51:49 am Stephen Smalley wrote: >> On Mon, 2008-11-03 at 14:47 +0100, Andy Warner wrote: >>> Stephen Smalley wrote: >>>> On Mon, 2008-11-03 at 12:49 +0100, Andy Warner wrote: >>>>> I am running Fedora 9 with the MLS policy and see no evidence >>>>> that the label translation is enabled. I am using the default >>>>> setrans.conf and the "disable=1" flag is commented out. >>>>> >>>>> Using the selinux_trans_to_raw (e.g., with a SystemHigh level) >>>>> produces the exact same label string as passed in which will >>>>> not pass validation (using s15:c0.c1023 will pass validation). >>>>> >>>>> Trying id-Z followed by newrole produces: >>>>> id -Z >>>>> warner_u:secadm_r:secadm_t:s0-s15:c0.c1023 >>>>> >>>>> newrole -l SystemLow-SystemHigh >>>>> warner_u:secadm_r:secadm_t:SystemLow-SystemHigh is not a valid >>>>> context >>>>> >>>>> Is there something that must be done to activate label >>>>> translation? >>>> Label translation is provided by a daemon, mcstrans. >>>> >>>> yum install mcstrans >>>> /sbin/chkconfig mcstrans on >>>> /sbin/service mcstrans start >>> Thanks. I was not starting the mcstrans service. When I get a >>> translation, it seems odd as follows. >>> >>> without mcstrans: >>> id -Z >>> warner_u:secadm_r:secadm_t:s0-s15:c0.c1023 >>> >>> with mcstrans: >>> id -Z >>> warner_u:secadm_r:secadm_t:SystemLow:SystemLow-SystemHigh >>> >>> Is it expected to have the high end of the range expressed as a >>> range? The translation table has the following relevant entries: >>> s0 SystemLow >>> s0-s15:c0.c1023 SystemLow-SystemHigh >> No, that looks wrong to me as well. cc'ing Dan Walsh of Red Hat, who >> maintains mcstrans. >> >> BTW, if you are looking for more complete MLS label translation >> support, you might try the extended mcstrans posted by Joe Nall. > > What is the status of the patch? I vaguely remember a little bit of > discussion/review about the patch but it's not clear to me if it was > ever accepted into upstream/Fedora and if it wasn't what the next steps > were going to be ... > Good question, we have let this slip through the cracks. I would like to replace my library totally with Joe's. The only concern would be to allow people who used my format to convert to the new format if possible or at least document how to do this.
-----BEGIN PGP SIGNATURE-----
iEYEARECAAYFAkkPYFkACgkQrlYvE4MpobOZRQCfbG2Nk+8sRypiJgSjIATHqLeI
jz4An3xTcOjf4ZJpwP2j0PtnM+bPRrR7
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Mon 3 Nov 2008 - 15:34:48 EST |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |