selinux January 2011 archive
Main Archive Page > Month Archives  > selinux archives
selinux: Re: [refpolicy] WARNING: at kernel/printk.c:430 do_sysl

Re: [refpolicy] WARNING: at kernel/printk.c:430 do_syslog+0x40d/0x441()

From: Justin P. Mattock <justinmattock_at_nospam>
Date: Mon Jan 24 2011 - 19:34:00 GMT
To: "Christopher J. PeBenito" <cpebenito@tresys.com>

On 01/24/11 11:30, Justin P. Mattock wrote:
> On 01/19/11 11:30, Justin P. Mattock wrote:
>> On 01/19/11 11:23, Christopher J. PeBenito wrote:
>>> On 01/19/11 13:06, Justin P. Mattock wrote:
>>>> this is showing up with the latest kernel in enforcing mode..
>>>> (I have not update the policy and/or selinux userspace)
>>>>
>>>> [ 12.803882] type=1400 audit(1295457694.801:3): avc: denied { syslog
>>>> } for pid=1540 comm="rsyslogd" capability=34
>>>> scontext=system_u:system_r:init_t:s0
>>>> tcontext=system_u:system_r:init_t:s0 tclass=capability2
>>> [cut]
>>>> when using audit2allow I get:
>>>>
>>>> allow init_t self:capability2 syslog;
>>>>
>>>> which gives an error when trying to install the module, due to the
>>>> policy not knowing what capability2 is
>>>>
>>>> system is ubuntu maverick, if this is already in(refpolicy) then I'll
>>>> pull the latest when I get a chance..
>>>
>>> Support for this capability is upstream in refpolicy.
>>>
>>
>
>
> well... after building and trying to install, seems I need to do this:
>
> From dae5d4d75ab5db99fde09a67f9a1df240f85fbdd Mon Sep 17 00:00:00 2001
> From: Justin P. Mattock <justinmattock@gmail.com>
> Date: Mon, 24 Jan 2011 11:13:31 -0800
> Subject: [PATCH] modified: policy/modules/kernel/domain.te
>
> Signed-off-by: Justin P. Mattock <justinmattock@gmail.com>
>
>
> diff --git a/policy/modules/kernel/domain.te
> b/policy/modules/kernel/domain.te
> index bc534c1..77c363b 100644
> --- a/policy/modules/kernel/domain.te
> +++ b/policy/modules/kernel/domain.te
> @@ -24,7 +24,8 @@ attribute unconfined_domain_type;
>
> # Domains that can mmap low memory.
> attribute mmap_low_domain_type;
> -neverallow { domain -mmap_low_domain_type } self:memprotect mmap_zero;
> +#neverallow { domain -mmap_low_domain_type } self:memprotect mmap_zero;
>
> # Domains that can set their current context
> # (perform dynamic transitions)

Oops.. forgot to post the error:

pp -i /usr/share/selinux/mcs/xprint.pp -i
/usr/share/selinux/mcs/xscreensaver.pp -i
/usr/share/selinux/mcs/xserver.pp -i /usr/share/selinux/mcs/yam.pp -i
/usr/share/selinux/mcs/zabbix.pp -i /usr/share/selinux/mcs/zebra.pp -i
/usr/share/selinux/mcs/zosremote.pp
libsepol.check_assertion_helper: neverallow violated by allow apmd_t
apmd_t:memprotect { mmap_zero };
libsemanage.semanage_expand_sandbox: Expand module failed
/usr/sbin/semodule: Failed!
make: *** [load] Error 1

Justin P. Mattock

-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.