<html><body> I'm running the Beta Server 20061006.2 + updates.img + lspp.52 with MLS in enforcing mode on ppc64. I installed with netboot using the kickstart incarnation available last week. There was a problem with the relabel before reboot, which looks like a base policy problem. I had to boot with enforcing=0 initially to avoid init panicking the system. Once the filesystem was relabeled, I rebooted in enforcing without problems. I can even login, both console and ssh, in enforcing mode. Thanks, George Wilson IBM LTC Security Development <img width="16" height="16" src="cid:1__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt="Inactive hide details for Klaus Weidner <klaus@atsec.com>">Klaus Weidner <klaus@atsec.com> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr valign="top"><td style="background-image:url(cid:2__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com); background-repeat: no-repeat; " width="40%"> <ul> <ul> <ul> <ul>Klaus Weidner <klaus@atsec.com> Sent by: redhat-lspp-bounces@redhat.com 10/14/06 21:22</ul> </ul> </ul> </ul> </td><td width="60%"> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr valign="top"><td width="1%" valign="middle"><img width="58" height="1" src="cid:3__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt=""> <div align="right">To</div></td><td width="100%"><img width="1" height="1" src="cid:3__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt=""> redhat-lspp@redhat.com</td></tr> <tr valign="top"><td width="1%" valign="middle"><img width="58" height="1" src="cid:3__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt=""> <div align="right">cc</div></td><td width="100%"><img width="1" height="1" src="cid:3__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt=""> </td></tr> <tr valign="top"><td width="1%" valign="middle"><img width="58" height="1" src="cid:3__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt=""> <div align="right">Subject</div></td><td width="100%"><img width="1" height="1" src="cid:3__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt=""> [redhat-lspp] LSPP kickstart config v0.8 released</td></tr> </table> <table border="0" cellspacing="0" cellpadding="0"> <tr valign="top"><td width="58"><img width="1" height="1" src="cid:3__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt=""></td><td width="336"><img width="1" height="1" src="cid:3__=08BBF89BDFE9C6FE8f9e8a93df938@us.ibm.com" border="0" alt=""></td></tr> </table> </td></tr> </table> <tt>Here's a new version of the kickstart script that fixes some bugs in the previous version. Unfortunately, when used with the latest RHEL5 beta, it's still not possible to log in in enforcing mode, and no login at all via ssh even in nonenforcing mode. Audit and other logs aren't particularily helpful. At least it boots in enforcing mode now, which I guess is progress... Has anyone managed to use the RHEL5-Server-20061006.2 version (plus the updates floppy) in MLS enforcing mode successfully? Changes: local policy: Allow run_init_t to write faillog files KS postinstall script: Use numeric MLS labels when creating users, disable old workarounds: - Label translation doesn't work during the kickstart postinstall. Use s0-s15:c0.c1023 instead of SystemLow-SystemHigh instead. (Starting /etc/init.d/mcstrans didn't help, it hangs when translating labels.) - Remove the workaround that used a shell script to set MALLOC_CHECK_=0 for /sbin/init. It's not necessary for the current code. - Don't delete various 32bit packages on x86_64, just be resigned to having a bunch of unwanted and unused code on the system instead. RPM download: </tt><tt><a href="http://klaus.vh.swiftco.net/lspp/SRPMS/">http://klaus.vh.swiftco.net/lspp/SRPMS/</a></tt><tt> </tt><tt><a href="http://klaus.vh.swiftco.net/lspp/RPMS/noarch/">http://klaus.vh.swiftco.net/lspp/RPMS/noarch/</a></tt><tt> Git repository: </tt><tt><a href="http://klaus.vh.swiftco.net/lspp/git/">http://klaus.vh.swiftco.net/lspp/git/</a></tt><tt> -Klaus -- redhat-lspp mailing list redhat-lspp@redhat.com </tt><tt><a href="https://www.redhat.com/mailman/listinfo/redhat-lspp">https://www.redhat.com/mailman/listinfo/redhat-lspp</a></tt><tt> </tt> </body></html>