<html><body> Thanks very much, Matt, for both the patch and some review. I never intended the unnecessary restriction and dropped the ball on fixing it. Thanks, George Wilson IBM LTC Security Development <img width="16" height="16" src="cid:1__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt="Inactive hide details for Matt Anderson <mra@hp.com>">Matt Anderson <mra@hp.com> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr valign="top"><td style="background-image:url(cid:2__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com); background-repeat: no-repeat; " width="40%"> <ul> <ul> <ul> <ul>Matt Anderson <mra@hp.com> Sent by: redhat-lspp-bounces@redhat.com 05/16/07 18:52</ul> </ul> </ul> </ul> </td><td width="60%"> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr valign="top"><td width="1%" valign="middle"><img width="58" height="1" src="cid:3__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt=""> <div align="right">To</div></td><td width="100%"><img width="1" height="1" src="cid:3__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt=""> redhat-lspp@redhat.com</td></tr> <tr valign="top"><td width="1%" valign="middle"><img width="58" height="1" src="cid:3__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt=""> <div align="right">cc</div></td><td width="100%"><img width="1" height="1" src="cid:3__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt=""> </td></tr> <tr valign="top"><td width="1%" valign="middle"><img width="58" height="1" src="cid:3__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt=""> <div align="right">Subject</div></td><td width="100%"><img width="1" height="1" src="cid:3__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt=""> [redhat-lspp] rbac-self-test patches</td></tr> </table> <table border="0" cellspacing="0" cellpadding="0"> <tr valign="top"><td width="58"><img width="1" height="1" src="cid:3__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt=""></td><td width="336"><img width="1" height="1" src="cid:3__=09BBF84DDF8215DB8f9e8a93df938@us.ibm.com" border="0" alt=""></td></tr> </table> </td></tr> </table> <tt>>From running the rbac-self-test on different systems, and with a slightly different procedure I ran into some issues. Thanks to help from George and Klaus they were resolved. The main difference was I had been ssh'ing into the system as a user and using su to become root. This caused two problems; sysadm_devpts_t instead of sysadm_tty_t and my SElinux user was staff_u instead of root. Here are the patches that I needed in order to get things working for me. -matt diff --git a/rbac-self-test/rbac-self-test b/rbac-self-test/rbac-self-test index acdf59d..f01301c 100644 --- a/rbac-self-test/rbac-self-test +++ b/rbac-self-test/rbac-self-test @@ -74,13 +74,18 @@ class SelfTest: self.program_name = os.path.basename(sys.argv[0]) self.read = False self.write = True - self.SystemHigh = 'SystemHigh' - self.SystemLow = 'SystemLow' self.expectSuccess = False self.expectFailure = True self.success = True self.failure = False self.failure_action_performed = False + self.SystemHigh = 'SystemHigh' + self.SystemLow = 'SystemLow' + self.aide_type = 'aide_t' + self.program_type = 'rbacselftest_t' + self.helperprogram_type = 'rbacselftesthelper_t' + self.selinux_user = selinux.getcon()[1].split(':')[0] + self.selinux_role = selinux.getcon()[1].split(':')[1] return(None) # @@ -358,7 +363,8 @@ class SelfTest: if rc == 0: try: - rc = self.runcon("root:sysadm_r:aide_t:SystemHigh", '/usr/sbin/aide', '--init') + context = self.selinux_user + ':' + self.selinux_role + ':' + self.aide_type + ':' + self.SystemHigh + rc = self.runcon(context, '/usr/sbin/aide', '--init') except OSError, (oserrno, strerror): self.message_log('Cannot initialize AIDE database, errno = ' + str(oserrno) + ': ' + strerror) rc = oserrno @@ -397,7 +403,8 @@ class SelfTest: rc = 0 try: - rc = self.runcon("root:sysadm_r:aide_t:SystemHigh", '/usr/sbin/aide', '--check') + context = self.selinux_user + ':' + self.selinux_role + ':' + self.aide_type + ':' + self.SystemHigh + rc = self.runcon(context, '/usr/sbin/aide', '--check') except OSError, (oserrno, strerror): self.message_log('Cannot verify AIDE database, errno = ' + str(oserrno) + ': ' + strerror) rc = oserrno @@ -450,8 +457,8 @@ class SelfTest: rc = 0 - context1 = 'root:sysadm_r:rbacselftest_t:' + level1 - context2 = 'root:sysadm_r:rbacselftesthelper_t:' + level2 + context1 = self.selinux_user + ':' + self.selinux_role + ':' + self.program_type + ':' + level1 + context2 = self.selinux_user + ':' + self.selinux_role + ':' + self.helperprogram_type + ':' + level2 if write == True: testopname = 'write' diff --git a/rbac-self-test/policy/rbacselftest.te b/rbac-self-test/policy/rbacselftest.te index de77b1f..8ee7477 100644 --- a/rbac-self-test/policy/rbacselftest.te +++ b/rbac-self-test/policy/rbacselftest.te @@ -110,7 +110,7 @@ allow rbacselftest_t var_run_t:file { getattr setattr create read write }; # and more allow rbacselftest_t self:fd use; -allow rbacselftest_t self:process { noatsecure rlimitinh siginh }; +allow rbacselftest_t self:process { noatsecure rlimitinh setexec siginh }; allow rbacselftest_t sysadm_devpts_t:chr_file write; allow rbacselftest_t sysadm_tty_device_t:chr_file { read write }; @@ -140,9 +140,12 @@ allow rbacselftest_t rbacselftesthelper_t:process transition; allow rbacselftest_t rbacselftesthelper_t:process { noatsecure rlimitinh siginh }; allow rbacselftesthelper_t local_login_t:fd use; +allow rbacselftesthelper_t newrole_t:fd use; allow rbacselftesthelper_t rbacselftest_t:process sigchld; +allow rbacselftesthelper_t sysadm_devpts_t:chr_file { read write }; -allow rbacselftesthelper_t sysadm_tty_device_t:chr_file { read write }; +allow rbacselftesthelper_t sysadm_tty_device_t:chr_file { read write ioctl getattr }; allow rbacselftesthelper_t rbacselftest_t:fd use; +allow rbacselftesthelper_t rbacselftest_var_run_t:file { read write }; files_read_all_files(rbacselftesthelper_t) libs_use_shared_libs(rbacselftesthelper_t) -- redhat-lspp mailing list redhat-lspp@redhat.com </tt><tt><a href="https://www.redhat.com/mailman/listinfo/redhat-lspp">https://www.redhat.com/mailman/listinfo/redhat-lspp</a></tt><tt> </tt> </body></html>