seedit-devel Mailing List for SELinux Policy Editor

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

Hi.

On Tue, 29 Apr 2008 16:38:29 +0530
"shaunak saha" <rea...@gm...> wrote:

> Hi ,
> 
> I m trying to run an application in an arm target. I m following the
> directions given here.
>  http://seedit.svn.sourceforge.net/svnroot/seedit/trunk/README.cross
> 
> My root filesystem inside the target is cramfs and the application i m
> trying to execute is in ext3 filesystem which is mounted in a directory in
> root filesystem.
> When i try to execute the eapplication it givving me all this avc denied
> arror
> 
> *audit(56.939:5): avc:  denied  { read write } for  pid=362
> comm="selinux_arm" na
> me="ttyS0" dev=tmpfs ino=412 scontext=system_u:system_r:selinux_arm_t
> tcontext=s
> ystem_u:object_r:unlabeled_t tclass=chr_file
> audit(56.970:6): avc:  denied  { search } for  pid=362 comm="selinux_arm"
> name="
> /" dev=mtdblock2 ino=76 scontext=system_u:system_r:selinux_arm_t
> tcontext=system
> _u:object_r:unlabeled_t tclass=dir
> audit(56.979:7): avc:  denied  { read } for  pid=362 comm="selinux_arm"
> name="ld
> .so.cache" dev=mtdblock2 ino=253124 scontext=system_u:system_r:selinux_arm_t
> tco
> ntext=system_u:object_r:unlabeled_t tclass=lnk_file
> audit(56.999:8): avc:  denied  { search } for  pid=362 comm="selinux_arm"
> name="
> /" dev=mtdblock4 ino=2 scontext=system_u:system_r:selinux_arm_t
> tcontext=system_
> u:object_r:dir_opt_xocean_t tclass=dir
> audit(57.020:9): avc:  denied  { read } for  pid=362 comm="selinux_arm"
> name="li
> bc-2.5.so" dev=mtdblock2 ino=1063684
> scontext=system_u:system_r:selinux_arm_t tc
> ontext=system_u:object_r:unlabeled_t tclass=file
> audit(57.040:10): avc:  denied  { execute } for  pid=362 comm="selinux_arm"
> name
> ="libc-2.5.so" dev=mtdblock2 ino=1063684
> scontext=system_u:system_r:selinux_arm_
> t tcontext=system_u:object_r:unlabeled_t tclass=file
> audit(57.059:11): avc:  denied  { write } for  pid=362 comm="selinux_arm"
> name="
> test.txt" dev=mtdblock4 ino=14 scontext=system_u:system_r:selinux_arm_t
> tcontext
> =system_u:object_r:opt_xocean_testdtxt_t tclass=file
> audit(57.080:12): avc:  denied  { ioctl } for  pid=362 comm="selinux_arm"
> name="
> console" dev=mtdblock2 ino=1 scontext=system_u:system_r:selinux_arm_t
> tcontext=s
> ystem_u:object_r:unlabeled_t tclass=chr_file*
> **
> For the application i m creating the policy in host usding sedit and then
> copying the whole policy_root directory in the /etc/selinux/seedit in the
> root filesystem.
> 
> My root filesystem is flashed in /dev/mtd2 and ext3 files in /dev/mtd4
> ls  -Z in root filesystem shows that all the directories except /dev
> ,/selinux ,/proc and /sys  are labeled as *romfs_t*.
> 
> Please help.

It seems that /opt is mounted as ext3, 
and files under /opt is labeled properly.

However, files under /dev are not labeled properly.
You may have to 
restorecon -R /dev 
at boot time(in rc.sysinit).

And can you tell me the full path of "console" and "libc-2.5.so" 
and can you try ls -Z for them?

They are  "unlabeled_t" for some reason, 
I want to find  why.

> 
> Regards,
> Shaunak
> 
> 
> 
> On Thu, Mar 20, 2008 at 9:31 AM, shaunak saha <rea...@gm...>
> wrote:
> 
> > Hi all,
> >
> > I m able to remove the "undefined reference" error now. I found some info
> > about how to remove this here :
> >
> > http://www.nsa.gov/selinux/list-archive/0708/22031.cfm and followed it.So
> > it is gone now.
> >
> > I removed -z,defs from the src/Makefile.But i dont know the consequences
> > of this.
> >
> > Thanks and Regards,
> > Shaunak
> >
> >   On Wed, Mar 19, 2008 at 6:22 PM, shaunak saha <rea...@gm...>
> > wrote:
> >
> > >
> > > Hi,
> > >
> > > Many thanks.Its now working.I have taken libselinux version
> > > 2.0.59.Previously it was 1.34.15.
> > >
> > > but now I m getting one more problem.
> > >
> > > *matchpathcon.lo: In function `add_array_elt':
> > > matchpathcon.c:(.text+0x20): undefined reference to `__tls_get_addr'
> > > matchpathcon.c:(.text+0x44): undefined reference to `__tls_get_addr'
> > > matchpathcon.c:(.text+0x60): undefined reference to `__tls_get_addr'
> > > matchpathcon.c:(.text+0x78): undefined reference to `__tls_get_addr'
> > > matchpathcon.c:(.text+0x90): undefined reference to `__tls_get_addr'
> > > matchpathcon.lo:matchpathcon.c:(.text+0xc0): more undefined references
> > > to `__tls_get_addr' follow
> > > collect2: ld returned 1 exit status
> > > *
> > > **
> > > This maybe  my problem with not setting the environment properly for my
> > > cross compiler toolchain.I m not sure about that.Just asked if anyone faced
> > > this problem before and know the silution for this.
> > >
> > > Thanks and Regards,
> > > Shaunak
> > >
> > >   On Wed, Mar 19, 2008 at 1:52 PM, Yuichi Nakamura <
> > > yn...@hi...> wrote:
> > >
> > > > Hi.
> > > >
> > > > On Wed, 19 Mar 2008 13:33:33 +0530
> > > > "shaunak saha" wrote:
> > > > > Hi all,
> > > > >
> > > > > This is shaunak. I m new to selinux.Trying to learn it .I found
> > > > seedit a
> > > > > very nice tool.Using it i m able to frame a policy for a sample
> > > > > client-server application.Now i want that application to be executed
> > > > on an
> > > > > arm board.So i m trying to build libselinux for arm.I got the
> > > > toolchain for
> > > > > my board.I used this command to build libselinux:
> > > > > make ARCH=<your arch> CC=<your cross compiler> CFLAGS=-D__thread=
> > > > > where in my arch i gave arm and in CC the path of my cross compiler.
> > > > > Is this command right?
> > > > > It gives this error after sometime.
> > > > >
> > > > > *cannot find -lsepol
> > > > > collect2: ld returned 1 exit status
> > > > > make[1]: *** [libselinux.so.1] Error 1*
> > > > > **
> > > > > Now do i have to cross compile libsepol?
> > > > It depends on version of libselinux.
> > > > If you use libselinux 2.0.35 or later,
> > > > you do not have to cross-compile libsepol,
> > > > but you have to pass
> > > > EMBEDDED=y like below.
> > > > make ARCH=<your arch> CC=<your cross compiler> CFLAGS=-D__thread=
> > > > EMBEDDED=y
> > > > See:
> > > > http://marc.info/?l=selinux&m=118064545200576&w=2
> > > >
> > > > But you have to cross compile libsepol if you use BusyBox.
> > > > BusyBox requires libsepol on build time.
> > > > # You do not have to copy libsepol to board.
> > > > Cross compiling libsepol is easy.
> > > > make CC=<your cross compiler>
> > > >
> > > > > Is there any good document available which will tell how to compile
> > > > > libselinux for arm?
> > > > Here is patch list:
> > > > http://elinux.org/SELinux
> > > > but not enough documentation.
> > > > I will modify README.cross.
> > > >
> > > > And I am going to give talk about Embeded SELinux in US.
> > > > http://embeddedlinuxconference.com/elc2008/index.html
> > > >
> > > > >
> > > > > Thanks and Regards
> > > > > Shaunak
> > > > > *
> > > > > *
> > > >
> > > > --
> > > > Yuichi Nakamura
> > > > Hitachi Software Engineering Co., Ltd.
> > > > Japan SELinux Users Group(JSELUG): http://www.selinux.gr.jp/
> > > > SELinux Policy Editor: http://seedit.sourceforge.net/
> > > >
> > > >
> > > >
> > > > -------------------------------------------------------------------------
> > > > This SF.net email is sponsored by: Microsoft
> > > > Defy all challenges. Microsoft(R) Visual Studio 2008.
> > > > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> > > > _______________________________________________
> > > > Seedit-devel mailing list
> > > > See...@li...
> > > > https://lists.sourceforge.net/lists/listinfo/seedit-devel
> > > >
> > >
> > >
> >
> 

2005	Jan	Feb	Mar	Apr	May	Jun (2)	Jul	Aug	Sep	Oct	Nov	Dec
2006	Jan	Feb	Mar	Apr	May	Jun	Jul (10)	Aug (1)	Sep	Oct (3)	Nov (3)	Dec
2007	Jan (1)	Feb	Mar	Apr	May (5)	Jun (3)	Jul	Aug (7)	Sep	Oct	Nov	Dec
2008	Jan	Feb	Mar (4)	Apr (4)	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec

seedit-devel Mailing List for SELinux Policy Editor

seedit-devel — Discussion about development of SELinux Policy Editor