http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c1 Thomas Biege changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |thomas@novell.com AssignedTo|bnc-team-screening@forge.pr |prusnak@novell.com |ovo.novell.com | --- Comment #1 from Thomas Biege 2010-02-22 15:32:49 UTC --- Pavol, can you make it possible? Thanks a lot. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c3 Justin mattock changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |justinmattock@gmail.com --- Comment #3 from Justin mattock 2010-02-23 19:20:34 UTC --- this one is tricky.. there seems to be two bugs hitting which makes it hard. after installing all of the SELinux specific libs/apps upon reboot gdm starts up but then gives up after the fifth try bringing the user to init3. when looking at /var/log/gdm/:5-greeter.log the first error is this: Failed to start message bus: Failed to open "/etc/selinux/targeted/contexts/dbus_contexts": No such file or directory EOF in dbus-launch reading address from dbus daemon. keep in mind this does not appear if you relabel the filesystem because the second/first bug hits(which is sysadm_t specific to init.te). a simple solution is to either cp -R the policy to the name targeted or make a symlink to targeted. but is not the solution to the problem. after using strace I noticed that /etc/selinux/config was giving a permissions denied. Looking at the permissions of /etc/selinux/config I noticed it was set to 0600 so after a simple chmod 644 /etc/selinux/config the system booted up using the custom name instead of defaulting(libselinux) to targeted. so the fix from here is chmod 644 /etc/selinux/config -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c5 --- Comment #5 from Alan Rouse 2010-02-25 17:31:39 UTC --- Please include the setroubleshoot package. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c7 --- Comment #7 from Alan Rouse 2010-02-25 17:38:34 UTC --- (In reply to comment #6)

(In reply to comment #5)

...

Please include the setroubleshoot package. sorry... please ignore!

Actually, please make sure packages can be installed without broken dependencies. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c9 --- Comment #9 from Pavol Rusnak 2010-03-07 23:22:52 CET --- I updated the SELinux stack to latest versions available from Fedora. Package policycoreutils fails on Factory, but passes on 11.2. Also setroubleshoot is broken on both. You might want look into it. Thomas: is there a chance you are working on SELinux policy for openSUSE? Alan asked me via email if there is anyone besides him, but let's continue discussion here. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c11 --- Comment #11 from Alan Rouse 2010-03-08 16:33:00 UTC --- We still need the update for findutils. "fixfiles -F relabel" fails due to -context not being implemented in findutils. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c13 --- Comment #13 from Alan Rouse 2010-03-08 17:27:36 UTC --- policycoreutils-2.0.79-27.1.i586.rpm is missing a few of the utilities that were in policycoreutils-2.0.62-3.1.i586. Notably, audit2allow, audit2why, chcat, newrole. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c15 --- Comment #15 from Alan Rouse 2010-03-08 18:13:03 UTC --- I have to break dependencies to install those packages. Where do I find libsemanage-python? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c17 --- Comment #17 from Alan Rouse 2010-03-10 15:48:56 UTC --- I can successfully install all of the packages in http\://download.opensuse.org/repositories/security\:/SELinux/openSUSE_Factory/i586/ except for python-capng-0.6.2-5.2.i586.rpm. That package requires libcapng = 0.6.2 which is not available. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c19 --- Comment #19 from Alan Rouse 2010-03-18 20:20:22 UTC --- Note from the original entry on this bug (first paragraph) we need policycoreutils 2.0.71 or later. The Factory currently contains policycoreutils 2.0.62-6.1. See http://download.opensuse.org/repositories/security:/SELinux/openSUSE_Factory... Am I looking in the wrong place? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c21 --- Comment #21 from Alan Rouse 2010-03-31 20:46:13 UTC --- setroubleshoot and setroubleshoot-server also have unmet dependencies: setroubleshoot-plugins >= 2.0.4 pygobject2 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c23 --- Comment #23 from Alan Rouse 2010-04-06 21:23:47 UTC --- (In reply to comment #22)

Alan: These should be fixed as well.

In ...repositories/security:/SELinux/openSUSE_Factory/i586/ setroubleshoot-2.2.64-10.1.i586.rpm requires setroubleshoot-plugins >= 2.0.4 but nothing provides it. setroubleshoot-server-2.2.64-10.1.i586.rpm requires libselinux-python but nothing provides it. Also, another selinux-related issue: /usr/lib/libcrypto.so.0.9.8 unnecessarily (?) requires executable stack, which selinux does not permit. This prevents logging in (among other things I'm sure...) with selinux in enforcing mode. After "zypper install prelink" you get the tools needed to confirm and fix this. To confirm: execstack -q /usr/lib/libcrypto.so.0.9.8 return "X" at the start of the line, confirming the library wants an executable stack. To fix: execstack -c /usr/lib/libcrypto.so.0.9.8 For more info, see http://etbe.coker.com.au/2007/10/07/executable-stack-and-shared-objects/ -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c Thomas Biege changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Other |Other Version|Final |unspecified AssignedTo|prusnak@novell.com |bnc-team-screening@forge.pr | |ovo.novell.com Product|openSUSE 11.2 |openSUSE 11.3 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c25 --- Comment #25 from Alan Rouse 2010-04-08 12:28:25 UTC --- I just wanted to make you aware of the fact that the version of these packages in the factory were not fixed as of the time I added that comment. Those tools would be useful to me, and I'm sure others also. By the way, are you interested in a working selinux policy for OpenSUSE? I'm currently able to boot to runlevel 5 and log in with selinux in enforcing mode. Obviously there's more to do but I'm making progress... -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c27 --- Comment #27 from Thomas Biege 2010-04-09 08:11:50 UTC --- (In reply to comment #25)

I just wanted to make you aware of the fact that the version of these packages in the factory were not fixed as of the time I added that comment. Those tools would be useful to me, and I'm sure others also.

By the way, are you interested in a working selinux policy for OpenSUSE? I'm currently able to boot to runlevel 5 and log in with selinux in enforcing mode. Obviously there's more to do but I'm making progress...

A working policy for openSUSE... that would be great! We can put it in security:SELinux at OBS. Alan, are you familiar with the openSUSE build service or did you already share it via a version control system like gitorious.org? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=581505 http://bugzilla.novell.com/show_bug.cgi?id=581505#c29 Pavol Rusnak changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #29 from Pavol Rusnak 2010-04-28 14:10:40 CEST --- Try reading this document http://en.opensuse.org/Build_Service/Collaboration or share your policy somewhere. Thanks! I'm closing this bug for now. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.