Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: Gentoo: Hardened

samba 4 MLS --> strict modules

 

 

Gentoo hardened RSS feed   Index | Next | Previous | View Threaded


alain.toussaint at securivm

Apr 14, 2012, 7:41 AM

Post #1 of 4 (360 views)
Permalink
samba 4 MLS --> strict modules

In the samba 4 howto, the instructions related to selinux apply to RH and
when I tried to compile this modules, I had an error because I'm running
in strict mode and semodule tell me it's an MLS modules. What do I need to
modify to this module to run it in strict mode?

Thanks
Alain


module samba4 1.0;


require {
type ntpd_t;
type usr_t;
type initrc_t;
class sock_file write;
class unix_stream_socket connectto;
}

#============= ntpd_t ==============
allow ntpd_t usr_t:sock_file write;

#============= ntpd_t ==============
allow ntpd_t initrc_t:unix_stream_socket connectto;


swift at gentoo

Apr 15, 2012, 12:47 AM

Post #2 of 4 (328 views)
Permalink
Re: samba 4 MLS --> strict modules [In reply to]

On Sat, Apr 14, 2012 at 10:41:48AM -0400, Alain Toussaint wrote:
> In the samba 4 howto, the instructions related to selinux apply to RH and
> when I tried to compile this modules, I had an error because I'm running
> in strict mode and semodule tell me it's an MLS modules. What do I need to
> modify to this module to run it in strict mode?
>
> module samba4 1.0;
>
>
> require {
> type ntpd_t;
> type usr_t;
> type initrc_t;
> class sock_file write;
> class unix_stream_socket connectto;
> }
>
> #============= ntpd_t ==============
> allow ntpd_t usr_t:sock_file write;
>
> #============= ntpd_t ==============
> allow ntpd_t initrc_t:unix_stream_socket connectto;

Doesn't look like an MLS specific module here. Just change the header:
instead of "module samba4 1.0" write "policy_module(samba4, 1.0)" and then
you should be able to build it with:

~# make -f /usr/share/selinux/strict/include/Makefile samba4.pp
~# semodule -i samba4.pp

Perhaps you also have a .fc file that goes with it? If you do, that might
contain some references to sensitivity labels or so that only apply to MLS.
In that case, tell me what the .fc file looks like.

Wkr,
Sven Vermeulen


alain.toussaint at securivm

Apr 15, 2012, 4:24 AM

Post #3 of 4 (328 views)
Permalink
RE: samba 4 MLS --> strict modules [In reply to]

Couldn't find the setting how to quotes in outlook 2010...

<<<<<<<<<<<
On Sat, Apr 14, 2012 at 10:41:48AM -0400, Alain Toussaint wrote:
> In the samba 4 howto, the instructions related to selinux apply to RH
> and when I tried to compile this modules, I had an error because I'm
> running in strict mode and semodule tell me it's an MLS modules. What
> do I need to modify to this module to run it in strict mode?
>
> module samba4 1.0;
>
>
> require {
> type ntpd_t;
> type usr_t;
> type initrc_t;
> class sock_file write;
> class unix_stream_socket connectto;
> }
>
> #============= ntpd_t ==============
> allow ntpd_t usr_t:sock_file write;
>
> #============= ntpd_t ==============
> allow ntpd_t initrc_t:unix_stream_socket connectto;

Doesn't look like an MLS specific module here. Just change the header:
instead of "module samba4 1.0" write "policy_module(samba4, 1.0)" and then
you should be able to build it with:

~# make -f /usr/share/selinux/strict/include/Makefile samba4.pp ~#
semodule -i samba4.pp

Perhaps you also have a .fc file that goes with it? If you do, that might
contain some references to sensitivity labels or so that only apply to
MLS.
In that case, tell me what the .fc file looks like.

Wkr,
Sven Vermeulen

>>>>>>>>>

Actually, I followed the instruction over there:

http://wiki.samba.org/index.php/Samba4/HOWTO

and there:

http://wiki.samba.org/index.php/Samba4/Winbind (yes I can login as
Administrator on my Linux box).

There isn't an .fc files, just the module for samba 4 as it's meant to run
on RHEL 6 in targeted mode (does RHEL use MLS policy). Thanks for the
instruction, I will correct the module and apply it.

Alain


swift at gentoo

Apr 17, 2012, 11:28 AM

Post #4 of 4 (319 views)
Permalink
Re: samba 4 MLS --> strict modules [In reply to]

On Sun, Apr 15, 2012 at 07:24:16AM -0400, Alain Toussaint wrote:
> Actually, I followed the instruction over there:
>
> http://wiki.samba.org/index.php/Samba4/HOWTO
>
> and there:
>
> http://wiki.samba.org/index.php/Samba4/Winbind (yes I can login as
> Administrator on my Linux box).

Ah, then the MLS is because you're asking checkmodule to build MLS policy
;-) The use of the makefile is a much more development-friendly (and
future-proof) method.

Wkr,
Sven Vermeulen

Gentoo hardened RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.