[9fans] if you're looking for some fun, check out selinux ...

[9fans] if you're looking for some fun, check out selinux ...

[Ronald G Minnich]

so, on FC5 I did a standard mount -o loop xyz /mnt
cd /mnt/lib64
rm *
rsync -av /lib64/* .

rsync fails, you get kernel messages like this:

system_u:object_r:unlabeled_t:s0 tclass=dir
audit(1153270163.378:19): avc:  denied  { read } for  pid=19059
comm="python" name="urandom" dev=tmpfs ino=1654
scontext=root:system_r:semanage_t:s0-s0:c0.c255
tcontext=system_u:object_r:device_t:s0 tclass=file
audit(1153270198.018:20): avc:  denied  { read } for  pid=19065
comm="python" name="urandom" dev=tmpfs ino=1654
scontext=root:system_r:semanage_t:s0-s0:c0.c255
tcontext=system_u:object_r:device_t:s0 tclass=file
audit(1153270211.628:21): avc:  denied  { read } for  pid=19067
comm="python" name="urandom" dev=tmpfs ino=1654
scontext=root:system_r:semanage_t:s0-s0:c0.c255
tcontext=system_u:object_r:device_t:s0 tclass=file
audit(1153270220.558:22): avc:  denied  { read } for  pid=19068
comm="python" name="urandom" dev=tmpfs ino=1654
scontext=root:system_r:semanage_t:s0-s0:c0.c255
tcontext=system_u:object_r:device_t:s0 tclass=file

ah, what's it all mean?

Well, there's an easy way to find out!You can see the necessary allow
rules by running audit2why with this audit message as input.

lots of barf like this:
audit(1153270220.558:22): avc:  denied  { read } for  pid=19068
comm="python" name="urandom" dev=tmpfs ino=1654
scontext=root:system_r:semanage_t:s0-s0:c0.c255
tcontext=system_u:object_r:device_t:s0 tclass=file
         Was caused by:
                 Missing or disabled TE allow rule.
                 Allow rules may exist but be disabled by boolean
settings; check boolean settings.

yee ha!
OF course, it is easy to fix! dmesg | audit2allow
allow mount_t unlabeled_t:filesystem { mount unmount };
allow semanage_t device_t:file read;
allow semanage_t unlabeled_t:dir search;
allow unlabeled_t fs_t:filesystem associate;

and where does that go? well, that's a great question, thanks for asking!

in /etc/selinux there is a bunch of stuff. The one you care about is this:
/etc/linux/config, and before I got much further I noticed this:

SELINUX=enforcing
is in there, easy to fix, turn all this shit OFF!

But, wow! Is this where we're all headed? I think I'm more and more
motivated to move everything I can to plan 9 .... this selinux is less
fun than a trip to the dentist. Plus, can you image the permutations of
those rule sets over time? many and varied subtleties shall appear. It's
really quite incredible.

ron

Re: [9fans] if you're looking for some fun, check out selinux ...

[David Leimbach]

Yeah i've got FC4 here... couldn't export a directory with samba until
I located the magic flag for the new 'chcon' tool.

I gave up on it after not being able to make an LDAP server work with
it's own DB directories and being unable to locate the magic chcon
flag.

It (SELINUX) was easily turned off with a switch in a conf file, but
it's such a pain in the ass, I don't know why it's in a "FC" style
distribution at all.

Dave

On 7/18/06, Ronald G Minnich <rminnich@lanl.gov> wrote:
>
> so, on FC5 I did a standard mount -o loop xyz /mnt
> cd /mnt/lib64
> rm *
> rsync -av /lib64/* .
>
> rsync fails, you get kernel messages like this:
>
> system_u:object_r:unlabeled_t:s0 tclass=dir
> audit(1153270163.378:19): avc:  denied  { read } for  pid=19059
> comm="python" name="urandom" dev=tmpfs ino=1654
> scontext=root:system_r:semanage_t:s0-s0:c0.c255
> tcontext=system_u:object_r:device_t:s0 tclass=file
> audit(1153270198.018:20): avc:  denied  { read } for  pid=19065
> comm="python" name="urandom" dev=tmpfs ino=1654
> scontext=root:system_r:semanage_t:s0-s0:c0.c255
> tcontext=system_u:object_r:device_t:s0 tclass=file
> audit(1153270211.628:21): avc:  denied  { read } for  pid=19067
> comm="python" name="urandom" dev=tmpfs ino=1654
> scontext=root:system_r:semanage_t:s0-s0:c0.c255
> tcontext=system_u:object_r:device_t:s0 tclass=file
> audit(1153270220.558:22): avc:  denied  { read } for  pid=19068
> comm="python" name="urandom" dev=tmpfs ino=1654
> scontext=root:system_r:semanage_t:s0-s0:c0.c255
> tcontext=system_u:object_r:device_t:s0 tclass=file
>
> ah, what's it all mean?
>
> Well, there's an easy way to find out!You can see the necessary allow
> rules by running audit2why with this audit message as input.
>
> lots of barf like this:
> audit(1153270220.558:22): avc:  denied  { read } for  pid=19068
> comm="python" name="urandom" dev=tmpfs ino=1654
> scontext=root:system_r:semanage_t:s0-s0:c0.c255
> tcontext=system_u:object_r:device_t:s0 tclass=file
>          Was caused by:
>                  Missing or disabled TE allow rule.
>                  Allow rules may exist but be disabled by boolean
> settings; check boolean settings.
>
> yee ha!
> OF course, it is easy to fix! dmesg | audit2allow
> allow mount_t unlabeled_t:filesystem { mount unmount };
> allow semanage_t device_t:file read;
> allow semanage_t unlabeled_t:dir search;
> allow unlabeled_t fs_t:filesystem associate;
>
> and where does that go? well, that's a great question, thanks for asking!
>
> in /etc/selinux there is a bunch of stuff. The one you care about is this:
> /etc/linux/config, and before I got much further I noticed this:
>
> SELINUX=enforcing
> is in there, easy to fix, turn all this shit OFF!
>
> But, wow! Is this where we're all headed? I think I'm more and more
> motivated to move everything I can to plan 9 .... this selinux is less
> fun than a trip to the dentist. Plus, can you image the permutations of
> those rule sets over time? many and varied subtleties shall appear. It's
> really quite incredible.
>
> ron
>

Re: [9fans] if you're looking for some fun, check out selinux ...

[Ronald G Minnich]

David Leimbach wrote:

> It (SELINUX) was easily turned off with a switch in a conf file, but
> it's such a pain in the ass, I don't know why it's in a "FC" style
> distribution at all.

The bigger question, which I can't quite figure out yet, is does selinux
provide some magic dust that in turn provides a level of security not
attainable any other way (i.e. in something like Plan 9) ... or, is it a
set of hacks to cover for an obsolete way of doing things. I am tending
toward thinking the latter, now that I've worked with it a bit. Watch
the discussions on labeling files, it's interesting, because the label
namespace seems to be fragmenting already.

ron

Re: [9fans] if you're looking for some fun, check out selinux ...

[jmk]

On Tue Jul 18 16:12:29 EDT 2006, leimy2k@gmail.com wrote:
> Yeah i've got FC4 here... couldn't export a directory with samba until
> I located the magic flag for the new 'chcon' tool.
> ...

It's only a few steps from 'chcon' to 'cthulhu'.

Re: Re: [9fans] if you're looking for some fun, check out selinux ...

[David Leimbach]

On 7/18/06, Ronald G Minnich <rminnich@lanl.gov> wrote:
> David Leimbach wrote:
>
> > It (SELINUX) was easily turned off with a switch in a conf file, but
> > it's such a pain in the ass, I don't know why it's in a "FC" style
> > distribution at all.
>
> The bigger question, which I can't quite figure out yet, is does selinux
> provide some magic dust that in turn provides a level of security not
> attainable any other way (i.e. in something like Plan 9) ... or, is it a
> set of hacks to cover for an obsolete way of doing things. I am tending
> toward thinking the latter, now that I've worked with it a bit. Watch
> the discussions on labeling files, it's interesting, because the label
> namespace seems to be fragmenting already.
>
> ron
>

It's very clearly add-on technology to make up for something people
felt was unmanageable in Unix.  However do we really need both ACLs
and SELINUX contexts?  Do our files really need to have named hidden
data to store this crap in?

I've honestly not read any papers justifying the need for ACLs or
SELINUX controls.

I suddenly miss DOS.

Dave

Re: Re: [9fans] if you're looking for some fun, check out selinux ...

[LiteStar numnums]

[-- Attachment #1: Type: text/plain, Size: 2090 bytes --]

You all seem to forget that this is a merging of anal retentive technologies
from a US government bureacracy and the anarchy of 'Linux', which is not
really a single anything accept a tree with lots and lots of code. This is
the same US goverment (although not the same bureaucracy) that unleashed
NIEM (niem.gov) onto the world, XML with no less than NINE NAMESPACES, which
is supposed to be used for critical (read: things like 'Oh, the leavies may
have been breached') data...
On a lighter note, I've always been happy with TrustedBSD & TrustedSolaris,
or OpenVMS ;-)

On 7/18/06, David Leimbach <leimy2k@gmail.com> wrote:
>
> On 7/18/06, Ronald G Minnich <rminnich@lanl.gov> wrote:
> > David Leimbach wrote:
> >
> > > It (SELINUX) was easily turned off with a switch in a conf file, but
> > > it's such a pain in the ass, I don't know why it's in a "FC" style
> > > distribution at all.
> >
> > The bigger question, which I can't quite figure out yet, is does selinux
> > provide some magic dust that in turn provides a level of security not
> > attainable any other way (i.e. in something like Plan 9) ... or, is it a
> > set of hacks to cover for an obsolete way of doing things. I am tending
> > toward thinking the latter, now that I've worked with it a bit. Watch
> > the discussions on labeling files, it's interesting, because the label
> > namespace seems to be fragmenting already.
> >
> > ron
> >
>
> It's very clearly add-on technology to make up for something people
> felt was unmanageable in Unix.  However do we really need both ACLs
> and SELINUX contexts?  Do our files really need to have named hidden
> data to store this crap in?
>
> I've honestly not read any papers justifying the need for ACLs or
> SELINUX controls.
>
> I suddenly miss DOS.
>
> Dave
>



--
Lead thou me on, O Zeus, and Destiny,
To that goal long ago to me assigned.
I'll follow and not falter; if my will
Prove weak and craven, still I'll follow on.
-- Epictetus

He who enters his wife's dressing room is a philosopher or a fool. -- Balzac

[-- Attachment #2: Type: text/html, Size: 2566 bytes --]

Re: Re: Re: [9fans] if you're looking for some fun, check out selinux ...

[David Leimbach]

I wonder when AdaOS will be done? :-)


On 7/18/06, LiteStar numnums <litestar@gmail.com> wrote:
> You all seem to forget that this is a merging of anal retentive technologies
> from a US government bureacracy and the anarchy of 'Linux', which is not
> really a single anything accept a tree with lots and lots of code. This is
> the same US goverment (although not the same bureaucracy) that unleashed
> NIEM ( niem.gov) onto the world, XML with no less than NINE NAMESPACES,
> which is supposed to be used for critical (read: things like 'Oh, the
> leavies may have been breached') data...
> On a lighter note, I've always been happy with TrustedBSD & TrustedSolaris,
> or OpenVMS ;-)
>
>
> On 7/18/06, David Leimbach <leimy2k@gmail.com> wrote:
> > On 7/18/06, Ronald G Minnich <rminnich@lanl.gov> wrote:
> > > David Leimbach wrote:
> > >
> > > > It (SELINUX) was easily turned off with a switch in a conf file, but
> > > > it's such a pain in the ass, I don't know why it's in a "FC" style
> > > > distribution at all.
> > >
> > > The bigger question, which I can't quite figure out yet, is does selinux
> > > provide some magic dust that in turn provides a level of security not
> > > attainable any other way (i.e. in something like Plan 9) ... or, is it a
> > > set of hacks to cover for an obsolete way of doing things. I am tending
> > > toward thinking the latter, now that I've worked with it a bit. Watch
> > > the discussions on labeling files, it's interesting, because the label
> > > namespace seems to be fragmenting already.
> > >
> > > ron
> > >
> >
> > It's very clearly add-on technology to make up for something people
> > felt was unmanageable in Unix.  However do we really need both ACLs
> > and SELINUX contexts?  Do our files really need to have named hidden
> > data to store this crap in?
> >
> > I've honestly not read any papers justifying the need for ACLs or
> > SELINUX controls.
> >
> > I suddenly miss DOS.
> >
> > Dave
> >
>
>
>
> --
> Lead thou me on, O Zeus, and Destiny,
> To that goal long ago to me assigned.
> I'll follow and not falter; if my will
> Prove weak and craven, still I'll follow on.
>  -- Epictetus
>
> He who enters his wife's dressing room is a philosopher or a fool. -- Balzac

Re: Re: Re: [9fans] if you're looking for some fun, check out selinux ...

[LiteStar numnums]

[-- Attachment #1: Type: text/plain, Size: 2819 bytes --]

Well, Oberon Native's been around for years... =)

On 7/18/06, David Leimbach <leimy2k@gmail.com> wrote:
>
> I wonder when AdaOS will be done? :-)
>
>
> On 7/18/06, LiteStar numnums <litestar@gmail.com> wrote:
> > You all seem to forget that this is a merging of anal retentive
> technologies
> > from a US government bureacracy and the anarchy of 'Linux', which is not
> > really a single anything accept a tree with lots and lots of code. This
> is
> > the same US goverment (although not the same bureaucracy) that unleashed
> > NIEM ( niem.gov) onto the world, XML with no less than NINE NAMESPACES,
> > which is supposed to be used for critical (read: things like 'Oh, the
> > leavies may have been breached') data...
> > On a lighter note, I've always been happy with TrustedBSD &
> TrustedSolaris,
> > or OpenVMS ;-)
> >
> >
> > On 7/18/06, David Leimbach <leimy2k@gmail.com> wrote:
> > > On 7/18/06, Ronald G Minnich <rminnich@lanl.gov> wrote:
> > > > David Leimbach wrote:
> > > >
> > > > > It (SELINUX) was easily turned off with a switch in a conf file,
> but
> > > > > it's such a pain in the ass, I don't know why it's in a "FC" style
> > > > > distribution at all.
> > > >
> > > > The bigger question, which I can't quite figure out yet, is does
> selinux
> > > > provide some magic dust that in turn provides a level of security
> not
> > > > attainable any other way (i.e. in something like Plan 9) ... or, is
> it a
> > > > set of hacks to cover for an obsolete way of doing things. I am
> tending
> > > > toward thinking the latter, now that I've worked with it a bit.
> Watch
> > > > the discussions on labeling files, it's interesting, because the
> label
> > > > namespace seems to be fragmenting already.
> > > >
> > > > ron
> > > >
> > >
> > > It's very clearly add-on technology to make up for something people
> > > felt was unmanageable in Unix.  However do we really need both ACLs
> > > and SELINUX contexts?  Do our files really need to have named hidden
> > > data to store this crap in?
> > >
> > > I've honestly not read any papers justifying the need for ACLs or
> > > SELINUX controls.
> > >
> > > I suddenly miss DOS.
> > >
> > > Dave
> > >
> >
> >
> >
> > --
> > Lead thou me on, O Zeus, and Destiny,
> > To that goal long ago to me assigned.
> > I'll follow and not falter; if my will
> > Prove weak and craven, still I'll follow on.
> >  -- Epictetus
> >
> > He who enters his wife's dressing room is a philosopher or a fool. --
> Balzac
>



--
Lead thou me on, O Zeus, and Destiny,
To that goal long ago to me assigned.
I'll follow and not falter; if my will
Prove weak and craven, still I'll follow on.
-- Epictetus

He who enters his wife's dressing room is a philosopher or a fool. -- Balzac

[-- Attachment #2: Type: text/html, Size: 3625 bytes --]

Re: Re: Re: [9fans] if you're looking for some fun,

[Brantley Coile]

> Well, Oberon Native's been around for years... =)

I object to that callous remark on two grounds.

The the Oberon system is the inspiration for acme, which, given this
mailing list, gives it some sort of place of honor, and the Oberon
language is as flexible as one can get in a small, strongly typed
language.  C might even have evolved to meet Oberon in the middle of
the language field, if it hadn't had pointer arithmetic.  That stopped
it cold.  Not only do we now require function prototypes, we can even do
typechecking of actual parameters against the format strings of print
functions.

In any event, suggestion that Ada and Oberon are in any way related in
an insult.  Langues have feelings too. :)

http://www.oberon.ethz.ch/oreport.html

(Is there a category for Languageist jokes?  You know, like racist
jokes only for programming langues?  ``There are three languages in a
boat, FORTRAN, Pascal, and C.  FORTRAN says ...  '')

Re: Re: Re: [9fans] if you're looking for some fun,

[LiteStar numnums]

[-- Attachment #1: Type: text/plain, Size: 1892 bytes --]

Actually, the joke rested on the fact that Ada is dogged by complexity
complaints, much like Oberon, which actually has a Native System, unlike
Ada. I do realise that Oberon and Ada are dissimilar, especially given their
direct origins (Wirth vs. DoD). Plus, having used Oberon, Ada & RavenSpark,
I actually realise the complaints against Ada, but poking fun was all that
this was meant to do.
By the way, I would suggest you to look up FOURTH, LITHP & C-- for
languagesist jokes... =) C-omega might even be another fun lookup
Cheers,
 -- Sztefan

On 7/18/06, Brantley Coile <brantley@coraid.com> wrote:
>
> > Well, Oberon Native's been around for years... =)
>
> I object to that callous remark on two grounds.
>
> The the Oberon system is the inspiration for acme, which, given this
> mailing list, gives it some sort of place of honor, and the Oberon
> language is as flexible as one can get in a small, strongly typed
> language.  C might even have evolved to meet Oberon in the middle of
> the language field, if it hadn't had pointer arithmetic.  That stopped
> it cold.  Not only do we now require function prototypes, we can even do
> typechecking of actual parameters against the format strings of print
> functions.
>
> In any event, suggestion that Ada and Oberon are in any way related in
> an insult.  Langues have feelings too. :)
>
> http://www.oberon.ethz.ch/oreport.html
>
> (Is there a category for Languageist jokes?  You know, like racist
> jokes only for programming langues?  ``There are three languages in a
> boat, FORTRAN, Pascal, and C.  FORTRAN says ...  '')
>
>


--
Lead thou me on, O Zeus, and Destiny,
To that goal long ago to me assigned.
I'll follow and not falter; if my will
Prove weak and craven, still I'll follow on.
-- Epictetus

He who enters his wife's dressing room is a philosopher or a fool. -- Balzac

[-- Attachment #2: Type: text/html, Size: 2360 bytes --]

Re: Re: Re: [9fans] if you're looking for some fun,

[Skip Tavakkolian]

> http://www.oberon.ethz.ch/oreport.html

something is mistyped in there. what's an ELSIF? do they
mean ELVIS?

(actually, that's my only objection) ;

wait is that too many ';' or not enough?
;

no i take it back.

RE: Re: Re: [9fans] if you're looking for some fun,

[cej]

> Well, Oberon Native's been around for years... =)

Some time ago i realized that native oberon is dead, or am i wrong??
++pac.

Re: Re: Re: [9fans] if you're looking for some fun,

[LiteStar numnums]

[-- Attachment #1: Type: text/plain, Size: 577 bytes --]

Last updates to anything in the FTP site is 2005, so not necessarily dead,
but stagnant perhaps?

On 7/19/06, cej@gli.cas.cz <cej@gli.cas.cz> wrote:
>
>
>
>
> > Well, Oberon Native's been around for years... =)
>
> Some time ago i realized that native oberon is dead, or am i wrong??
> ++pac.
>
>


--
Lead thou me on, O Zeus, and Destiny,
To that goal long ago to me assigned.
I'll follow and not falter; if my will
Prove weak and craven, still I'll follow on.
-- Epictetus

He who enters his wife's dressing room is a philosopher or a fool. -- Balzac

[-- Attachment #2: Type: text/html, Size: 918 bytes --]