Permission denied when building kernel

[Matthew East]

I cannot build and install a kernel with selinux enabled. Here is what
happens towards the end of the modules_install stage:

if [ -r System.map ]; then /sbin/depmod -ae -F System.map -b
/var/tmp/kernel-2.6.6-root -r 2.6.6; fi
WARNING: Couldn't open directory
/var/tmp/kernel-2.6.6-root/lib/modules/2.6.6: Permission denied
FATAL: Could not open
/var/tmp/kernel-2.6.6-root/lib/modules/2.6.6/modules.dep.temp for
writing: Permission denied
make[1]: *** [_modinst_post] Error 1
error: Bad exit status from /var/tmp/rpm-tmp.11877 (%install)
 

RPM build errors:
    Bad exit status from /var/tmp/rpm-tmp.11877 (%install)
make: *** [rpm] Error 1

Here are the error messages:

[root@localhost linux-2.6.6]# dmesg |tail

{snip}

audit(1085609097.359:0): avc:  denied  { search } for  pid=17414
exe=/sbin/depmod name=tmp dev=hda2 ino=196228
scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:tmp_t
tclass=dir
audit(1085609097.359:0): avc:  denied  { search } for  pid=17414
exe=/sbin/depmod name=tmp dev=hda2 ino=196228
scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:tmp_t
tclass=dir

I hope that someone can help me with this!! Maybe I am going about the
compiling the wrong way, but it works fine with selinux disabled. 

Many thanks in advance, Matt

p.s. Just for the record, or in case they are useful, here are the error
messages I get when booting my new kernel which was compiled with
selinux set to permissive.

Freeing unused kernel memory: 160k freed
security:  5 users, 7 roles, 1244 types, 1 bools
security:  30 classes, 303377 rules
SELinux:  Completing initialization.
SELinux:  Setting up existing superblocks.
SELinux: initialized (dev , type selinuxfs), uses genfs_contexts
SELinux: initialized (dev hda2, type ext3), uses xattr
audit(1085619351.268:0): avc:  denied  { ioctl } for  pid=164
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.271:0): avc:  denied  { getattr } for  pid=176
exe=/bin/bash path=/etc/hotplug dev=hda2 ino=49185
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
audit(1085619351.271:0): avc:  denied  { read } for  pid=164
exe=/bin/bash path=pipe:[842] dev= ino=842
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=fifo_file
audit(1085619351.272:0): avc:  denied  { ioctl } for  pid=165
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.274:0): avc:  denied  { search } for  pid=177
exe=/bin/bash name=hotplug dev=hda2 ino=49185
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
audit(1085619351.274:0): avc:  denied  { read } for  pid=165
exe=/bin/bash path=pipe:[843] dev= ino=843
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=fifo_file
audit(1085619351.274:0): avc:  denied  { ioctl } for  pid=167
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.277:0): avc:  denied  { search } for  pid=178
exe=/bin/bash name=hotplug dev=hda2 ino=49185
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
audit(1085619351.277:0): avc:  denied  { read } for  pid=167
exe=/bin/bash path=pipe:[844] dev= ino=844
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=fifo_file
audit(1085619351.277:0): avc:  denied  { ioctl } for  pid=166
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.280:0): avc:  denied  { search } for  pid=179
exe=/bin/bash name=hotplug dev=hda2 ino=49185
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
audit(1085619351.280:0): avc:  denied  { read } for  pid=166
exe=/bin/bash path=pipe:[845] dev= ino=845
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=fifo_file
audit(1085619351.290:0): avc:  denied  { getattr } for  pid=177
exe=/bin/env path=/etc/ld.so.cache dev=hda2 ino=50220
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=file
audit(1085619351.290:0): avc:  denied  { read } for  pid=177
exe=/bin/env name=libc-2.3.3.so dev=hda2 ino=131669
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=file
audit(1085619351.290:0): avc:  denied  { getattr } for  pid=177
exe=/bin/env path=/lib/tls dev=hda2 ino=130821
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
audit(1085619351.290:0): avc:  denied  { read } for  pid=176
exe=/bin/bash path=/lib/ld-2.3.3.so dev=hda2 ino=130827
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=file
audit(1085619351.290:0): avc:  denied  { getattr } for  pid=176
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.291:0): avc:  denied  { write } for  pid=176
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.292:0): avc:  denied  { search } for  pid=164
exe=/bin/bash name=hotplug dev=hda2 ino=49185
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
audit(1085619351.292:0): avc:  denied  { read } for  pid=179
exe=/bin/bash path=/lib/ld-2.3.3.so dev=hda2 ino=130827
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=file
audit(1085619351.293:0): avc:  denied  { getattr } for  pid=179
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.293:0): avc:  denied  { write } for  pid=179
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.294:0): avc:  denied  { search } for  pid=166
exe=/bin/bash name=hotplug dev=hda2 ino=49185
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
audit(1085619351.294:0): avc:  denied  { read } for  pid=178
exe=/bin/bash path=/lib/ld-2.3.3.so dev=hda2 ino=130827
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=file
audit(1085619351.294:0): avc:  denied  { getattr } for  pid=178
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.295:0): avc:  denied  { write } for  pid=178
exe=/bin/bash path=/dev/null dev=hda2 ino=283937
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=chr_file
audit(1085619351.296:0): avc:  denied  { search } for  pid=167
exe=/bin/bash name=hotplug dev=hda2 ino=49185
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=dir
audit(1085619351.699:0): avc:  denied  { getattr } for  pid=177
exe=/bin/env path=pipe:[843] dev= ino=843
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=fifo_file
audit(1085619351.700:0): avc:  denied  { write } for  pid=177
exe=/bin/env path=pipe:[843] dev= ino=843
scontext=system_u:system_r:kernel_t
tcontext=system_u:object_r:unlabeled_t tclass=fifo_file
SELinux: initialized (dev ram0, type ext2), uses xattr
SELinux: initialized (dev , type mqueue), not configured for labeling
SELinux: initialized (dev , type hugetlbfs), not configured for labeling
SELinux: initialized (dev , type devpts), uses transition SIDs
SELinux: initialized (dev , type eventpollfs), uses genfs_contexts
SELinux: initialized (dev , type pipefs), uses task SIDs
SELinux: initialized (dev , type tmpfs), uses transition SIDs
SELinux: initialized (dev , type futexfs), uses genfs_contexts
SELinux: initialized (dev , type sockfs), uses task SIDs
SELinux: initialized (dev , type proc), uses genfs_contexts
SELinux: initialized (dev , type bdev), uses genfs_contexts
SELinux: initialized (dev , type rootfs), uses genfs_contexts
SELinux: initialized (dev , type sysfs), uses genfs_contexts

[Stephen Smalley]

On Thu, 2004-05-27 at 04:39, Matthew East wrote:
>  I cannot build and install a kernel with selinux enabled. Here is
> what
>  happens towards the end of the modules_install stage: 
>  if [ -r System.map ]; then /sbin/depmod -ae -F System.map -b
>  /var/tmp/kernel-2.6.6-root -r 2.6.6; fi
>  WARNING: Couldn't open directory
>  /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6: Permission denied
>  FATAL: Could not open
>  /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6/modules.dep.temp for
>  writing: Permission denied
>  make[1]: *** [_modinst_post] Error 1
>  error: Bad exit status from /var/tmp/rpm-tmp.11877 (%install) 
Add 'tmp_domain(depmod)' to
/etc/security/selinux/src/policy/domains/program/modutils.te and do a
'make load' in /etc/security/selinux/src/policy.  yum install
policy-sources if you don't already have it.

>  p.s. Just for the record, or in case they are useful, here are the
> error
>  messages I get when booting my new kernel which was compiled with
>  selinux set to permissive.
>  
>  Freeing unused kernel memory: 160k freed
>  security:  5 users, 7 roles, 1244 types, 1 bools
>  security:  30 classes, 303377 rules
>  SELinux:  Completing initialization.
>  SELinux:  Setting up existing superblocks.
>  SELinux: initialized (dev , type selinuxfs), uses genfs_contexts
>  SELinux: initialized (dev hda2, type ext3), uses xattr
>  audit(1085619351.268:0): avc:  denied  { ioctl } for  pid=164
>  exe=/bin/bash path=/dev/null dev=hda2 ino=283937
>  scontext=system_u:system_r:kernel_t
>  tcontext=system_u:object_r:unlabeled_t tclass=chr_file
>  audit(1085619351.271:0): avc:  denied  { getattr } for  pid=176
>  exe=/bin/bash path=/etc/hotplug dev=hda2 ino=49185
>  scontext=system_u:system_r:kernel_t
>  tcontext=system_u:object_r:unlabeled_t tclass=dir 
Very odd; these certainly shouldn't be unlabeled_t.  What does a
getfilecon /etc/hotplug (or any of these files that are showing up with
unlabeled_t) show?

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Matthew East]

On Thu, 2004-05-27 at 14:45, Stephen Smalley wrote:
>  On Thu, 2004-05-27 at 04:39, Matthew East wrote:
>  > I cannot build and install a kernel with selinux enabled. Here is what
>  > happens towards the end of the modules_install stage:
>  
>  > if [ -r System.map ]; then /sbin/depmod -ae -F System.map -b
>  > /var/tmp/kernel-2.6.6-root -r 2.6.6; fi
>  > WARNING: Couldn't open directory
>  > /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6: Permission denied
>  > FATAL: Could not open
>  > /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6/modules.dep.temp for
>  > writing: Permission denied
>  > make[1]: *** [_modinst_post] Error 1
>  > error: Bad exit status from /var/tmp/rpm-tmp.11877 (%install)
>  
>  Add 'tmp_domain(depmod)' to
>  /etc/security/selinux/src/policy/domains/program/modutils.te and do a
>  'make load' in /etc/security/selinux/src/policy.  yum install
>  policy-sources if you don't already have it. 
Ok will try this.

>  > p.s. Just for the record, or in case they are useful, here are
> the error
>  > messages I get when booting my new kernel which was compiled with
>  > selinux set to permissive.
>  > 
>  > Freeing unused kernel memory: 160k freed
>  > security:  5 users, 7 roles, 1244 types, 1 bools
>  > security:  30 classes, 303377 rules
>  > SELinux:  Completing initialization.
>  > SELinux:  Setting up existing superblocks.
>  > SELinux: initialized (dev , type selinuxfs), uses genfs_contexts
>  > SELinux: initialized (dev hda2, type ext3), uses xattr
>  > audit(1085619351.268:0): avc:  denied  { ioctl } for  pid=164
>  > exe=/bin/bash path=/dev/null dev=hda2 ino=283937
>  > scontext=system_u:system_r:kernel_t
>  > tcontext=system_u:object_r:unlabeled_t tclass=chr_file
>  > audit(1085619351.271:0): avc:  denied  { getattr } for  pid=176
>  > exe=/bin/bash path=/etc/hotplug dev=hda2 ino=49185
>  > scontext=system_u:system_r:kernel_t
>  > tcontext=system_u:object_r:unlabeled_t tclass=dir
>  
>  Very odd; these certainly shouldn't be unlabeled_t.  What does a
>  getfilecon /etc/hotplug (or any of these files that are showing up with
>  unlabeled_t) show? 
I'm afraid I've removed the custom kernel so I can't tell you. I assumed
that the reason was that I'd compiled and installed the kernel with
selinux as permissive. In any case, under my current setup with the
fedora default kernel:

[matt@localhost matt]$ getfilecon /etc/hotplug
/etc/hotplug    system_u:object_r:hotplug_etc_t

To be honest my system is a bit strange at the moment, and I've put
selinux back in permissive mode, as I keep finding strange things that I
can't do with it in enforcing mode with no error messages (e.g.
Openoffice.org doesn't open and I can't do a "glxgears" - weird huh?!)
So it's probably that I've done something wrong. The installation of
fedora was of test 2 and I've been updating it until Core 2. So maybe a
clean install would be a good idea.

Thanks very much for all your help.

[Thomas Bleher]

* Stephen Smalley <sds(a)epoch.ncsc.mil&gt; [2004-05-27 14:45]:
>  On Thu, 2004-05-27 at 04:39, Matthew East wrote:
>  > p.s. Just for the record, or in case they are useful, here are the error
>  > messages I get when booting my new kernel which was compiled with
>  > selinux set to permissive.
>  > 
>  > Freeing unused kernel memory: 160k freed
>  > security:  5 users, 7 roles, 1244 types, 1 bools
>  > security:  30 classes, 303377 rules
>  > SELinux:  Completing initialization.
>  > SELinux:  Setting up existing superblocks.
>  > SELinux: initialized (dev , type selinuxfs), uses genfs_contexts
>  > SELinux: initialized (dev hda2, type ext3), uses xattr
>  > audit(1085619351.268:0): avc:  denied  { ioctl } for  pid=164
>  > exe=/bin/bash path=/dev/null dev=hda2 ino=283937
>  > scontext=system_u:system_r:kernel_t
>  > tcontext=system_u:object_r:unlabeled_t tclass=chr_file
>  > audit(1085619351.271:0): avc:  denied  { getattr } for  pid=176
>  > exe=/bin/bash path=/etc/hotplug dev=hda2 ino=49185
>  > scontext=system_u:system_r:kernel_t
>  > tcontext=system_u:object_r:unlabeled_t tclass=dir
>  
>  Very odd; these certainly shouldn't be unlabeled_t.  What does a
>  getfilecon /etc/hotplug (or any of these files that are showing up with
>  unlabeled_t) show? 
It looks like it is a similar problem like the one that has bitten
me[0].
Matthew said he had built a custom kernel so it is possible that a an
unusual combination of kernel options is causing this.
I am attaching my kernel .config (run through egrep -v '^#') so that
hopefully someone with more kernel knowledge can debug this and find the
problem. (I would be happy to test kernel patches trying to fix this)

Thanks,
Thomas

[0]: see http://marc.theaimsgroup.com/?l=selinux&m=108535024629852&w=2

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

(Attribution lost, sorry...)

>  > Very odd; these certainly shouldn't be unlabeled_t.  What
> does a
>  > getfilecon /etc/hotplug (or any of these files that are showing up with
>  > unlabeled_t) show? 
I've managed to have this happen two different ways:

1) /tmp was on a tmpfs filesystem, so got wiped every reboot.

2) I managed to get 'udev' to fail to label stuff as well, but I can't
remember
how that one happened..

[Russell Coker]

On Thu, 27 May 2004 18:39, Matthew East <matthew.east(a)iue.it&gt; wrote:
>  I cannot build and install a kernel with selinux enabled. Here is
> what
>  happens towards the end of the modules_install stage:
>
>  if [ -r System.map ]; then /sbin/depmod -ae -F System.map -b
>  /var/tmp/kernel-2.6.6-root -r 2.6.6; fi
>  WARNING: Couldn't open directory
>  /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6: Permission denied
>  FATAL: Could not open
>  /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6/modules.dep.temp for
>  writing: Permission denied
>  make[1]: *** [_modinst_post] Error 1
>  error: Bad exit status from /var/tmp/rpm-tmp.11877 (%install) 
Steve suggested adding tmp_domain(depmod), that will allow search access to 
tmp_t, however I expect that /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6 
will have type sysadm_tmp_t so something like the following will probably do 
better:
allow depmod_t tmp_t:dir search;
rw_dir_create_file(depmod_t, sysadm_tmp_t)

But the ideal solution (IMHO) would be to build kernels as non-root and 
non-sysadm_t.  There is no reason why compiling a kernel should require 
administrative access, if it won't compile as a regular user then that's a 
bug and should be filed in bugzilla.  user_t and staff_t can execute 
depmod_exec_t without a domain transition and won't have any problems in this 
regard.

>  audit(1085609097.359:0): avc:  denied  { search } for  pid=17414
>  exe=/sbin/depmod name=tmp dev=hda2 ino=196228
>  scontext=root:sysadm_r:depmod_t tcontext=system_u:object_r:tmp_t
>  tclass=dir 
-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Matthew East]

On Mon, 2004-05-31 at 12:06, Russell Coker wrote:
>  On Thu, 27 May 2004 18:39, Matthew East <matthew.east(a)iue.it&gt;
> wrote:
>  > I cannot build and install a kernel with selinux enabled. Here is what
>  > happens towards the end of the modules_install stage:
>  >
>  > if [ -r System.map ]; then /sbin/depmod -ae -F System.map -b
>  > /var/tmp/kernel-2.6.6-root -r 2.6.6; fi
>  > WARNING: Couldn't open directory
>  > /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6: Permission denied
>  > FATAL: Could not open
>  > /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6/modules.dep.temp for
>  > writing: Permission denied
>  > make[1]: *** [_modinst_post] Error 1
>  > error: Bad exit status from /var/tmp/rpm-tmp.11877 (%install)
>  
>  Steve suggested adding tmp_domain(depmod), that will allow search access to 
>  tmp_t, however I expect that /var/tmp/kernel-2.6.6-root/lib/modules/2.6.6 
>  will have type sysadm_tmp_t so something like the following will probably do 
>  better:
>  allow depmod_t tmp_t:dir search;
>  rw_dir_create_file(depmod_t, sysadm_tmp_t) 
OK thanks I will try that as well! You are right that the previous
suggestion didn't do the trick.

>  But the ideal solution (IMHO) would be to build kernels as non-root
> and 
>  non-sysadm_t.  There is no reason why compiling a kernel should require 
>  administrative access, if it won't compile as a regular user then that's a 
>  bug and should be filed in bugzilla.  user_t and staff_t can execute 
>  depmod_exec_t without a domain transition and won't have any problems in this 
>  regard. 
Yes in the README file with the kernel source it underlines that one
should compile as user, and then su to install. But I was using the
command "make rpm" as I thought that if I didn't install the kernel as
an rpm, then it might cause difficulties for the other rpm packages
which depended on the kernel. The "make rpm" command seems to require
you to be root, possibly (I'm no expert) as it uses the /usr/src/redhat
area.

Thanks everyone for their help!!

Matt

[lonely wolf]

Matthew East wrote:

> Yes in the README file with the kernel source it underlines that one
> should compile as user, and then su to install. But I was using the
> command "make rpm" as I thought that if I didn't install the kernel as
> an rpm, then it might cause difficulties for the other rpm packages
> which depended on the kernel. The "make rpm" command seems to require
> you to be root, possibly (I'm no expert) as it uses the /usr/src/redhat
> area.
>  
use http://erizo.ucdavis.edu/~dmk/notes/RPMs/Creating_RPMs.html as a 
guide for how to build rpm packages as normal user.

ps1: %_topdir    is enough to build rpm. the %_tmppath is just a 
security addon.
ps2: i have never succeeded in building rpm of non-modular kernels. 
"make rpm" fails while triyng the " make modules " part.