GNOME Running with MLS

[Anschuetz, Eric R CTR NAWCTSD, 4.6.2]

Hey all,

For the past week or so I've been attempting to get MLS running with a graphical
environment on RHEL 6.2, but I can't seem to figure out how a user with an elevated
level (say, a user running at level s2) can log in graphically. Users running at level s0
work fine. I've tried giving gnome and X binaries in /usr/bin s0-s15 privileges, but
still immediately get booted out after attempting to login. Even if I'm in permissive
mode and login, running setenforce 1 will immediately log me out and prevent me from
logging back in.

I guess in short I'm wondering--does anyone have any tips for running a desktop
environment with MLS?

Thanks!
Eric

[Douglas Brown]

Hi Eric,

First and foremost, I would use RHEL 6.4 because their has been some important MLS policy
improvements since 6.2, but even then, run level 5 multi-level logins don't yet really
work.

If you're familiar with Trusted Solaris / Trusted Extensions, multilevel GUIs are
quite complex and SELinux isn't quite there yet. That being said, I'm happy to see
someone else interested in this area.

Let me know if you're really interested and I can send you more details with what I
have "working" thus far.

Cheers,
Doug

From: <Anschuetz>, "<Eric R CTR NAWCTSD>", "4.6.2"
<[e-mail]<mailto:[e-mail]>>
Date: Thursday, 13 June 2013 11:02 PM
To:
"[e-mail]<mailto:[e-mail]>"
<[e-mail]<mailto:[e-mail]>>
Subject: GNOME Running with MLS

Hey all,

For the past week or so I've been attempting to get MLS running with a graphical
environment on RHEL 6.2, but I can't seem to figure out how a user with an elevated
level (say, a user running at level s2) can log in graphically. Users running at level s0
work fine. I've tried giving gnome and X binaries in /usr/bin s0-s15 privileges, but
still immediately get booted out after attempting to login. Even if I'm in permissive
mode and login, running setenforce 1 will immediately log me out and prevent me from
logging back in.

I guess in short I'm wondering--does anyone have any tips for running a desktop
environment with MLS?

Thanks!
Eric

[Anschuetz, Eric R CTR NAWCTSD, 4.6.2]

Doug,

Thanks for the quick response! I'll try upgrading to RHEL 6.4. What do you have
working so far?

Eric



From: Douglas Brown
Sent: Thu 6/13/2013 7:04 PM
To: Anschuetz, Eric R CTR NAWCTSD, 4.6.2
Cc: selinux(a)lists.fedoraproject.org
Subject: Re: GNOME Running with MLS


Hi Eric,


First and foremost, I would use RHEL 6.4 because their has been some important MLS policy
improvements since 6.2, but even then, run level 5 multi-level logins don't yet really
work.


If you're familiar with Trusted Solaris / Trusted Extensions, multilevel GUIs are
quite complex and SELinux isn't quite there yet. That being said, I'm happy to see
someone else interested in this area.


Let me know if you're really interested and I can send you more details with what I
have "working" thus far.


Cheers,
Doug


From: <Anschuetz>, "<Eric R CTR NAWCTSD>", "4.6.2"
<eric.r.anschuetz.ctr(a)navy.mil&gt;
Date: Thursday, 13 June 2013 11:02 PM
To: &quot;selinux(a)lists.fedoraproject.org&quot; <selinux(a)lists.fedoraproject.org&gt;
Subject: GNOME Running with MLS



Hey all,

For the past week or so I've been attempting to get MLS running with a graphical
environment on RHEL 6.2, but I can't seem to figure out how a user with an elevated
level (say, a user running at level s2) can log in graphically. Users running at level s0
work fine. I've tried giving gnome and X binaries in /usr/bin s0-s15 privileges, but
still immediately get booted out after attempting to login. Even if I'm in permissive
mode and login, running setenforce 1 will immediately log me out and prevent me from
logging back in.

I guess in short I'm wondering--does anyone have any tips for running a desktop
environment with MLS?

Thanks!
Eric

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/13/2013 09:02 AM, Anschuetz, Eric R CTR NAWCTSD, 4.6.2 wrote:
>  Hey all,
>  
>  For the past week or so I've been attempting to get MLS running with a
>  graphical environment on RHEL 6.2, but I can't seem to figure out how a
>  user with an elevated level (say, a user running at level s2) can log in
>  graphically. Users running at level s0 work fine. I've tried giving gnome
>  and X binaries in /usr/bin s0-s15 privileges, but still immediately get
>  booted out after attempting to login. Even if I'm in permissive mode and
>  login, running setenforce 1 will immediately log me out and prevent me from
>  logging back in.
>  
>  I guess in short I'm wondering--does anyone have any tips for running a
>  desktop environment with MLS?
>  
>  Thanks! Eric
>  
>  
>  -- selinux mailing list selinux(a)lists.fedoraproject.org 
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>   
Did you setup pam_namespace to have alternate homedirs and /tmp?

What AVC messages are you seeing?
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.13 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iEYEARECAAYFAlG/LcEACgkQrlYvE4MpobPuMACeNyEY73XiuKh9LvBfLsj/1Tot
> XeIAoMi5XTElNZS5S/sl+juPhv6AWQTc
> =FnQQ
> -----END PGP SIGNATURE-----