Fedora Core 5 Test Update: selinux-policy-2.2.29-3.fc5

[Daniel J Walsh]

---------------------------------------------------------------------
Fedora Test Update Notification
FEDORA-2006-271
2006-04-04
---------------------------------------------------------------------

Product     : Fedora Core 5
Name        : selinux-policy
Version     : 2.2.29                      
Release     : 3.fc5                  
Summary     : SELinux policy configuration
Description :
SELinux Reference Policy - modular.

---------------------------------------------------------------------
Update Information:

Update SELinux policy to current rawhide to fix many policy
problems



---------------------------------------------------------------------
* Tue Apr  4 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.29-3.fc5
- Bump for fc5
* Mon Apr  3 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.29-3
- Get auditctl working in MLS policy
* Mon Apr  3 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.29-2
- Add mono dbus support
- Lots of file_context fixes for textrel_shlib_t in FC5
- Turn off execmem auditallow since they are filling log files
* Thu Mar 30 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.29-1
- Update to upstream
* Thu Mar 30 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.28-3
- Allow automount and dbus to read cert files
* Thu Mar 30 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.28-2
- Fix ftp policy
- Fix secadm running of auditctl
* Mon Mar 27 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.28-1
- Update to upstream

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/testing/5/

3cab9d261fba619ee2484f9dddb653b49b0c16f3  SRPMS/selinux-policy-2.2.29-3.fc5.src.rpm
59d942385e7cb8cc74694138a052e6ce496f18bc  ppc/selinux-policy-2.2.29-3.fc5.noarch.rpm
cd7da7f8d897d19c0a96b0387f4d068afc23a16a 
ppc/selinux-policy-targeted-2.2.29-3.fc5.noarch.rpm
a79ad120a34528de5af2106b8e45aa2d57d31b5a  ppc/selinux-policy-mls-2.2.29-3.fc5.noarch.rpm
5d786584b6b7961b712a662df4d5951030ad701a 
ppc/selinux-policy-strict-2.2.29-3.fc5.noarch.rpm
59d942385e7cb8cc74694138a052e6ce496f18bc  x86_64/selinux-policy-2.2.29-3.fc5.noarch.rpm
cd7da7f8d897d19c0a96b0387f4d068afc23a16a 
x86_64/selinux-policy-targeted-2.2.29-3.fc5.noarch.rpm
a79ad120a34528de5af2106b8e45aa2d57d31b5a 
x86_64/selinux-policy-mls-2.2.29-3.fc5.noarch.rpm
5d786584b6b7961b712a662df4d5951030ad701a 
x86_64/selinux-policy-strict-2.2.29-3.fc5.noarch.rpm
59d942385e7cb8cc74694138a052e6ce496f18bc  i386/selinux-policy-2.2.29-3.fc5.noarch.rpm
cd7da7f8d897d19c0a96b0387f4d068afc23a16a 
i386/selinux-policy-targeted-2.2.29-3.fc5.noarch.rpm
a79ad120a34528de5af2106b8e45aa2d57d31b5a  i386/selinux-policy-mls-2.2.29-3.fc5.noarch.rpm
5d786584b6b7961b712a662df4d5951030ad701a 
i386/selinux-policy-strict-2.2.29-3.fc5.noarch.rpm

This update can be installed with the 'yum' update program.  Use 'yum update
package-name' at the command line.  For more information, refer to 'Managing
Software with yum,' available at http://fedora.redhat.com/docs/yum/.
---------------------------------------------------------------------

[dragoran]

Daniel Walsh wrote:
> ---------------------------------------------------------------------
>  Fedora Test Update Notification
>  FEDORA-2006-271
>  2006-04-04
>  ---------------------------------------------------------------------
>
>  Product     : Fedora Core 5
>  Name        : selinux-policy
>  Version     : 2.2.29                      
>  Release     : 3.fc5                  
>  Summary     : SELinux policy configuration
>  Description :
>  SELinux Reference Policy - modular.
>
>  ---------------------------------------------------------------------
>  Update Information:
>
>  Update SELinux policy to current rawhide to fix many policy
>  problems
>
>
>
>  ---------------------------------------------------------------------
>  * Tue Apr  4 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.29-3.fc5
>  - Bump for fc5
>  * Mon Apr  3 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.29-3
>  - Get auditctl working in MLS policy
>  * Mon Apr  3 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.29-2
>  - Add mono dbus support
>  - Lots of file_context fixes for textrel_shlib_t in FC5
>  - Turn off execmem auditallow since they are filling log files
>  * Thu Mar 30 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.29-1
>  - Update to upstream
>  * Thu Mar 30 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.28-3
>  - Allow automount and dbus to read cert files
>  * Thu Mar 30 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.28-2
>  - Fix ftp policy
>  - Fix secadm running of auditctl
>  * Mon Mar 27 2006 Dan Walsh <dwalsh(a)redhat.com&gt; 2.2.28-1
>  - Update to upstream
>
>  ---------------------------------------------------------------------
>  This update can be downloaded from:
>    http://download.fedora.redhat.com/pub/fedora/linux/core/updates/testing/5/
>
>  3cab9d261fba619ee2484f9dddb653b49b0c16f3  SRPMS/selinux-policy-2.2.29-3.fc5.src.rpm
>  59d942385e7cb8cc74694138a052e6ce496f18bc  ppc/selinux-policy-2.2.29-3.fc5.noarch.rpm
>  cd7da7f8d897d19c0a96b0387f4d068afc23a16a 
> ppc/selinux-policy-targeted-2.2.29-3.fc5.noarch.rpm
>  a79ad120a34528de5af2106b8e45aa2d57d31b5a  ppc/selinux-policy-mls-2.2.29-3.fc5.noarch.rpm
>  5d786584b6b7961b712a662df4d5951030ad701a 
> ppc/selinux-policy-strict-2.2.29-3.fc5.noarch.rpm
>  59d942385e7cb8cc74694138a052e6ce496f18bc  x86_64/selinux-policy-2.2.29-3.fc5.noarch.rpm
>  cd7da7f8d897d19c0a96b0387f4d068afc23a16a 
> x86_64/selinux-policy-targeted-2.2.29-3.fc5.noarch.rpm
>  a79ad120a34528de5af2106b8e45aa2d57d31b5a 
> x86_64/selinux-policy-mls-2.2.29-3.fc5.noarch.rpm
>  5d786584b6b7961b712a662df4d5951030ad701a 
> x86_64/selinux-policy-strict-2.2.29-3.fc5.noarch.rpm
>  59d942385e7cb8cc74694138a052e6ce496f18bc  i386/selinux-policy-2.2.29-3.fc5.noarch.rpm
>  cd7da7f8d897d19c0a96b0387f4d068afc23a16a 
> i386/selinux-policy-targeted-2.2.29-3.fc5.noarch.rpm
>  a79ad120a34528de5af2106b8e45aa2d57d31b5a 
> i386/selinux-policy-mls-2.2.29-3.fc5.noarch.rpm
>  5d786584b6b7961b712a662df4d5951030ad701a 
> i386/selinux-policy-strict-2.2.29-3.fc5.noarch.rpm
>
>  This update can be installed with the 'yum' update program.  Use 'yum update
>  package-name' at the command line.  For more information, refer to 'Managing
>  Software with yum,' available at http://fedora.redhat.com/docs/yum/.
>  ---------------------------------------------------------------------
>
>     
to avcs after boot:
audit(1144165927.130:2): avc:  denied  { use } for  pid=2815 
comm="bluez-pin" name="[8372]" dev=pipefs ino=8372 
scontext=user_u:system_r:bluetooth_helper_t:s0 
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=fd
audit(1144165927.130:3): avc:  denied  { use } for  pid=2815 
comm="bluez-pin" name="[8372]" dev=pipefs ino=8372 
scontext=user_u:system_r:bluetooth_helper_t:s0 
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=fd
don't know if they where present in the old version but I don't noticed 
anything because of to much execmem granted messages (that are finally 
gone!) (Turn off execmem auditallow since they are filling log files)

[Jason L Tibbitts III]

I received the following odd messages with this update:

>  sudo rpm -Fvh
> /usr/local/redhat/mirror-fedora/updates/testing/5/i386/selinux* 
Preparing...        
       ########################################### [100%]
   1:selinux-policy         ########################################### [ 50%]
   2:selinux-policy-targeted########################################### [100%]
libsemanage.semanage_install_active: Could not copy
/etc/selinux/targeted/modules/active/homedir_template to
/etc/selinux/targeted/contexts/files/homedir_template.
libsemanage.semanage_install_active: Could not copy
/etc/selinux/targeted/modules/active/homedir_template to
/etc/selinux/targeted/contexts/files/homedir_template.
semodule:  Failed!

I was previously running these from rawhide: 

selinux-policy-2.2.28-3
selinux-policy-targeted-2.2.28-3

so perhaps that has some bearing.  sestatus says:

SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 20
Policy from config file:        targeted

I'm not sure if the system is in a reasonable state at this point;
it's across town at the moment so I'm not sure if a reboot into the
new policy is a good idea.

 - J<

[Daniel J Walsh]

Jason L Tibbitts III wrote:
>  I received the following odd messages with this update:
>
>    
> > sudo rpm -Fvh /usr/local/redhat/mirror-fedora/updates/testing/5/i386/selinux*
> >     
>  Preparing...                ########################################### [100%]
>     1:selinux-policy         ########################################### [ 50%]
>     2:selinux-policy-targeted########################################### [100%]
>  libsemanage.semanage_install_active: Could not copy
> /etc/selinux/targeted/modules/active/homedir_template to
> /etc/selinux/targeted/contexts/files/homedir_template.
>  libsemanage.semanage_install_active: Could not copy
> /etc/selinux/targeted/modules/active/homedir_template to
> /etc/selinux/targeted/contexts/files/homedir_template.
>  semodule:  Failed!
>     
Did you get any avc messages?

>  I was previously running these from rawhide: 
>
>  selinux-policy-2.2.28-3
>  selinux-policy-targeted-2.2.28-3
>
>  so perhaps that has some bearing.  sestatus says:
>
>  SELinux status:                 enabled
>  SELinuxfs mount:                /selinux
>  Current mode:                   enforcing
>  Mode from config file:          enforcing
>  Policy version:                 20
>  Policy from config file:        targeted
>
>  I'm not sure if the system is in a reasonable state at this point;
>  it's across town at the moment so I'm not sure if a reboot into the
>  new policy is a good idea.
>
>   - J<
>
>

[Jason L Tibbitts III]

> >>>> "DJW" == Daniel J Walsh <Daniel>
> writes: 
DJW> Did you get any avc messages?

That system is constantly throwing denials from hald and mount, but
looking back through the log I see the following two messages at the
time I applied the update:

Apr  4 16:24:21 util10 kernel: audit(1144185861.320:675): avc:  denied  { write } for 
pid=19560 comm="semodule" name="files" dev=dm-0 ino=165314
scontext=user_u:system_r:semanage_t:s0 tcontext=system_u:object_r:file_context_t:s0
tclass=dir
Apr  4 16:24:21 util10 kernel: audit(1144185861.340:676): avc:  denied  { write } for 
pid=19560 comm="semodule" name="files" dev=dm-0 ino=165314
scontext=user_u:system_r:semanage_t:s0 tcontext=system_u:object_r:file_context_t:s0
tclass=dir

 - J<

[Daniel J Walsh]

Jason L Tibbitts III wrote:
> >>>>> "DJW" == Daniel J Walsh <Daniel>
> writes:
> >>>>>             
>
>  DJW> Did you get any avc messages?
>
>  That system is constantly throwing denials from hald and mount, but
>  looking back through the log I see the following two messages at the
>  time I applied the update:
>
>  Apr  4 16:24:21 util10 kernel: audit(1144185861.320:675): avc:  denied  { write } for 
> pid=19560 comm="semodule" name="files" dev=dm-0 ino=165314
> scontext=user_u:system_r:semanage_t:s0 tcontext=system_u:object_r:file_context_t:s0
> tclass=dir
>  Apr  4 16:24:21 util10 kernel: audit(1144185861.340:676): avc:  denied  { write } for 
> pid=19560 comm="semodule" name="files" dev=dm-0 ino=165314
> scontext=user_u:system_r:semanage_t:s0 tcontext=system_u:object_r:file_context_t:s0
> tclass=dir
>
>   - J<
>
>     
This rule should be in policy, but it might have been in this update. 

You can force the update by temporarily executing setenforce 0, or you 
could add this rule to policy via

grep semodule /var/log/messages | audit2allow -M temp

semodule -l temp.pp

Update rpm

semodule -r temp