SELinux: avc_has_perm: unexpected error 22
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouse
full xorg.0.log is here:
http://fpaste.org/OOM2/
Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouse
Quoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking, anyways looking through the commits I think this:
might be what I am hitting, causing gdm to die out, as it starts.
any ideas?
Justin P. Mattock
Quoted 23 lines · Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouseQuoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking, anyways looking through the commits I think this:
Quoted 8 lines
might be what I am hitting, causing gdm to die out, as it starts.
any ideas?
Justin P. Mattock
not sure if anybody is seeing this or hitting this with the current, but reverting the above commit does not fix the problem. will try another bisect(hopefully)
Justin P. Mattock
Quoted 29 lines · Justin P. Mattock
Quoted 28 lines · Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouseQuoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking, anyways looking through the commits I think this:
might be what I am hitting, causing gdm to die out, as it starts.
Quoted 7 lines
Quoted 3 lines
any ideas?
Justin P. Mattock
not sure if anybody is seeing this or hitting this with the current, but reverting the above commit does not fix the problem. will try another bisect(hopefully)
Are you sure it is a kernel issue? Seems more likely that it would be a policy problem. What AVC denials are you getting?
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 32 lines · Stephen Smalley
Quoted 31 lines · Justin P. Mattock
Quoted 30 lines · Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouseQuoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking, anyways looking through the commits I think this:
might be what I am hitting, causing gdm to die out, as it starts.
any ideas?
Quoted 9 lines
Quoted 5 lines
Quoted 1 line
Justin P. Mattock
not sure if anybody is seeing this or hitting this with the current, but reverting the above commit does not fix the problem. will try another bisect(hopefully)
Are you sure it is a kernel issue? Seems more likely that it would be a policy problem. What AVC denials are you getting?
strange.. was not even thinking of the avc's because the policy has already been customized and has been working for a while now without adding any rules.
Anyways your right, seems the labels get changed or something with this kernel or something:
http://fpaste.org/w4nK/
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 44 lines · Justin P. Mattock
Quoted 32 lines · Stephen Smalley
Quoted 31 lines · Justin P. Mattock
Quoted 30 lines · Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouseQuoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking, anyways looking through the commits I think this:
might be what I am hitting, causing gdm to die out, as it starts.
any ideas?
Quoted 9 lines
Quoted 5 lines
Quoted 1 line
Justin P. Mattock
not sure if anybody is seeing this or hitting this with the current, but reverting the above commit does not fix the problem. will try another bisect(hopefully)
Are you sure it is a kernel issue? Seems more likely that it would be a policy problem. What AVC denials are you getting?
Quoted 7 lines
strange.. was not even thinking of the avc's because the policy has already been customized and has been working for a while now without adding any rules.
Anyways your right, seems the labels get changed or something with this kernel or something:
http://fpaste.org/w4nK/
audit(1300983537.941:34): security_compute_sid: invalid context system_u:system_r:root_xdrawable_t:s0-s0:c0.c1023 for scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=x_drawable
This looks like it might be a kernel regression after all. security_compute_sid should return object_r for tclass x_drawable, not system_r. Likely due to the recent changes there to support socket type transitions. Not sure exactly what is going wrong, as it should only happen on the socket classes.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 58 lines · Stephen Smalley
Quoted 44 lines · Justin P. Mattock
Quoted 32 lines · Stephen Smalley
Quoted 31 lines · Justin P. Mattock
Quoted 30 lines · Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouseQuoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking, anyways looking through the commits I think this:
might be what I am hitting, causing gdm to die out, as it starts.
any ideas?
Quoted 9 lines
Quoted 5 lines
Quoted 1 line
Justin P. Mattock
not sure if anybody is seeing this or hitting this with the current, but reverting the above commit does not fix the problem. will try another bisect(hopefully)
Are you sure it is a kernel issue? Seems more likely that it would be a policy problem. What AVC denials are you getting?
Quoted 7 lines
strange.. was not even thinking of the avc's because the policy has already been customized and has been working for a while now without adding any rules.
Anyways your right, seems the labels get changed or something with this kernel or something:
http://fpaste.org/w4nK/audit(1300983537.941:34):
security_compute_sid: invalid context system_u:system_r:root_xdrawable_t:s0-s0:c0.c1023 for scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=x_drawable
Quoted 6 lines
This looks like it might be a kernel regression after all.
security_compute_sidshould returnobject_rfor tclassx_drawable, notsystem_r. Likely due to the recent changes there to support socket type transitions. Not sure exactly what is going wrong, as it should only happen on the socket classes.
alright!!
as for good kernel:
2.6.38-00071-g5a69473
is the last good one I have, so bisecting wont be too much but if I hit the breakage like last time it might slow things down and/or ruin the bisect.
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 66 lines · Justin P. Mattock
Quoted 58 lines · Stephen Smalley
Quoted 44 lines · Justin P. Mattock
Quoted 32 lines · Stephen Smalley
Quoted 31 lines · Justin P. Mattock
Quoted 30 lines · Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouseQuoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking, anyways looking through the commits I think this:
might be what I am hitting, causing gdm to die out, as it starts.
any ideas?
Quoted 9 lines
Quoted 5 lines
Quoted 1 line
Justin P. Mattock
not sure if anybody is seeing this or hitting this with the current, but reverting the above commit does not fix the problem. will try another bisect(hopefully)
Are you sure it is a kernel issue? Seems more likely that it would be a policy problem. What AVC denials are you getting?
Quoted 7 lines
strange.. was not even thinking of the avc's because the policy has already been customized and has been working for a while now without adding any rules.
Anyways your right, seems the labels get changed or something with this kernel or something:
http://fpaste.org/w4nK/audit(1300983537.941:34):
security_compute_sid: invalid context system_u:system_r:root_xdrawable_t:s0-s0:c0.c1023 for scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=x_drawableQuoted 6 lines
This looks like it might be a kernel regression after all.
security_compute_sidshould returnobject_rfor tclassx_drawable, notsystem_r. Likely due to the recent changes there to support socket type transitions. Not sure exactly what is going wrong, as it should only happen on the socket classes.
Quoted 7 lines
alright!!
as for good kernel:
2.6.38-00071-g5a69473
is the last good one I have, so bisecting wont be too much but if I hit the breakage like last time it might slow things down and/or ruin the bisect.
If it is what I think it is, then the breakage would be commit 6f5317e730505d5cbc851c435a2dfe3d5a21d343
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 69 lines · Stephen Smalley
Quoted 68 lines · Justin P. Mattock
Quoted 58 lines · Stephen Smalley
Quoted 44 lines · Justin P. Mattock
Quoted 32 lines · Stephen Smalley
Quoted 31 lines · Justin P. Mattock
Quoted 30 lines · Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouseQuoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking, anyways looking through the commits I think this:
might be what I am hitting, causing gdm to die out, as it starts.
any ideas?
Quoted 9 lines
Quoted 5 lines
Quoted 1 line
Justin P. Mattock
not sure if anybody is seeing this or hitting this with the current, but reverting the above commit does not fix the problem. will try another bisect(hopefully)
Are you sure it is a kernel issue? Seems more likely that it would be a policy problem. What AVC denials are you getting?
Quoted 7 lines
strange.. was not even thinking of the avc's because the policy has already been customized and has been working for a while now without adding any rules.
Anyways your right, seems the labels get changed or something with this kernel or something:
http://fpaste.org/w4nK/audit(1300983537.941:34):
security_compute_sid: invalid context system_u:system_r:root_xdrawable_t:s0-s0:c0.c1023 for scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=x_drawableQuoted 6 lines
This looks like it might be a kernel regression after all.
security_compute_sidshould returnobject_rfor tclassx_drawable, notsystem_r. Likely due to the recent changes there to support socket type transitions. Not sure exactly what is going wrong, as it should only happen on the socket classes.alright!!
Quoted 9 lines
Quoted 5 lines
as for good kernel:
2.6.38-00071-g5a69473
is the last good one I have, so bisecting wont be too much but if I hit the breakage like last time it might slow things down and/or ruin the bisect.If it is what I think it is, then the breakage would be commit
6f5317e730505d5cbc851c435a2dfe3d5a21d343
yep!
reverting that commit gets gdm to not crap out.
full dmesg here:
http://fpaste.org/34DC/
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Hi Justin,
Quoted 86 lines · Justin P. Mattock
Quoted 75 lines · Stephen Smalley
Quoted 74 lines · Justin P. Mattock
Quoted 63 lines · Stephen Smalley
Quoted 48 lines · Justin P. Mattock
Quoted 36 lines · Stephen Smalley
Quoted 35 lines · Justin P. Mattock
Quoted 33 lines · Justin P. Mattock
Quoted 14 lines · Justin P. Mattock
this is showing up with the latest Mainline kernel. gdm craps out..:
[ 60.817] (II) Unloading synaptics [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.822] SELinux: avc_has_perm: unexpected error 22 [ 60.828] SELinux: avc_has_perm: unexpected error 22 [ 60.831] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.871] SELinux: avc_has_perm: unexpected error 22 [ 60.881] (II) UnloadModule: "mouse" [ 60.881] (II) Unloading mouseQuoted 4 lines
full xorg.0.log is here:
http://fpaste.org/OOM2/Justin P. Mattock
seems doing a bisect right now during the merge window is breaking,
anyways looking through the commits I think this:might be what I am hitting, causing gdm to die out, as it starts.
any ideas?
Justin P. Mattock
Quoted 9 lines
Quoted 4 lines
not sure if anybody is seeing this or hitting this with the current,
but reverting the above commit does not fix the problem. will try another bisect(hopefully)Are you sure it is a kernel issue? Seems more likely that it would be a
policy problem. What AVC denials are you getting?Quoted 8 lines
strange.. was not even thinking of the avc's because the policy has already been customized and has been working for a while now without adding any rules.
Anyways your right, seems the labels get changed or something with this
kernel or something:
http://fpaste.org/w4nK/audit(1300983537.941:34):
security_compute_sid: invalid context system_u:system_r:root_xdrawable_t:s0-s0:c0.c1023 for scontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=x_drawableQuoted 7 lines
This looks like it might be a kernel regression after all.
security_compute_sidshould returnobject_rfor tclassx_drawable, notsystem_r. Likely due to the recent changes there to support socket type
transitions. Not sure exactly what is going wrong, as it should only happen on the socket classes.alright!!
Quoted 9 lines
Quoted 5 lines
as for good kernel:
2.6.38-00071-g5a69473
is the last good one I have, so bisecting wont be too much but if I hit the breakage like last time it might slow things down and/or ruin the bisect.If it is what I think it is, then the breakage would be commit
6f5317e730505d5cbc851c435a2dfe3d5a21d343
Quoted 8 lines
yep!
reverting that commit gets gdm to not crap out.
full dmesg here:
http://fpaste.org/34DC/Justin P. Mattock
So far I have not got an environment as your to reproduce this problem. Could you please kindly print the orig_class and the sock boolean in your case? It's weird since so far only the process and socket classes could retain the creator's role, any other classes object should have "object_r" as usual.
Many thanks for your help!
Best regards,
Harry
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 7 lines · Harry Ciao
So far I have not got an environment as your to reproduce this problem. Could you please kindly print the
orig_classand the sock boolean in your case? It's weird since so far only the process and socket classes could retain the creator's role, any other classes object should have "object_r" as usual.Many thanks for your help!
You can exercise the code without using XACE/XSELinux by running the compute_create program from libselinux/utils, e.g.
$ compute_create `id -Z` `id -Z` x_drawable
I think the bug lies in map_class() handling of the case where the userspace object class has no corresponding kernel class, as would be the case for the x_* classes. map_class() should likely return 0 (SECCLASS_NULL) in that case rather than pol_value and thereby ensure that we won't match any legitimate kernel class value.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 11 lines · Stephen Smalley
Quoted 7 lines · Harry Ciao
So far I have not got an environment as your to reproduce this problem. Could you please kindly print the
orig_classand the sock boolean in your case? It's weird since so far only the process and socket classes could retain the creator's role, any other classes object should have "object_r" as usual.Many thanks for your help!
You can exercise the code without using XACE/XSELinux by running the
compute_createprogram from libselinux/utils, e.g.
Quoted 7 lines
$ compute_create `id -Z` `id -Z` x_drawableI think the bug lies in
map_class()handling of the case where the userspace object class has no corresponding kernel class, as would be the case for the x_* classes.map_class()should likely return 0 (SECCLASS_NULL) in that case rather thanpol_valueand thereby ensure that we won't match any legitimate kernel class value.
To test this theory, Justin, can you try this patch?
security/selinux/ss/services.c +1 -1
@@ -213,7 +213,7 @@ static u16 map_class(u16 pol_value)return i; } -return pol_value; +return SECCLASS_NULL ; } static void map_decision(u16 tclass, struct av_decision *avd,
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
PATCH 1/1 selinux: Fix regression for Xorg
Commit 6f5317e730505d5cbc851c435a2dfe3d5a21d343 introduced a bug in the handling of userspace object classes that is causing breakage for Xorg when XSELinux is enabled. Fix the bug by changing map_class() to return SECCLASS_NULL when the class cannot be mapped to a kernel object class.
---
security/selinux/ss/services.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/selinux/ss/services.c +1 -1
@@ -213,7 +213,7 @@ static u16 map_class(u16 pol_value)return i; } -return pol_value; +return SECCLASS_NULL ; } static void map_decision(u16 tclass, struct av_decision *avd,
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] selinux: Fix regression for Xorg
alright!! patch applied to the current Mainline..
Yes this fixes the issue of gdm crapping out.
full dmesg below:
http://fpaste.org/Sgy7/
Quoted 18 lines
Commit
6f5317e730505d5cbc851c435a2dfe3d5a21d343introduced a bug in the handling of userspace object classes that is causing breakage for Xorg when XSELinux is enabled. Fix the bug by changingmap_class()to returnSECCLASS_NULLwhen the class cannot be mapped to a kernel object class.Reported-by "Justin P. Mattock"<[email protected]>Signed-off-by Stephen Smalley<[email protected]>---
security/selinux/ss/services.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)security/selinux/ss/services.c +0
-0
security/selinux/ss/services.c static u16 map_class(u16 pol_value)
Quoted 10 lines
security/selinux/ss/services.c +1
-2@@ -213,7 +213,7 @@ static u16 map_class(u16 pol_value)return i; } -return pol_value; +return SECCLASS_NULL ; } static void map_decision(u16 tclass, struct av_decision *avd, -- Stephen Smalley National Security Agency
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] selinux: Fix regression for Xorg
In reply to Stephen Smalleynot sure whats going on now.. but loading up the latest on my iMac with the below patch makes no difference I still hit the bug macbook pro works fine(maybe something with the different video drivers or something)
full dmesg of my iMac here:
http://fpaste.org/SNFC/
Quoted 19 lines
Commit
6f5317e730505d5cbc851c435a2dfe3d5a21d343introduced a bug in the handling of userspace object classes that is causing breakage for Xorg when XSELinux is enabled. Fix the bug by changingmap_class()to returnSECCLASS_NULLwhen the class cannot be mapped to a kernel object class.Reported-by "Justin P. Mattock"<[email protected]>Signed-off-by Stephen Smalley<[email protected]>---
security/selinux/ss/services.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)security/selinux/ss/services.c +0
-0
security/selinux/ss/services.c static u16 map_class(u16 pol_value) · line 219
Quoted 8 lines
security/selinux/ss/services.c +1
-1@@ -213,7 +213,7 @@ static u16 map_class(u16 pol_value)return i; } -return pol_value; +return SECCLASS_NULL ; } static void map_decision(u16 tclass, struct av_decision *avd,
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] selinux: Fix regression for Xorg
Quoted 6 lines · Justin P. Mattock
not sure whats going on now.. but loading up the latest on my iMac with the below patch makes no difference I still hit the bug macbook pro works fine(maybe something with the different video drivers or something)
full dmesg of my iMac here:
http://fpaste.org/SNFC/
Hi Justin,
I did before and after testing using the compute_create utility from libselinux/utils, and it showed that the kernel returned the wrong context prior to the patch and the right context afterward. I'm guessing you aren't booting the right kernel or didn't apply the patch correctly.
You can run:compute_create id -Z id -Z x_drawable
and see whether the returned context has object_r or not.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] selinux: Fix regression for Xorg
Quoted 16 lines · Stephen Smalley
Quoted 6 lines · Justin P. Mattock
not sure whats going on now.. but loading up the latest on my iMac with the below patch makes no difference I still hit the bug macbook pro works fine(maybe something with the different video drivers or something)
full dmesg of my iMac here:
http://fpaste.org/SNFC/Hi Justin,
I did before and after testing using the
compute_createutility from libselinux/utils, and it showed that the kernel returned the wrong context prior to the patch and the right context afterward. I'm guessing you aren't booting the right kernel or didn't apply the patch correctly.
Quoted 3 lines
You can run:
compute_createid -Zid -Zx_drawable
and see whether the returned context hasobject_ror not.
Also, I tested before and after the patch with Xorg, and confirmed that the compute_sid errors vanished when using a kernel with the patch applied.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] selinux: Fix regression for Xorg
Quoted 17 lines · Stephen Smalley
Quoted 16 lines · Stephen Smalley
Quoted 6 lines · Justin P. Mattock
not sure whats going on now.. but loading up the latest on my iMac with the below patch makes no difference I still hit the bug macbook pro works fine(maybe something with the different video drivers or something)
full dmesg of my iMac here:
http://fpaste.org/SNFC/Hi Justin,
I did before and after testing using the
compute_createutility from libselinux/utils, and it showed that the kernel returned the wrong context prior to the patch and the right context afterward. I'm guessing you aren't booting the right kernel or didn't apply the patch correctly.
Quoted 8 lines
Quoted 3 lines
You can run:
compute_createid -Zid -Zx_drawable
and see whether the returned context hasobject_ror not.Also, I tested before and after the patch with Xorg, and confirmed that the
compute_siderrors vanished when using a kernel with the patch applied.
I will retest that patch on that machine..(I was seeing crud with git) other than that on the macbook patch works fine.
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] selinux: Fix regression for Xorg
In reply to Stephen SmalleyQuoted 17 lines · Stephen Smalley
Quoted 16 lines · Stephen Smalley
Quoted 6 lines · Justin P. Mattock
not sure whats going on now.. but loading up the latest on my iMac with the below patch makes no difference I still hit the bug macbook pro works fine(maybe something with the different video drivers or something)
full dmesg of my iMac here:
http://fpaste.org/SNFC/Hi Justin,
I did before and after testing using the
compute_createutility from libselinux/utils, and it showed that the kernel returned the wrong context prior to the patch and the right context afterward. I'm guessing you aren't booting the right kernel or didn't apply the patch correctly.
Quoted 8 lines
Quoted 3 lines
You can run:
compute_createid -Zid -Zx_drawable
and see whether the returned context hasobject_ror not.Also, I tested before and after the patch with Xorg, and confirmed that the
compute_siderrors vanished when using a kernel with the patch applied.
appologize for that.. ended up putting the *_NULL in the wrong function(unmap).. after correcting that everything runs the way it should.
Thanks for the help on this!
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.