warning about debian hotplug package 20040329-9!
warning warning warning, do not install hotplug version 20040329-9 from debian unstable because /etc/hotplug/net.rc attempts to write to /etc/hotplug/net.enable.
hotplug writing to /etc/ even /etc/hotplug is banned by the [present] selinux policy.
i'm raising a bugreport about this one if there isn't one already.
l.
Signature · 14 lines
-- Information I post is with honesty, integrity, and the expectation that you will take full responsibility if acting on the information contained, and that, should you find it to be flawed or even mildly useful, you will act with both honesty and integrity in return - and tell me. -- <a href="http://lkcl.net"> lkcl.net </a> <br /> <a href="mailto:[email protected]"> [email protected] </a> <br /> -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 8 lines · Luke Kenneth Casson Leighton
warning warning warning, do not install hotplug version 20040329-9 from debian unstable because
/etc/hotplug/net.rcattempts to write to/etc/hotplug/net.enable.hotplug writing to
/etc/even/etc/hotplugis banned by the [present] selinux policy.i'm raising a bugreport about this one if there isn't one already.
That package is broken in other ways. It doesn't work with PC-Card or Cardbus Ethernet devices doing DHCP. Just use -8.
Signature · 9 lines
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 11 lines · Russell Coker
Quoted 8 lines · Luke Kenneth Casson Leighton
warning warning warning, do not install hotplug version 20040329-9 from debian unstable because
/etc/hotplug/net.rcattempts to write to/etc/hotplug/net.enable.hotplug writing to
/etc/even/etc/hotplugis banned by the [present] selinux policy.i'm raising a bugreport about this one if there isn't one already.
That package is broken in other ways.
oh-ah? oops.
because it's being depended on in debian for quite a lot of things, like loading atmel wireless networking firmware.
Quoted 2 lines
It doesn't work with PC-Card or Cardbus
Ethernet devices doing DHCP.
hm, it's all scripted (sh, bash) so that should be fixable, oh well.
Quoted 1 line
Just use -8.
-8. i'm really sorry but i've not heard of -8, and a search with google strips away the "-".
do you have a url for it?
l.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 5 lines · Luke Kenneth Casson Leighton
Quoted 1 line
Just use -8.
-8. i'm really sorry but i've not heard of -8, and a search with google strips away the "-".
You reported a bug in -9, -8 is the one before it.
Signature · 10 lines
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 8 lines · Russell Coker
Quoted 5 lines · Luke Kenneth Casson Leighton
Quoted 1 line
Just use -8.
?
?-8. ?i'm really sorry but i've not heard of -8, and a search ?with google strips away the "-".You reported a bug in -9, -8 is the one before it.
...+*?? *click*.
*lol*. okay, i get it :)
hotplug-20040329-8.deb
l.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
A message that is not in the archive (sent off-list or not yet received): [email protected]
dear selinux and linux kernel,
i am after some assistance in clarifying how hotplug works, with a view to solving an issue with SE/Linux where the default SE/Linux policy is to deny write permission to /etc/hotplug (with good reason) but the hotplug package is presently demanding write permission.
a simple request for a change to writing to /var/state/hotplug instead has thrown up a number of issues with kernel (2.6.6) hotplugging and i would greatly appreciate some confirmation and some assistance.
i raised a bug with the debian maintainer for hotplug [he is known to be, how to describe in a few polite words, a control freak. coming from me, that's saying a lot].
i suggested that the location for files to be written to be moved to /var/state/hotplug and he CLOSED the bug with a message saying "you can't do that, /var might not be mounted at the time".
i reopened the bug, and then pointed out that the boottime order was "Mounting local filesystems" (/etc/init.d/mountall.sh) followed by "Starting Hotplug" (/etc/init.d/hotplug) and he responded with "well the kernel can run hotplug at any time".
which seems to me to be a bit daft: if you haven't initialised the hotplug system with /etc/init.d/hotplug, what's the point of responding to kernel-triggered hotplug events?
sounds like an issue with the kernel, there, to me.
can anyone on the linux kernel mailing list who has knowledge of the hotplug kernel stuff (and also who knows or is capable of knowing how the debian hotplug system works) confirm whether hotplug events will or will not be triggered by the kernel if you have NOT run the /etc/init.d/hotplug script?
for example, i'm staring at line 176 of /etc/hotplug/usb.rc (v 1.22) in version hotplug-20040329-8 and i note that usbdevfs is mounted on /proc/bus/usb.
a comment at line 148 and 164 makes it clear (ish) that a distro could mount usbdevfs, which could cause a "partial" initialisation of the usb hotplugging subsystem, and hotplug events could have been dropped as a result, or not properly started.
so, distros shouldn't _be_ doing a partial initialisation of the usb subsystem, basically!
anyway.
from this cursory examination, i would conclude that the argument used [to justify not moving state information to a new directory /var/state/hotplug] by the debian maintainer of hotplug that "the hotplug system may generate events at any time" is bogus.
e.g. under such circumstances where a distribution has initialised the usb hotplug system BEFORE /etc/init.d/hotplug start gets a chance to run "/etc/hotplug/usb.rc start", hotplug events are likely to get missed - not least because the filesystem might not have been initialised / mounted (except the root filesystem maybe) and consequently it's hazardous and problematic, and the usb.rc script has to reinvent some of the events it might have missed!!
l.
Quoted 20 lines · Jim McCullough
Quoted 18 lines · Luke Kenneth Casson Leighton
Quoted 15 lines · Russell Coker
Quoted 10 lines · Luke Kenneth Casson Leighton
warning warning warning, do not install hotplug version 20040329-9 from debian unstable because
/etc/hotplug/net.rcattempts to write to/etc/hotplug/net.enable.hotplug writing to
/etc/even/etc/hotplugis banned by the [present] selinux policy.i'm raising a bugreport about this one if there isn't one already.
That package is broken in other ways.
So then what if (horror of horrors) somebody puts "/var" on a usb disk device. (or some other type of device initialized by hotplug?)
Quoted 92 lines
dear selinux and linux kernel,
i am after some assistance in clarifying how hotplug works, with a view to solving an issue with SE/Linux where the default SE/Linux policy is to deny write permission to
/etc/hotplug(with good reason) but the hotplug package is presently demanding write permission.a simple request for a change to writing to
/var/state/hotpluginstead has thrown up a number of issues with kernel (2.6.6) hotplugging and i would greatly appreciate some confirmation and some assistance.i raised a bug with the debian maintainer for hotplug [he is known to be, how to describe in a few polite words, a control freak. coming from me, that's saying a lot].
i suggested that the location for files to be written to be moved to
/var/state/hotplugand he CLOSED the bug with a message saying "you can't do that, /var might not be mounted at the time".i reopened the bug, and then pointed out that the boottime order was "Mounting local filesystems" (
/etc/init.d/mountall.sh) followed by "Starting Hotplug" (/etc/init.d/hotplug) and he responded with "well the kernel can run hotplug at any time".which seems to me to be a bit daft: if you haven't initialised the hotplug system with
/etc/init.d/hotplug, what's the point of responding to kernel-triggered hotplug events?sounds like an issue with the kernel, there, to me.
can anyone on the linux kernel mailing list who has knowledge of the hotplug kernel stuff (and also who knows or is capable of knowing how the debian hotplug system works) confirm whether hotplug events will or will not be triggered by the kernel if you have NOT run the
/etc/init.d/hotplugscript?for example, i'm staring at line 176 of
/etc/hotplug/usb.rc(v 1.22) in version hotplug-20040329-8 and i note that usbdevfs is mounted on/proc/bus/usb.a comment at line 148 and 164 makes it clear (ish) that a distro could mount usbdevfs, which could cause a "partial" initialisation of the usb hotplugging subsystem, and hotplug events could have been dropped as a result, or not properly started.
so, distros shouldn't _be_ doing a partial initialisation of the usb subsystem, basically!
anyway.
from this cursory examination, i would conclude that the argument used [to justify not moving state information to a new directory
/var/state/hotplug] by the debian maintainer of hotplug that "the hotplug system may generate events at any time" is bogus.e.g. under such circumstances where a distribution has initialised the usb hotplug system BEFORE
/etc/init.d/hotplugstart gets a chance to run "/etc/hotplug/usb.rcstart", hotplug events are likely to get missed - not least because the filesystem might not have been initialised / mounted (except the root filesystem maybe) and consequently it's hazardous and problematic, and the usb.rc script has to reinvent some of the events it might have missed!!l.
Quoted 20 lines · Jim McCullough
Quoted 4 lines · Luke Kenneth Casson Leighton
Quoted 1 line · Russell Coker
On Sat, 10 Jul 2004 06:14, Luke Kenneth Casson Leighton
Quoted 13 lines
Quoted 13 lines
Quoted 10 lines · wrote:
warning warning warning, do not install hotplug version 20040329-9 from debian unstable because
/etc/hotplug/net.rcattempts to write to/etc/hotplug/net.enable.hotplug writing to
/etc/even/etc/hotplugis banned by the [present] selinux policy.i'm raising a bugreport about this one if there isn't one already.
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
That package is broken in other ways.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 2 lines · Chris Babcock
So then what if (horror of horrors) somebody puts "/var" on a usb disk device. (or some other type of device initialized by hotplug?)
or an nfs-mounted partition.
the suggestion in that case that i received by one of the hotplug developers / people-monitoring-debian-bugs-for-hotplug was that you should modify the /etc/hotplug scripts to use /devfs/shm/tmp instead, assuming that you have a debian initrd.
now, on SE/Linux that isn't possible, and the reason isn't entirely clear, but i believe that the access permissions to the tmpfs created by the debian initrd are such that when the umount tmpfs occurs, it actually _does_ unmount it.
on a standard debian/linux system (no selinux kernel) the initrd scripts attempt, amongst other things, to mount various filesystems and these are successful, but they are not _un_mounted properly later on.
anyway, i digress: the idea i came up with was that the debian package be modified such that it's possible to specify the state directory, even if that's one of a list of possible locations e.g. choose one: /etc/hotplug, /etc/hotplug/run, /var/run/hotplug, /devfs/shm/tmp, other.
consequently, if this were to be implemented, at least people mad enough to use usb disks or nfs mounted stuff, they'd be able to at least get going without having to hack the source of hotplug.
Quoted 12 lines
Quoted 12 lines
dear selinux and linux kernel,
i am after some assistance in clarifying how hotplug works, with a view to solving an issue with SE/Linux where the default SE/Linux policy is to deny write permission to
/etc/hotplug(with good reason) but the hotplug package is presently demanding write permission.a simple request for a change to writing to
/var/state/hotpluginstead has thrown up a number of issues with kernel (2.6.6) hotplugging and i would greatly appreciate some confirmation and some assistance.