netlabel: UNLABELED ath9k not denying unlabeled traffic
When using netlabelctl on a dell laptop
I'm able to define the addresses that I want:
netlabelctl unlbl add interface:wlan0 address:<radiostation> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add interface:wlan0 address:<myaddress> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl -p unlbl accept off
{the above was from http://paulmoore.livejournal.com/1758.html };
(I'm able to listen to the radio station allowed, then if I choose another station; if I haven't defined an address like the above, mplayer just sits there.denying the unlabeled packet. that is until I allow the address);
The problem I have is when I do the same on my macbook pro ati chipset. with the ath9k module, I'm able to listen to any station, search the web etc.. it seems netlabelctl -p unlbl accept off makes no difference if it's on or off.
Is this built into ath9k yet, or is there something I'm missing?
regards;
Justin P. Mattock
Quoted 10 lines · Justin P. Mattock
When using netlabelctl on a dell laptop
I'm able to define the addresses that I want:netlabelctl unlbl add interface:wlan0 address:<radiostation> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add interface:wlan0 address:<myaddress> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl -p unlbl accept off
{the above was from http://paulmoore.livejournal.com/1758.html };
Hey, somebody actually reads that stuff! I guess I'll need to be careful what I write from now on :)
Hi Justin, on a more serious note, if you are having problems with labeled networking it's probably a good idea to CC the SELinux, LSM and/or netdev lists depending on the issue as I often miss mail if it is only posted to LKML. When in doubt you can just CC me personally ([email protected]) and I'll add whatever list seems appropriate.
Quoted 4 lines
(I'm able to listen to the radio station allowed, then if I choose another station; if I haven't defined an address like the above, mplayer just sits there.denying the unlabeled packet. that is until I allow the address);
Good, that is how it should work give the configuration shown above.
Quoted 7 lines
The problem I have is when I do the same on my macbook pro ati chipset. with the ath9k module, I'm able to listen to any station, search the web etc..
it seems netlabelctl -p unlbl accept off makes no difference if it's on or off.Is this built into ath9k yet, or is there something I'm missing?
That is just plain odd, there isn't really anything that is driver specific. Can you share any more details like kernel version, netlabel_tools verion, distro, etc? I don't have any ath9k hardware lying around to test so I would appreciate whatever additional information you can provide.
Signature · 2 lines
paul moore linux @ hp
Quoted 34 lines · Paul Moore
Quoted 11 lines · Justin P. Mattock
When using netlabelctl on a dell laptop
I'm able to define the addresses that I want:netlabelctl unlbl add interface:wlan0 address:<radiostation> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add interface:wlan0 address:<myaddress> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl -p unlbl accept off
{the above was from http://paulmoore.livejournal.com/1758.html };
Hey, somebody actually reads that stuff! I guess I'll need to be careful what I write from now on :)
Hi Justin, on a more serious note, if you are having problems with labeled networking it's probably a good idea to CC the SELinux, LSM and/or netdev lists depending on the issue as I often miss mail if it is only posted to LKML. When in doubt you can just CC me personally ([email protected]) and I'll add whatever list seems appropriate.
Quoted 5 lines
(I'm able to listen to the radio station allowed, then if I choose another station; if I haven't defined an address like the above, mplayer just sits there.denying the unlabeled packet. that is until I allow the address);
Good, that is how it should work give the configuration shown above.
Quoted 6 lines
The problem I have is when I do the same on my macbook pro ati chipset. with the ath9k module, I'm able to listen to any station, search the web etc..
it seems netlabelctl -p unlbl accept off makes no difference if it's on or off.
Quoted 6 lines
Quoted 2 lines
Is this built into ath9k yet, or is there something I'm missing?
That is just plain odd, there isn't really anything that is driver specific. Can you share any more details like kernel version,
netlabel_toolsverion, distro, etc? I don't have any ath9k hardware lying around to test so I would appreciate whatever additional information you can provide.
Hey alright.(I finally got around to trying netlabelctl out!).
The two systems I have for this are: Dell latitude x200
running ubuntu jaunty, kernel is 2.6.29-rc1.
with netlabel_tools_0.18 which was an rpm packaged
that I converted to .deb.(can't remember the repository where I grabbed it from); The wireless card for the dell is a dell 1350
using bcmxx(b43-phy0); works great.
The results when using netlabelctl with the dell is nice, i.g. like I said as soon as I issue netlabelctl unlbl accept off, those addresses not defined are simply not allowed.(the problem with the dell is I'm not seeing any allow rules being generated: i.g.
allow netlabel_peer_t netif_t:netif ingress;
allow netlabel_peer_t node_t:node recvfrom;
allow unlabeled_t netif_t:netif ingress;
allow unlabeled_t node_t:node recvfrom;
The next is a macbookpro ati chipset the kernel is 2.6.29-rc1 the o.s. is ubuntu jaunty, the netlabel_tools is the same as above. the only results I see out of this is the avc's it's generating (the allow rules above are from the macbook);
some reason the dell doesn't generate any avc's,
which makes me wonder is this a module issue.
Also I've gone through thinking, well maybe this is avc's driven,
i.g. each address once added by netlabelctl receives a certain allow rule (like the allow rules above),
if not either no allow rule is given to it,resulting in a denial you can't see in dmesg, or a denial that just won't be allowed by checkpolicy.
So after seeing if this was the case I was left with an address defined by netlabel(allowed) and defined the allow rules that it had created. unfortunately after all of that I still was able to turn on another radio station that had no address in netlabelctl's unlbl database.(and no allow rule with SELinux);
leading me to believe that the netlabel area or driver isn't working properly. or just told to not enforce the netlabel accept off option.
As for the list, I have linux-wireless in my address book(not sure which is right);
regards;
Justin P. Mattock
Quoted 13 lines · Justin P. Mattock
Quoted 12 lines · Paul Moore
Quoted 10 lines · Justin P. Mattock
When using netlabelctl on a dell laptop
I'm able to define the addresses that I want:netlabelctl unlbl add interface:wlan0 address:<radiostation> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add interface:wlan0 address:<myaddress> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl -p unlbl accept off
{the above was from http://paulmoore.livejournal.com/1758.html };
...
Quoted 12 lines
Quoted 12 lines
Quoted 11 lines
(I'm able to listen to the radio station allowed, then if I choose another station; if I haven't defined an address like the above, mplayer just sits there.denying the unlabeled packet. that is until I allow the address);
The problem I have is when I do the same on my macbook pro ati chipset. with the ath9k module, I'm able to listen to any station, search the web etc..
it seems netlabelctl -p unlbl accept off makes no difference if it's on or off.Is this built into ath9k yet, or is there something I'm missing?
Quoted 7 lines
Quoted 5 lines
That is just plain odd, there isn't really anything that is driver specific. Can you share any more details like kernel version,
netlabel_toolsverion, distro, etc? I don't have any ath9k hardware lying around to test so I would appreciate whatever additional information you can provide.Hey alright.(I finally got around to trying netlabelctl out!).
It's pretty cool. In newer versions of netlabelctl I added an undocumented option to actually allow it to fix a sandwhich and do the dishes afterwards. The exact command line option needed is left as an exercise for the reader :)
Quoted 7 lines
The two systems I have for this are: Dell latitude x200 running ubuntu jaunty, kernel is 2.6.29-rc1.
with netlabel_tools_0.18 which was an rpm packaged that I converted to .deb.(can't remember the repository where I grabbed it from);
The wireless card for the dell is a dell 1350
using bcmxx(b43-phy0); works great.
Great. I'm not a debian user so I can't be of much help on the packaging side, but you can get raw tarballs from the NetLabel project site on SF (the current release is 0.19 which includes support for all the goodies in 2.6.28):
Quoted 9 lines
The results when using netlabelctl with the dell is nice, i.g. like I said as soon as I issue netlabelctl unlbl accept off, those addresses not defined are simply not allowed.(the problem with the dell is I'm not seeing any allow rules being generated: i.g.
allow
netlabel_peer_tnetif_t:netif ingress;
allownetlabel_peer_tnode_t:node recvfrom;
allowunlabeled_tnetif_t:netif ingress;
allowunlabeled_tnode_t:node recvfrom;
[NOTE: the rules/permissions you list above are the "newer" network_peer permissions which are likely not active unless you are running a custom SELinux policy as the default Reference Policy hasn't made the switch yet to the newer system]
The netlabelctl tool doesn't generate any allow rules, all it does is configure the NetLabel subsystem which is all that is necessary because, this is important, NetLabel doesn't actually do any network traffic enforcement. NetLabel is a network labeling framework, which means that it only deals with setting labels on outbound network packets and retrieving labels from inbound network packets (the "netlabel unlbl accept on|off" option is a gray area). The decision about wether to accept or reject inbound network traffic is left to the LSM (NetLabel supports both SELinux and Smack). If you want I can go into more detail but it would probably be rather boring and not really provide you much in the way of answering your question.
Quoted 6 lines
The next is a macbookpro ati chipset the kernel is 2.6.29-rc1 the o.s. is ubuntu jaunty, the
netlabel_toolsis the same as above. the only results I see out of this is the avc's it's generating (the allow rules above are from the macbook);
some reason the dell doesn't generate any avc's,
which makes me wonder is this a module issue.
Huh. Just so I'm clear on this ... on the macbook you see avc denials that correspond to the allow rules you posted above, but on the dell you don't see the same avc denials? Are you running the same SELinux policy on both systems (version numbers)? What is the output of the following command on both systems?
# cat /selinux/policy_capabilities/network_peer_controls
Quoted 6 lines
Also I've gone through thinking, well maybe this is avc's driven, i.g. each address once added by netlabelctl receives a certain allow rule (like the allow rules above),
if not either no allow rule is given to it,resulting in a denial you can't see in dmesg,
or a denial that just won't be allowed by checkpolicy.
Quoted 8 lines
So after seeing if this was the case I was left with an address defined by netlabel(allowed) and defined the allow rules that it had created. unfortunately after all of that I still was able to turn on another radio station that had no address in netlabelctl's unlbl database.(and no allow rule
with SELinux);
leading me to believe that the netlabel area or driver isn't working properly. or just told to not enforce the netlabel accept off option.
Well, like I said above, it shouldn't be a policy module or allow rule problem but I think you may be right in that the SELinux policy is a good place to start looking. Compare the policy on the two systems to see if they are the same version and check to see if the new network peer controls are active (the cat command above; 0 is disabled, 1 is enabled). Post what you find out.
Quoted 2 lines
As for the list, I have linux-wireless in my address book(not sure which is right);
Not sure linux-wireless will have much to do about this but you included the SELinux which is good, thank you.
Signature · 2 lines
paul moore linux @ hp
Quoted 35 lines · Paul Moore
Quoted 13 lines · Justin P. Mattock
Quoted 12 lines · Paul Moore
Quoted 10 lines · Justin P. Mattock
When using netlabelctl on a dell laptop
I'm able to define the addresses that I want:netlabelctl unlbl add interface:wlan0 address:<radiostation> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add interface:wlan0 address:<myaddress> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl -p unlbl accept off
{the above was from http://paulmoore.livejournal.com/1758.html };
...
Quoted 18 lines
Quoted 17 lines
Quoted 11 lines
(I'm able to listen to the radio station allowed, then if I choose another station; if I haven't defined an address like the above, mplayer just sits there.denying the unlabeled packet. that is until I allow the address);
The problem I have is when I do the same on my macbook pro ati chipset. with the ath9k module, I'm able to listen to any station, search the web etc..
it seems netlabelctl -p unlbl accept off makes no difference if it's on or off.Is this built into ath9k yet, or is there something I'm missing?
That is just plain odd, there isn't really anything that is driver specific. Can you share any more details like kernel version,
netlabel_toolsverion, distro, etc? I don't have any ath9k hardware lying around to test so I would appreciate whatever additional information you can provide.
Quoted 6 lines
Quoted 1 line
Hey alright.(I finally got around to trying netlabelctl out!).
It's pretty cool. In newer versions of netlabelctl I added an undocumented option to actually allow it to fix a sandwhich and do the dishes afterwards. The exact command line option needed is left as an exercise for the reader :)
I hope it doesn't run afoul of this patent:
http://www.wipo.int/pctdb/en/wo.jsp?IA=US2005044838&WO=2006068865&DISPLAY=STATUS
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 4 lines · Stephen Smalley
Quoted 3 lines · Paul Moore
Quoted 2 lines · Justin P. Mattock
Quoted 1 line · Paul Moore
On Wednesday 14 January 2009 12:18:18 am Justin P. Mattock
Quoted 35 lines · wrote:
Quoted 35 lines
Quoted 11 lines
Quoted 11 lines
Quoted 11 lines
When using netlabelctl on a dell laptop
I'm able to define the addresses that I want:netlabelctl unlbl add interface:wlan0 address:<radiostation> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add interface:wlan0 address:<myaddress> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl -p unlbl accept off
{the above was from http://paulmoore.livejournal.com/1758.html
};...
Quoted 20 lines
Quoted 10 lines
Quoted 10 lines
(I'm able to listen to the radio station allowed, then if I choose another station; if I haven't defined an address like the above, mplayer just sits there.denying the unlabeled packet. that is until I allow the address);
The problem I have is when I do the same on my macbook pro ati chipset. with the ath9k module, I'm able to listen to any station, search the web etc..
it seems netlabelctl -p unlbl accept off makes no difference if it's on or off.Quoted 8 lines
Quoted 2 lines
Is this built into ath9k yet, or is there something I'm missing?
That is just plain odd, there isn't really anything that is driver specific. Can you share any more details like kernel version,
netlabel_toolsverion, distro, etc? I don't have any ath9k hardware lying around to test so I would appreciate whatever additional information you can provide.Hey alright.(I finally got around to trying netlabelctl out!).
Quoted 8 lines
Quoted 4 lines
It's pretty cool. In newer versions of netlabelctl I added an undocumented option to actually allow it to fix a sandwhich and do the dishes afterwards. The exact command line option needed is left as an exercise for the reader :)
I hope it doesn't run afoul of this patent:
http://www.wipo.int/pctdb/en/wo.jsp?IA=US2005044838&WO=2006068865&DIS
PLAY=STATUS
Sigh. I fear that it may, guess I'll have to pull feature from the next release :( What am I going to do for lunch now!
Signature · 7 lines
paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 8 lines · Paul Moore
Quoted 7 lines · Stephen Smalley
Quoted 4 lines · Paul Moore
It's pretty cool. In newer versions of netlabelctl I added an undocumented option to actually allow it to fix a sandwhich and do the dishes afterwards. The exact command line option needed is left as an exercise for the reader :)
Quoted 6 lines
Quoted 3 lines
I hope it doesn't run afoul of this patent:
http://www.wipo.int/pctdb/en/wo.jsp?IA=US2005044838&WO=2006068865&DIS
PLAY=STATUSSigh. I fear that it may, guess I'll have to pull feature from the next release :( What am I going to do for lunch now!
"pre-assembly of various sandwich components and simultaneous preparation of different parts of the same sandwich"
Unless netlabelctl is mutl-threaded I think you're safe based on the "simultaneous preparation" portion of the patent. I'm glad you've done this. I'm hungry, even if I have to wait for one part of the sandwich to be finished before it starts working on the next....
-Eric
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 24 lines · Eric Paris
Quoted 11 lines · Paul Moore
Quoted 9 lines · Stephen Smalley
Quoted 5 lines · Paul Moore
It's pretty cool. In newer versions of netlabelctl I added an undocumented option to actually allow it to fix a sandwhich and do the dishes afterwards. The exact command line option needed is left as an exercise for the reader :)
Quoted 7 lines
Quoted 4 lines
I hope it doesn't run afoul of this patent:
http://www.wipo.int/pctdb/en/wo.jsp?IA=US2005044838&WO=2006068865&DIS
PLAY=STATUSSigh. I fear that it may, guess I'll have to pull feature from the next release :( What am I going to do for lunch now!
"pre-assembly of various sandwich components and simultaneous preparation of different parts of the same sandwich"
Quoted 8 lines
Unless netlabelctl is mutl-threaded I think you're safe based on the "simultaneous preparation" portion of the patent. I'm glad you've done this. I'm hungry, even if I have to wait for one part of the sandwich to be finished before it starts working on the next....
-Eric
hot deal 2 big mac's for $3.50
this way while you're having one, the other
is being assembled.(but there's competition;
2 famous star's for $3.00);
regards;
Justin P. Mattock
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 39 lines · Paul Moore
Quoted 15 lines · Justin P. Mattock
Quoted 13 lines · Paul Moore
Quoted 11 lines · Justin P. Mattock
When using netlabelctl on a dell laptop
I'm able to define the addresses that I want:netlabelctl unlbl add interface:wlan0 address:<radiostation> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add interface:wlan0 address:<myaddress> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl -p unlbl accept off
{the above was from http://paulmoore.livejournal.com/1758.html };
...
Quoted 18 lines
Quoted 18 lines
Quoted 10 lines
(I'm able to listen to the radio station allowed, then if I choose another station; if I haven't defined an address like the above, mplayer just sits there.denying the unlabeled packet. that is until I allow the address);
The problem I have is when I do the same on my macbook pro ati chipset. with the ath9k module, I'm able to listen to any station, search the web etc..
it seems netlabelctl -p unlbl accept off makes no difference if it's on or off.Quoted 2 lines
Is this built into ath9k yet, or is there something I'm missing?
That is just plain odd, there isn't really anything that is driver specific. Can you share any more details like kernel version,
netlabel_toolsverion, distro, etc? I don't have any ath9k hardware lying around to test so I would appreciate whatever additional information you can provide.
Quoted 5 lines
Quoted 2 lines
Hey alright.(I finally got around to trying netlabelctl out!).
It's pretty cool. In newer versions of netlabelctl I added an undocumented option to actually allow it to fix a sandwhich and do the dishes afterwards. The exact command line option needed is left as an exercise for the reader :)
yep, it is pretty cool.
ultimately my goal with netlabel is to see if I can setup the network
namespace(if this is proper to say).
i.g. have all the radio stations in its own domain,(and possibly it's own tag,doi etc..) and then have all T.V. stations running in its own domain. and then web searching in its own domain. I see cipsov4 does this, but not sure if it does what the UNLABEL domain/protocol does. (just looking at cipsov4; look like ipsec, you need two computers setup with the same domain and tag etc..) not too sure though.
Quoted 10 lines
Quoted 9 lines
The two systems I have for this are: Dell latitude x200 running ubuntu jaunty, kernel is 2.6.29-rc1.
with netlabel_tools_0.18 which was an rpm packaged that I converted to .deb.(can't remember the repository where I grabbed it from);
The wireless card for the dell is a dell 1350
using bcmxx(b43-phy0); works great.
Quoted 4 lines
Great. I'm not a debian user so I can't be of much help on the packaging side, but you can get raw tarballs from the NetLabel project site on SF (the current release is 0.19 which includes support for all the goodies in 2.6.28):
I did grab that package but ran into the version_info error,(resorted to the rpm out of desperation);
Quoted 12 lines
Quoted 11 lines
The results when using netlabelctl with the dell is nice, i.g. like I said as soon as I issue netlabelctl unlbl accept off, those addresses not defined are simply not allowed.(the problem with the dell is I'm not seeing any allow rules being generated: i.g.
allow
netlabel_peer_tnetif_t:netif ingress;
allownetlabel_peer_tnode_t:node recvfrom;
allowunlabeled_tnetif_t:netif ingress;
allowunlabeled_tnode_t:node recvfrom;
Quoted 4 lines
[NOTE: the rules/permissions you list above are the "newer"
network_peerpermissions which are likely not active unless you are running a custom SELinux policy as the default Reference Policy hasn't made the switch yet to the newer system]The netlabelctl tool doesn't generate any allow rules, all it does is configure the NetLabel subsystem which is all that is necessary because, this is important, NetLabel doesn't actually do any network traffic enforcement. NetLabel is a network labeling framework, which means that it only deals with setting labels on outbound network packets and retrieving labels from inbound network packets (the "netlabel unlbl accept on|off" option is a gray area). The decision about wether to accept or reject inbound network traffic is left to the LSM (NetLabel supports both SELinux and Smack). If you want I can go into more detail but it would probably be rather boring and not really provide you much in the way of answering your question.
boring to others, but to me, it's awesome.
Quoted 9 lines
Quoted 8 lines
The next is a macbookpro ati chipset the kernel is 2.6.29-rc1 the o.s. is ubuntu jaunty, the
netlabel_toolsis the same as above. the only results I see out of this is the avc's it's generating (the allow rules above are from the macbook);
some reason the dell doesn't generate any avc's,
which makes me wonder is this a module issue.
Quoted 4 lines
Huh. Just so I'm clear on this ... on the macbook you see avc denials that correspond to the allow rules you posted above, but on the dell you don't see the same avc denials? Are you running the same SELinux policy on both systems (version numbers)? What is the output of the following command on both systems?
# cat /selinux/policy_capabilities/network_peer_controls
for both systems I'm running the refpolicy(svn) from tresys. the new ubac options, and newrole mechanism etc..
doing cat /selinux/policy_capabilities_netowork_peer_controls says "1" should be for both.
Quoted 17 lines
Quoted 16 lines
Also I've gone through thinking, well maybe this is avc's driven, i.g. each address once added by netlabelctl receives a certain allow rule (like the allow rules above),
if not either no allow rule is given to it,resulting in a denial you can't see in dmesg,
or a denial that just won't be allowed by checkpolicy.
So after seeing if this was the case I was left with an address defined by netlabel(allowed) and defined the allow rules that it had created. unfortunately after all of that I still was able to turn on another radio station that had no address in netlabelctl's unlbl database.(and no allow rule
with SELinux);
leading me to believe that the netlabel area or driver isn't working properly. or just told to not enforce the netlabel accept off option.
Quoted 2 lines
Well, like I said above, it shouldn't be a policy module or allow rule problem but I think you may be right in that the SELinux policy is a good place to start looking. Compare the policy on the two systems to see if they are the same version and check to see if the new network peer controls are active (the cat command above; 0 is disabled, 1 is enabled). Post what you find out.
they should be for both(uncommenting in /etc/selinux/refpolicy/policy/policy_capabilities enables that option);
I think at this point I'm going to load an older kernel, with the madwifi module(ath0) to isolate this issue i.g. if ath0 module reacts the same as the dell does(when adding address and such); then this would point me in the right direction. but if I receive the same response. then maybe my libraries are messed up.
Quoted 8 lines
Quoted 4 lines
As for the list, I have linux-wireless in my address book(not sure which is right);
Not sure linux-wireless will have much to do about this but you included the SELinux which is good, thank you.
overall I like this netlabel mechanism, hopefully I can get this working properly.
regards;
Justin P. Mattock
Quoted 2 lines · Justin P. Mattock
Quoted 1 line · Paul Moore
On Wednesday 14 January 2009 11:15:46 am Justin P. Mattock wrote:
...
Quoted 3 lines
yep, it is pretty cool.
ultimately my goal with netlabel is to see if I can setup the network namespace(if this is proper to say).
I understand what you are trying to say but I don't believe "namespace" is the term you want to use since it is already used by the container folks for something completely different.
Quoted 4 lines
i.g. have all the radio stations in its own domain,(and possibly
it's own tag,doi etc..)
and then have all T.V. stations running in its own domain. and then web searching in its own domain.
Yep, you can do that with NetLabel and the fallback/static labels like you've been doing. Based on what I've seen from you so far, Secmark would also likely work for you but it takes a slightly different approach (configuration with iptables, different allow rules).
Quoted 5 lines
I see cipsov4 does this, but not sure if it does what the UNLABEL domain/protocol does.
(just looking at cipsov4; look like ipsec, you need two computers setup with the same domain and tag etc..)
not too sure though.
Yep, CIPSO is a labeling protocol like labeled IPsec. Both have their advantages and disadvantages but both require that the other end of the connection support the labeling protocol. Since you are talking about labeling public network traffic it is almost certain that the other end of your connections don't support a network labeling protocol. The fallback/static labeling capabilities of NetLabel (that is the "unlabeled/unlbl" protocol in NetLabel, it is "unlabeled" because there is no label present on the network traffic) was designed to solve this case for the network peer label case. Secmark was designed to solve this for the iptables label case.
If you don't understand the difference between a network peer label and a network iptables label here is the executive summary:
"A network peer label represents the security attributes of the
traffic's sender, a iptables label represents the network attributes of the traffic."
... which basically means the peer label tells you about the process/host which generated the data (SELinux context, Smack label, etc.) while the iptables label tells you about the network headers of the traffic (destination address, protocol, port, anything that iptables/netfilter can match on).
Quoted 13 lines
Quoted 13 lines
Quoted 7 lines
The two systems I have for this are: Dell latitude x200 running ubuntu jaunty, kernel is 2.6.29-rc1.
with netlabel_tools_0.18 which was an rpm packaged that I converted to .deb.(can't remember the repository where I grabbed it from);
The wireless card for the dell is a dell 1350
using bcmxx(b43-phy0); works great.Great. I'm not a debian user so I can't be of much help on the packaging side, but you can get raw tarballs from the NetLabel project site on SF (the current release is 0.19 which includes support for all the goodies in 2.6.28):
Quoted 4 lines
Quoted 1 line
I did grab that package but ran into the
version_infoerror,(resorted to the rpm out of desperation);
Hmm, can you show me the error? I'd like to make sure it is fixed ...
Quoted 28 lines
Quoted 15 lines
Quoted 9 lines
The results when using netlabelctl with the dell is nice, i.g. like I said as soon as I issue netlabelctl unlbl accept off, those addresses not defined are simply not allowed.(the problem with the dell is I'm not seeing any allow rules being generated: i.g.
allow
netlabel_peer_tnetif_t:netif ingress;
allownetlabel_peer_tnode_t:node recvfrom;
allowunlabeled_tnetif_t:netif ingress;
allowunlabeled_tnode_t:node recvfrom;[NOTE: the rules/permissions you list above are the "newer"
network_peerpermissions which are likely not active unless you are running a custom SELinux policy as the default Reference Policy hasn't made the switch yet to the newer system]Quoted 12 lines
The netlabelctl tool doesn't generate any allow rules, all it does is configure the NetLabel subsystem which is all that is necessary because, this is important, NetLabel doesn't actually do any network traffic enforcement. NetLabel is a network labeling framework, which means that it only deals with setting labels on outbound network packets and retrieving labels from inbound network packets (the "netlabel unlbl accept on|off" option is a gray area).
The decision about wether to accept or reject inbound network
traffic is left to the LSM (NetLabel supports both SELinux and Smack). If you want I can go into more detail but it would probably be rather boring and not really provide you much in the way of answering your question.
Quoted 1 line
boring to others, but to me, it's awesome.
I think so too :)
Quoted 13 lines
Quoted 13 lines
Quoted 6 lines
The next is a macbookpro ati chipset the kernel is 2.6.29-rc1 the o.s. is ubuntu jaunty, the
netlabel_toolsis the same as above. the only results I see out of this is the avc's it's generating (the allow rules above are from the macbook); some reason the dell doesn't generate any avc's, which makes me wonder is this a module issue.Huh. Just so I'm clear on this ... on the macbook you see avc denials that correspond to the allow rules you posted above, but on the dell you don't see the same avc denials? Are you running the same SELinux policy on both systems (version numbers)? What is the output of the following command on both systems?
Quoted 6 lines
Quoted 1 line
# cat /selinux/policy_capabilities/network_peer_controlsfor both systems I'm running the refpolicy(svn) from tresys. the new ubac options, and newrole mechanism etc..
doing cat /selinux/policy_capabilities_netowork_peer_controls says "1" should be for both.
Ahhhh! How did that happen?! (see my response to your other email)
Signature · 2 lines
paul moore linux @ hp
Quoted 1 line · Paul Moore
On Wednesday 14 January 2009 12:32:35 pm Justin P. Mattock wrote:
...
Quoted 13 lines
Quoted 13 lines
Quoted 13 lines
Quoted 6 lines
The next is a macbookpro ati chipset the kernel is 2.6.29-rc1 the o.s. is ubuntu jaunty, the
netlabel_toolsis the same as above. the only results I see out of this is the avc's it's generating (the allow rules above are from the macbook); some reason the dell doesn't generate any avc's, which makes me wonder is this a module issue.Huh. Just so I'm clear on this ... on the macbook you see avc denials that correspond to the allow rules you posted above, but on the dell you don't see the same avc denials? Are you running the same SELinux policy on both systems (version numbers)? What is the output of the following command on both systems?
Quoted 8 lines
Quoted 6 lines
Quoted 1 line
# cat /selinux/policy_capabilities/network_peer_controlsfor both systems I'm running the refpolicy(svn) from tresys. the new ubac options, and newrole mechanism etc..
doing cat /selinux/policy_capabilities_netowork_peer_controls says "1" should be for both.Ahhhh! How did that happen?! (see my response to your other email)
Sorry, just realized your other email was private. In case anyone else is following this thread, the SELinux policy for network_peer_controls policy capability is still a work in progress and is disabled by default because there are still a few issues remaining. Disabling the network_peer_controls (the default configuration) fixed the problem.
Signature · 2 lines
paul moore linux @ hp
Quoted 28 lines · Paul Moore
Quoted 2 lines · Paul Moore
On Wednesday 14 January 2009 12:32:35 pm Justin P. Mattock wrote:
...
Quoted 20 lines
Quoted 20 lines
Quoted 7 lines
Quoted 7 lines
The next is a macbookpro ati chipset the kernel is 2.6.29-rc1 the o.s. is ubuntu jaunty, the
netlabel_toolsis the same as above. the only results I see out of this is the avc's it's generating (the allow rules above are from the macbook); some reason the dell doesn't generate any avc's, which makes me wonder is this a module issue.Quoted 8 lines
Huh. Just so I'm clear on this ... on the macbook you see avc denials that correspond to the allow rules you posted above, but on the dell you don't see the same avc denials? Are you running the same SELinux policy on both systems (version numbers)? What is the output of the following command on both systems?
# cat /selinux/policy_capabilities/network_peer_controlsfor both systems I'm running the refpolicy(svn) from tresys. the new ubac options, and newrole mechanism etc..
doing cat /selinux/policy_capabilities_netowork_peer_controls says "1" should be for both.
Quoted 6 lines
Quoted 2 lines
Ahhhh! How did that happen?! (see my response to your other email)
Sorry, just realized your other email was private. In case anyone else is following this thread, the SELinux policy for
network_peer_controlspolicy capability is still a work in progress and is disabled by default because there are still a few issues remaining. Disabling thenetwork_peer_controls(the default configuration) fixed the problem.
Cool, that's what I figured when looking at cipsov4.
As for the namespace term(yeah I don't know the term; ahh different domain's or mappings I think);
Anyways heres what I'm trying to achieve:
default looks like this:
Configured NetLabel domain mappings(1)
domain: DEFAULT
protocol: UNLABELED
I want to try and have three of these for the
different types of media:
(in theory)
Configured NetLabel domain mappings(3)
domain:radio
protocol: UNLABELED
domain:T.V.
protocol: UNLABELED
domain:web
protocol: UNLABELED
(and if possible three different tags(either 1,2,5), but probably can only do that with cipsov4);
heres what I've come up with so far:
netlabelctl -p map del default
netlabelctl unlbl add domain:radio interface:wlan0 address:<myadd> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add domain:radio interface:wlan0 address:<radioadd> label:system_u:object_r:netlabel_peer_t:s0
netlabelctl unlbl add domain:T.V. interface:wlan0 address:<myadd> label:system_u:object_r:netlabel_peer_t:s0 netlabelctl unlbl add domain:T.V. interface:wlan0 address:<t.v.add> label:system_u:object_r:netlabel_peer_t:s0
As for the new capabilities, I don't mind trying that out when the time comes(but first I need to figure the this out before any other ways);
here is what the error looks like:
netlabel_tools-0.19# make
INFO: creating the version header file
.: 10: version_info: not found
make: *** [include/version.h] Error 2
(googling for the missing package results in a bunch of hits on "just do a uname -r");
In any case using the default, and then just adding addresses is probably fine for the time being.
regards;
Justin P. Mattock
Quoted 7 lines · Justin P. Mattock
Anyways heres what I'm trying to achieve:
default looks like this:
Configured NetLabel domain mappings(1)
domain: DEFAULT
protocol: UNLABELED
Quoted 12 lines
I want to try and have three of these for the
different types of media:
(in theory)
Configured NetLabel domain mappings(3)
domain:radio
protocol: UNLABELED
domain:T.V.
protocol: UNLABELED
domain:web
protocol: UNLABELED
(and if possible three differenttags(either 1,2,5), but probably can only do that with cipsov4);
Actually, in your case you are probably always going to want to send network traffic without any labels attached to the packets (no labeled IPsec or CIPSO) so you can stick with the default domain mapping configuration which sends all packets "unlabeled". The part you should be concerned about is the static/fallback configuration which assigns network peer labels to packets which do not have labels attached to them by the remote host.
NOTE: the domain mapping configuration only controls how outbound network traffic is labeled on-the-wire; it "maps" the LSM/SELinux "domains" to a specific labeling protocol configuration, e.g. all apache_t traffic should be labeled with CIPSO DOI 3 while all firefox_t traffic should not be labeled at all.
Quoted 9 lines
heres what I've come up with so far:
netlabelctl -p map del default
netlabelctl unlbl add domain:radio interface:wlan0 address:<myadd> label:system_u:object_r:netlabel_peer_t:s0
netlabelctl unlbl add domain:radio interface:wlan0 address:<radioadd> label:system_u:object_r:netlabel_peer_t:s0
Quoted 4 lines
netlabelctl unlbl add domain:T.V. interface:wlan0 address:<myadd> label:system_u:object_r:netlabel_peer_t:s0
netlabelctl unlbl add domain:T.V. interface:wlan0 address:<t.v.add> label:system_u:object_r:netlabel_peer_t:s0
I think what you mean to type is the following:
# netlabelctl unlbl add interface:wlan0 address:<radioadd> \
label:system_u:object_r:netlabel_peer_t:s0... note there is no "domain" argument, that only exists for "netlabelctl map ..." commands.
NOTE: if you really want to get fancy you can create new SELinux domains for each type of media and add NetLabel configurations for those new domains. Imagine you create a new "internet_radio_t" domain/type and only allow the "netplayer_t" domain (yeah, I made that up but you get the point) access to network traffic labeled with internet_radio_t. You would then use the following command to label your incoming traffic with NetLabel:
# netlabelctl unlbl add interface:wlan0 address:<radioadd> \
label:system_u:object_r:internet_radio_t:s0NOTE: you can also skip the "interface:wlan0" argument and just use "default" instead if you want the configuration to apply to all your network interfaces; although bear in mind that the "default" configuration can be overridden by the interface specific configurations.
Quoted 3 lines
As for the new capabilities, I don't mind trying that out when the time comes(but first I need to figure the this out before any other ways);
No problem, I understand. Let me know if you have any more problems.
Quoted 6 lines
here is what the error looks like:
netlabel_tools-0.19# make
INFO: creating the version header file
.: 10:version_info: not found
make: *** [include/version.h] Error 2
Huh, can you try the following:
1. Open the netlabel_tools-0.19/Makefile in your favorite editor
2. Change the ". version_info; \" line to "source ./version_info; \"
3. Save your changes
4. Try running "make" again
Thanks.
Signature · 2 lines
paul moore linux @ hp
Quoted 9 lines · Paul Moore
Quoted 7 lines · Justin P. Mattock
Anyways heres what I'm trying to achieve:
default looks like this:
Configured NetLabel domain mappings(1)
domain: DEFAULT
protocol: UNLABELED
Quoted 15 lines
Quoted 4 lines
I want to try and have three of these for the
different types of media:
(in theory)
Configured NetLabel domain mappings(3)Quoted 9 lines
domain:radio
protocol: UNLABELED
domain:T.V.
protocol: UNLABELED
domain:web
protocol: UNLABELED
(and if possible three differenttags(either 1,2,5), but probably can only do that with cipsov4);
apologize for the slow response
(had to do some external activities);
Quoted 2 lines
Actually, in your case you are probably always going to want to send network traffic without any labels attached to the packets (no labeled IPsec or CIPSO) so you can stick with the default domain mapping configuration which sends all packets "unlabeled". The part you should be concerned about is the static/fallback configuration which assigns network peer labels to packets which do not have labels attached to them by the remote host.
sure would be nice to use ipsec/cipsov4 with a internet radio. (lock down that tcp line);
I'll have to look into making sure I have static/fallback configured correctly.
Quoted 23 lines
NOTE: the domain mapping configuration only controls how outbound network traffic is labeled on-the-wire; it "maps" the LSM/SELinux "domains" to a specific labeling protocol configuration, e.g. all
apache_ttraffic should be labeled with CIPSO DOI 3 while allfirefox_ttraffic should not be labeled at all.Quoted 9 lines
heres what I've come up with so far:
netlabelctl -p map del default
netlabelctl unlbl add domain:radio interface:wlan0 address:<myadd> label:system_u:object_r:netlabel_peer_t:s0
netlabelctl unlbl add domain:radio interface:wlan0 address:<radioadd> label:system_u:object_r:netlabel_peer_t:s0Quoted 5 lines
netlabelctl unlbl add domain:T.V. interface:wlan0 address:<myadd> label:system_u:object_r:netlabel_peer_t:s0
netlabelctl unlbl add domain:T.V. interface:wlan0 address:<t.v.add> label:system_u:object_r:netlabel_peer_t:s0I think what you mean to type is the following:
# netlabelctl unlbl add interface:wlan0 address:<radioadd> \ label:system_u:object_r:netlabel_peer_t:s0
Quoted 10 lines
... note there is no "domain" argument, that only exists for "netlabelctl map ..." commands.
NOTE: if you really want to get fancy you can create new SELinux domains for each type of media and add NetLabel configurations for those new domains. Imagine you create a new "
internet_radio_t" domain/type and only allow the "netplayer_t" domain (yeah, I made that up but you get the point) access to network traffic labeled withinternet_radio_t. You would then use the following command to label your incoming traffic with NetLabel:# netlabelctl unlbl add interface:wlan0 address:<radioadd> \ label:system_u:object_r:internet_radio_t:s0NOTE: you can also skip the "interface:wlan0" argument and just use "default" instead if you want the configuration to apply to all your network interfaces; although bear in mind that the "default" configuration can be overridden by the interface specific configurations.
Alright, I thought you could use the map option for unlbl.
Quoted 16 lines
Quoted 4 lines
As for the new capabilities, I don't mind trying that out when the time comes(but first I need to figure the this out before any other ways);
No problem, I understand. Let me know if you have any more problems.
Quoted 7 lines
here is what the error looks like:
netlabel_tools-0.19# make
INFO: creating the version header file
.: 10:version_info: not found
make: *** [include/version.h] Error 2
Quoted 10 lines
Huh, can you try the following:
1. Open the netlabel_tools-0.19/Makefile in your favorite editor
2. Change the ".version_info; \" line to "source ./version_info; \"
3. Save your changes
4. Try running "make" againThanks.
Thanks for the info,
Ill try this right away and let you know
if the package compiles.
regards;
Justin P. Mattock
Quoted 3 lines · Justin P. Mattock
Paul Moore wrote:
apologize for the slow response
(had to do some external activities);
No problem, I've got a day job too :)
Quoted 6 lines
Quoted 6 lines
NOTE: the domain mapping configuration only controls how outbound network traffic is labeled on-the-wire; it "maps" the LSM/SELinux "domains" to a specific labeling protocol configuration, e.g. all
apache_ttraffic should be labeled with CIPSO DOI 3 while allfirefox_ttraffic should not be labeled at all.
...
Quoted 19 lines
Quoted 19 lines
I think what you mean to type is the following:
# netlabelctl unlbl add interface:wlan0 address:<radioadd> \ label:system_u:object_r:netlabel_peer_t:s0... note there is no "domain" argument, that only exists for "netlabelctl map ..." commands.
NOTE: if you really want to get fancy you can create new SELinux domains for each type of media and add NetLabel configurations for those new domains. Imagine you create a new "
internet_radio_t" domain/type and only allow the "netplayer_t" domain (yeah, I made that up but you get the point) access to network traffic labeled withinternet_radio_t. You would then use the following command to label your incoming traffic with NetLabel:# netlabelctl unlbl add interface:wlan0 address:<radioadd> \ label:system_u:object_r:internet_radio_t:s0
Quoted 7 lines
Quoted 5 lines
NOTE: you can also skip the "interface:wlan0" argument and just use "default" instead if you want the configuration to apply to all your network interfaces; although bear in mind that the "default" configuration can be overridden by the interface specific configurations.
Alright, I thought you could use the map option for unlbl.
Yes, you can use configure the LSM/SELinux domain mapping to send unlabeled/"unlbl" packets (the default configuration maps all outbound traffic to "unlbl") but since you only really care about inbound traffic you can ignore the "map" option.
Signature · 2 lines
paul moore linux @ hp
Quoted 74 lines · Paul Moore
Quoted 7 lines · Justin P. Mattock
Anyways heres what I'm trying to achieve:
default looks like this:
Configured NetLabel domain mappings(1)
domain: DEFAULT
protocol: UNLABELEDQuoted 13 lines
I want to try and have three of these for the
different types of media:
(in theory)
Configured NetLabel domain mappings(3)
domain:radio
protocol: UNLABELED
domain:T.V.
protocol: UNLABELED
domain:web
protocol: UNLABELED
(and if possible three differenttags(either 1,2,5), but probably can only do that with cipsov4);Actually, in your case you are probably always going to want to send network traffic without any labels attached to the packets (no labeled IPsec or CIPSO) so you can stick with the default domain mapping configuration which sends all packets "unlabeled". The part you should be concerned about is the static/fallback configuration which assigns network peer labels to packets which do not have labels attached to them by the remote host.
NOTE: the domain mapping configuration only controls how outbound network traffic is labeled on-the-wire; it "maps" the LSM/SELinux "domains" to a specific labeling protocol configuration, e.g. all
apache_ttraffic should be labeled with CIPSO DOI 3 while allfirefox_ttraffic should not be labeled at all.Quoted 9 lines
heres what I've come up with so far:
netlabelctl -p map del default
netlabelctl unlbl add domain:radio interface:wlan0 address:<myadd> label:system_u:object_r:netlabel_peer_t:s0
netlabelctl unlbl add domain:radio interface:wlan0 address:<radioadd> label:system_u:object_r:netlabel_peer_t:s0Quoted 5 lines
netlabelctl unlbl add domain:T.V. interface:wlan0 address:<myadd> label:system_u:object_r:netlabel_peer_t:s0
netlabelctl unlbl add domain:T.V. interface:wlan0 address:<t.v.add> label:system_u:object_r:netlabel_peer_t:s0I think what you mean to type is the following:
# netlabelctl unlbl add interface:wlan0 address:<radioadd> \ label:system_u:object_r:netlabel_peer_t:s0... note there is no "domain" argument, that only exists for "netlabelctl map ..." commands.
NOTE: if you really want to get fancy you can create new SELinux domains for each type of media and add NetLabel configurations for those new domains. Imagine you create a new "
internet_radio_t" domain/type and only allow the "netplayer_t" domain (yeah, I made that up but you get the point) access to network traffic labeled withinternet_radio_t. You would then use the following command to label your incoming traffic with NetLabel:# netlabelctl unlbl add interface:wlan0 address:<radioadd> \ label:system_u:object_r:internet_radio_t:s0NOTE: you can also skip the "interface:wlan0" argument and just use "default" instead if you want the configuration to apply to all your network interfaces; although bear in mind that the "default" configuration can be overridden by the interface specific configurations.
Quoted 4 lines
As for the new capabilities, I don't mind trying that out when the time comes(but first I need to figure the this out before any other ways);
No problem, I understand. Let me know if you have any more problems.
Quoted 7 lines
here is what the error looks like:
netlabel_tools-0.19# make
INFO: creating the version header file
.: 10:version_info: not found
make: *** [include/version.h] Error 2
Quoted 10 lines
Huh, can you try the following:
1. Open the netlabel_tools-0.19/Makefile in your favorite editor
2. Change the ".version_info; \" line to "source ./version_info; \"
3. Save your changes
4. Try running "make" againThanks.
O.k. changed . version like how you had posted.
The package compiled like a charm.
regards;
Justin P. Mattock
Quoted 16 lines · Justin P. Mattock
Quoted 15 lines · Paul Moore
Quoted 6 lines · Justin P. Mattock
here is what the error looks like:
netlabel_tools-0.19# make
INFO: creating the version header file
.: 10:version_info: not found
make: *** [include/version.h] Error 2Huh, can you try the following:
1. Open the netlabel_tools-0.19/Makefile in your favorite editor
2. Change the ".version_info; \" line to "source ./version_info;
\" 3. Save your changes
4. Try running "make" again
Quoted 4 lines
Quoted 1 line
Thanks.
O.k. changed . version like how you had posted.
The package compiled like a charm.
Great, I'll change the Makefile(s) in SVN ... I don't quite understand the reason (what is your /bin/sh? I'm guessing not bash?) but at least we now have a solution :)
Signature · 2 lines
paul moore linux @ hp
Quoted 22 lines · Paul Moore
Quoted 16 lines · Justin P. Mattock
Quoted 15 lines · Paul Moore
Quoted 6 lines · Justin P. Mattock
here is what the error looks like:
netlabel_tools-0.19# make
INFO: creating the version header file
.: 10:version_info: not found
make: *** [include/version.h] Error 2Huh, can you try the following:
1. Open the netlabel_tools-0.19/Makefile in your favorite editor
2. Change the ".version_info; \" line to "source ./version_info;
\" 3. Save your changes
4. Try running "make" againQuoted 4 lines
Quoted 1 line
Thanks.
O.k. changed . version like how you had posted.
The package compiled like a charm.
Quoted 8 lines
Great, I'll change the Makefile(s) in SVN ... I don't quite understand the reason (what is your
/bin/sh? I'm guessing not bash?) but at least we now have a solution :)--
paul moore
linux @ hp
hmm..
under ps auxZ
I see:
2896 tty1 S+ 0:00 /bin/bash /usr/bin/startx
then open aterm for navigating.
Thankfully it works(this people can install
it a test it out.)
regards;
Signature · 1 line
Justin P. Mattock
Quoted 31 lines · Justin Mattock
Quoted 22 lines · Paul Moore
Quoted 16 lines · Justin P. Mattock
Quoted 15 lines · Paul Moore
Quoted 6 lines · Justin P. Mattock
here is what the error looks like:
netlabel_tools-0.19# make
INFO: creating the version header file
.: 10:version_info: not found
make: *** [include/version.h] Error 2Huh, can you try the following:
1. Open the netlabel_tools-0.19/Makefile in your favorite
editor 2. Change the ".version_info; \" line to "source ./version_info; \" 3. Save your changes
4. Try running "make" againQuoted 4 lines
Quoted 1 line
Thanks.
O.k. changed . version like how you had posted.
The package compiled like a charm.Quoted 7 lines
Great, I'll change the Makefile(s) in SVN ... I don't quite understand the reason (what is your
/bin/sh? I'm guessing not bash?) but at least we now have a solution :)--
paul moore
linux @ hp
Quoted 8 lines
hmm..
under ps auxZ
I see:
2896 tty1 S+ 0:00/bin/bash/usr/bin/startx
then open aterm for navigating.Thankfully it works(this people can install
it a test it out.)
Well, it is possible that /bin/sh points to a non-bash shell but maybe not (I'm pretty sure the make command executes the scripts with /bin/sh). Either way, I checked in the fix to the SVN tree earlier today so newer releases will have the fix; if needed I can release a 0.19.1 or similar but I want to wait and see how widespread the problem is ...
Signature · 2 lines
paul moore linux @ hp
Quoted 48 lines · Paul Moore
Quoted 31 lines · Justin Mattock
Quoted 22 lines · Paul Moore
Quoted 16 lines · Justin P. Mattock
Quoted 15 lines · Paul Moore
Quoted 6 lines · Justin P. Mattock
here is what the error looks like:
netlabel_tools-0.19# make
INFO: creating the version header file
.: 10:version_info: not found
make: *** [include/version.h] Error 2Huh, can you try the following:
1. Open the netlabel_tools-0.19/Makefile in your favorite
editor 2. Change the ".version_info; \" line to "source ./version_info; \" 3. Save your changes
4. Try running "make" againQuoted 4 lines
Quoted 1 line
Thanks.
O.k. changed . version like how you had posted.
The package compiled like a charm.Quoted 7 lines
Great, I'll change the Makefile(s) in SVN ... I don't quite understand the reason (what is your
/bin/sh? I'm guessing not bash?) but at least we now have a solution :)--
paul moore
linux @ hpQuoted 8 lines
hmm..
under ps auxZ
I see:
2896 tty1 S+ 0:00/bin/bash/usr/bin/startx
then open aterm for navigating.Thankfully it works(this people can install
it a test it out.)Well, it is possible that
/bin/shpoints to a non-bash shell but maybe not (I'm pretty sure the make command executes the scripts with/bin/sh). Either way, I checked in the fix to the SVN tree earlier today so newer releases will have the fix; if needed I can release a 0.19.1 or similar but I want to wait and see how widespread the problem is ...
Quoted 4 lines
--
paul moore
linux @ hp
Cool, If I see anybody
struggling, I point them to the
fix you posted.
I also might be missing something, i.g.
one of the boxes that gave this error I built
with debootstrap, but then the other that gave this as well was built with nubuntu which seems more complete than debootstrap.
but then maybe both are missing a package.
(or it's a debian thing)
regards;
Signature · 1 line
Justin P. Mattock
Quoted 8 lines · Justin Mattock
Quoted 7 lines · Paul Moore
Well, it is possible that
/bin/shpoints to a non-bash shell but maybe not (I'm pretty sure the make command executes the scripts with/bin/sh). Either way, I checked in the fix to the SVN tree earlier today so newer releases will have the fix; if needed I can release a 0.19.1 or similar but I want to wait and see how widespread the problem is ...
Quoted 7 lines
Quoted 3 lines
--
paul moore
linux @ hpCool, If I see anybody
struggling, I point them to the
fix you posted.
Great. Also let me know, if this looks like it will be widespread problem I'll make a new release; I'd hate for people to have to patch the Makefile to get it to build ...
Quoted 7 lines
I also might be missing something, i.g.
one of the boxes that gave this error I built
with debootstrap, but then the other that gave this as well was built with nubuntu which seems more complete than debootstrap.
but then maybe both are missing a package.
(or it's a debian thing)
It could also be my rather poor understanding of bash and makefiles :) If anyone out there wants to take a look and offer an explanation or a better patch I'm more than happy to accept it.
Signature · 2 lines
paul moore linux @ hp
Quoted 15 lines · Paul Moore
Quoted 13 lines · Justin Mattock
Quoted 11 lines · Paul Moore
Well, it is possible that
/bin/shpoints to a non-bash shell but maybe not (I'm pretty sure the make command executes the scripts with/bin/sh). Either way, I checked in the fix to the SVN tree earlier today so newer releases will have the fix; if needed I can release a 0.19.1 or similar but I want to wait and see how widespread the problem is ...--
paul moore
linux @ hp
Quoted 8 lines
Quoted 4 lines
Cool, If I see anybody
struggling, I point them to the
fix you posted.Great. Also let me know, if this looks like it will be widespread problem I'll make a new release; I'd hate for people to have to patch the
Makefileto get it to build ...
no problem.
Quoted 9 lines
Quoted 8 lines
I also might be missing something, i.g.
one of the boxes that gave this error I built
with debootstrap, but then the other that gave this as well was built with nubuntu which seems more complete than debootstrap.
but then maybe both are missing a package.
(or it's a debian thing)
Quoted 3 lines
It could also be my rather poor understanding of bash and makefiles :) If anyone out there wants to take a look and offer an explanation or a better patch I'm more than happy to accept it.
here as well.
regards;
Justin P. Mattock