linux-kernel - Re: netlabel: UNLABELED ath9k not denying unlabeled traffic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200901141508.58174.paul.moore@hp.com>
Date:	Wed, 14 Jan 2009 15:08:58 -0500
From:	Paul Moore <paul.moore@...com>
To:	linux-kernel@...r.kernel.org, linux-wireless@...r.kernel.org,
	"SE-Linux" <selinux@...ho.nsa.gov>
Cc:	"Justin P. Mattock" <justinmattock@...il.com>
Subject: Re: netlabel: UNLABELED ath9k not denying unlabeled traffic

On Wednesday 14 January 2009 3:04:30 pm Paul Moore wrote:
> On Wednesday 14 January 2009 12:32:35 pm Justin P. Mattock wrote:

...

> > >> The next is a macbookpro ati chipset the kernel is 2.6.29-rc1
> > >> the o.s. is ubuntu jaunty, the netlabel_tools is the same as
> > >> above. the only results I see out of this is the avc's it's
> > >> generating (the allow rules above are from the macbook);
> > >> some reason the dell doesn't generate any avc's,
> > >> which makes me wonder is this a module issue.
> > >
> > > Huh.  Just so I'm clear on this ... on the macbook you see avc
> > > denials that correspond to the allow rules you posted above, but
> > > on the dell you don't see the same avc denials?  Are you running
> > > the same SELinux policy on both systems (version numbers)?  What
> > > is the output of the following command on both systems?
> > >
> > >  # cat /selinux/policy_capabilities/network_peer_controls
> >
> > for both systems I'm running the refpolicy(svn) from tresys.
> > the new ubac options, and newrole mechanism etc..
> > doing cat /selinux/policy_capabilities_netowork_peer_controls says
> > "1" should be for both.
>
> Ahhhh!  How did that happen?!  (see my response to your other email)

Sorry, just realized your other email was private.  In case anyone else 
is following this thread, the SELinux policy for network_peer_controls 
policy capability is still a work in progress and is disabled by 
default because there are still a few issues remaining.  Disabling the 
network_peer_controls (the default configuration) fixed the problem.

-- 
paul moore
linux @ hp
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/