SELinux Developer Summit 2009: CfP ends TODAY

This is the last call for the CfP for this year's SELinux Developer 
Summit, being held as part of LinuxCon in Portland:

  http://events.linuxfoundation.org/events/linuxcon/co-located-events

Details of the CfP for the SELinux Developer Summit are here:

  http://selinuxproject.org/page/Developer_Summit_2009/CFP

Please send any proposals for talks, discussion topics or development 
sessions to the program committee as outlined in the CfP.

** If you are attending, please subscribe to the event mailing list **

  http://selinuxproject.org/mailman/listinfo/selinux-developer-summit-2009

This will help us estimate numbers and design the agenda.

Thanks,

- James
--

-- 
James Morris
<jmorris@...>

Re: SELinux Developer Summit 2009: CfP ends TODAY

James Morris wrote:
> This is the last call for the CfP for this year's SELinux Developer
> Summit, being held as part of LinuxCon in Portland:
>
>    http://events.linuxfoundation.org/events/linuxcon/co-located-events
>
> Details of the CfP for the SELinux Developer Summit are here:
>
>    http://selinuxproject.org/page/Developer_Summit_2009/CFP
>
> Please send any proposals for talks, discussion topics or development
> sessions to the program committee as outlined in the CfP.
>
> ** If you are attending, please subscribe to the event mailing list **
>
>    http://selinuxproject.org/mailman/listinfo/selinux-developer-summit-2009
>
>
> This will help us estimate numbers and design the agenda.
>
>
> Thanks,
>
>
> - James
>    
be nice to attend, just one problem
"$", will there be videos available?

Justin P. Mattock

Re: SELinux Developer Summit 2009: CfP ends TODAY

> This is the last call for the CfP for this year's SELinux Developer
> Summit, being held as part of LinuxCon in Portland:

Is anyone from this list planning to attend Ohio LinuxFest in September?

--

-- 

-----
http://www.globalherald.net/jb01
GlobalHerald.NET, the Smarter Social Network! (tm)

Re: SELinux Developer Summit 2009: CfP ends TODAY

On Tue, 30 Jun 2009, Justin P. Mattock wrote:

> >    
> be nice to attend, just one problem
> "$", will there be videos available?

Probably not; this is an interactive developer event.  It's possible that 
minutes will be published.

--

-- 
James Morris
<jmorris@...>

Re: SELinux Developer Summit 2009: CfP ends TODAY

James Morris wrote:
> On Tue, 30 Jun 2009, Justin P. Mattock wrote:
>
>    
>>>
>>>        
>> be nice to attend, just one problem
>> "$", will there be videos available?
>>      
>
> Probably not; this is an interactive developer event.  It's possible that
> minutes will be published.
>
>
>    
Cool,
Well in that case maybe one of
these days.
Asied note when will an event like
this be in the los angeles, or
san jose area?

Justin P. Mattock

Re: The problem with TUN/TAP devices

Paul Moore wrote:
> Unfortunately we have a problem with the network access controls and TUN/TAP 
> devices.  The basic issue is that packets entering the stack via a TUN device, 
> e.g. QEMU/KVM guest instance operating with a bridged network configuration, 
> do not have a fully initialized sock associated with them.  I say "fully 
> initialized" because the basic initialization has been done (memory allocated, 
> initial values set to SECINITSID_UNLABELED, etc.) but the last step where we 
> assign the sock a label/SID never happens.  Why?  Because the TUN driver code 
> only calls sk_alloc() and nothing else in the TUN code paths finish the 
> SELinux sock setup.
>   

So what should it be calling and why is the fact that it isn't not a bug
in the TUN driver?

> Okay, so what?  Well, the problem is that the SELinux IP postrouting code 
> treats the packet's sock label (the one that is still set as unlabeled_t in 
> the TUN case) as the originating peer label; in short it looks like packets 
> sent from your QEMU/KVM instance are unlabeled_t instead of my_guest_t:s3.  
> Needless to say this is not ideal.
>
> So how do we fix it?  Well, there are a two options that I can think of right 
> now (feel free to add to the list):
>
> 1. Set the sock's label/SID in sk_alloc()
> 2. Introduce a new hook to set the label/SID of a sock and call it from
>    tun_set_iff()
>
> The problem with #2 is that it introduces a new (basically TUN specific) hook 
> to do something silly.  Important, but still kinda silly.  The problem with #1 

Problem about PAM-selinux

Hi, all,
I have a pam-selinux problem. I know I should post it to pam list, but
no response from them.

Things happened like this:
I want to upgrade my pam in Fedora Core 6,  when I make my
Linux-PAM-1.1.0, I encountered a error.

pam_selinux.c: In function `mls_range_allowed':
pam_selinux.c:239: error: `CONTEXT__CONTAINS' undeclared (first use in
this function)
pam_selinux.c:239: error: (Each undeclared identifier is reported only once
pam_selinux.c:239: error: for each function it appears in.)
pam_selinux.c:246: error: `SECCLASS_CONTEXT' undeclared (first use in
this function)

And I grep "CONTEXT__CONTAINS" in the whole Linux-PAM-1.1.0 source
code packet, nowhere defines it.
It seems to be some issues about selinux.
Anybody can give me a help ?  Thanks.

Re: Problem about PAM-selinux

Andy wrote:
> Hi, all,
> I have a pam-selinux problem. I know I should post it to pam list, but
> no response from them.
>
> Things happened like this:
> I want to upgrade my pam in Fedora Core 6,  when I make my
> Linux-PAM-1.1.0, I encountered a error.
>
> pam_selinux.c: In function `mls_range_allowed':
> pam_selinux.c:239: error: `CONTEXT__CONTAINS' undeclared (first use in
> this function)
> pam_selinux.c:239: error: (Each undeclared identifier is reported only once
> pam_selinux.c:239: error: for each function it appears in.)
> pam_selinux.c:246: error: `SECCLASS_CONTEXT' undeclared (first use in
> this function)
>
> And I grep "CONTEXT__CONTAINS" in the whole Linux-PAM-1.1.0 source
> code packet, nowhere defines it.
> It seems to be some issues about selinux.
> Anybody can give me a help ?  Thanks.
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@... with
> the words "unsubscribe selinux" without quotes as the message.
>
>    
looks like an old *.h file somewhere
try updating all the SELinux packages,

Re: SELinux Developer Summit 2009: CfP ends TODAY

On Tue, 30 Jun 2009, Justin P. Mattock wrote:

> Cool,
> Well in that case maybe one of
> these days.
> Asied note when will an event like
> this be in the los angeles, or
> san jose area?

If there's a major Linux developer event there, it could happen. 
Currently, the way it works us by co-locating with a larger event, and 
many of the core developers are on the East coast.

You might be able to find others in the area and set up a user group -- 
this is what happened in Japan -- and possibly co-host an event with 
SCALE.  It seems they have provision for this:

http://scale7x.socallinuxexpo.org/conference-info/special-events

--

-- 
James Morris
<jmorris@...>

RBAC with SELinux MCS