Rule set based access control (rsbac) for linux

Andrea Pasquinucci | 4 Apr 2006 09:02

Picon

Re: RSBAC 1.2.6pre4 released

On Tue, Mar 07, 2006 at 11:00:06AM +0100, kang wrote:
* 1.2.6pre4 released
* 
* RSBAC 1.2.6pre4 has been released for both kernels 2.4.32 and 2.6.15.

I cannot compile this kernel, I get the following 2 errors:

  CC      rsbac/adf/daz/dazuko_rsbac.o
In file included from rsbac/adf/daz/dazuko_rsbac.c:32:
rsbac/adf/daz/dazuko_rsbac.h:26:31: error: linux/modversions.h: No such file or directory
make[3]: *** [rsbac/adf/daz/dazuko_rsbac.o] Error 1
make[2]: *** [rsbac/adf/daz] Error 2
make[1]: *** [rsbac/adf] Error 2
make: *** [rsbac] Error 2

  CC      rsbac/data_structures/aci_data_structures.o
rsbac/data_structures/aci_data_structures.c: In function 'rsbac_init':
rsbac/data_structures/aci_data_structures.c:8015: error: variable 'rc_init_p_aci' has
initializer but incomplete type
rsbac/data_structures/aci_data_structures.c:8015: error: 'DEFAULT_RC_P_INIT_ACI' undeclared
(first use in this function)
rsbac/data_structures/aci_data_structures.c:8015: error: (Each undeclared identifier is reported
only once
rsbac/data_structures/aci_data_structures.c:8015: error: for each function it appears in.)
rsbac/data_structures/aci_data_structures.c:8015: error: storage size of 'rc_init_p_aci' isn't known
rsbac/data_structures/aci_data_structures.c:8016: warning: unused variable 'init_pid'
rsbac/data_structures/aci_data_structures.c:8015: warning: unused variable 'rc_init_p_aci'
rsbac/data_structures/aci_data_structures.c:8014: warning: unused variable 'p'
rsbac/data_structures/aci_data_structures.c:8013: warning: unused variable 'rsbac_kthread_entry'
make[2]: *** [rsbac/data_structures/aci_data_structures.o] Error 1

(Continue reading)

Amon Ott | 4 Apr 2006 13:15

Re: RSBAC 1.2.6pre4 released

Hi Andrea!

On Dienstag 04 April 2006 09:02, Andrea Pasquinucci wrote:
> On Tue, Mar 07, 2006 at 11:00:06AM +0100, kang wrote:
> * 1.2.6pre4 released
> * 
> * RSBAC 1.2.6pre4 has been released for both kernels 2.4.32 and 
2.6.15.
> 
> I cannot compile this kernel, I get the following 2 errors:
> 
>   CC      rsbac/adf/daz/dazuko_rsbac.o
> In file included from rsbac/adf/daz/dazuko_rsbac.c:32:
> rsbac/adf/daz/dazuko_rsbac.h:26:31: error: linux/modversions.h: No 
such file or directory
> make[3]: *** [rsbac/adf/daz/dazuko_rsbac.o] Error 1
> make[2]: *** [rsbac/adf/daz] Error 2
> make[1]: *** [rsbac/adf] Error 2
> make: *** [rsbac] Error 2

This should be fixed in latest svn.

>   CC      rsbac/data_structures/aci_data_structures.o
> rsbac/data_structures/aci_data_structures.c: In function 
'rsbac_init':
> rsbac/data_structures/aci_data_structures.c:8015: error: variable 
'rc_init_p_aci' has initializer but incomplete type
> rsbac/data_structures/aci_data_structures.c:8015: error: 
'DEFAULT_RC_P_INIT_ACI' undeclared (first use in this function)
> rsbac/data_structures/aci_data_structures.c:8015: error: (Each

(Continue reading)

gabor.horvath | 7 Apr 2006 08:38

Picon

Boot Role question

Dear Members, 

I'd appreciate if someone could answer my questions. Former I used wrapper 
roles to start the rsbac system. They worked OK. Now I want to test the 
boot role to reduce the number of necessary 'wrapper' roles.

1. When does the run of the boot role end? I mean if it starts anything 
which doesn't have a force role then it will run with Boot Role, won't it?
2. How can I be sure that all process with boot role ended?

Thank you very much.

Gábor Horváth
mailto:gabor.horvath <at> konicaminolta.hu

Amon Ott | 7 Apr 2006 09:53

Re: Boot Role question

On Freitag 07 April 2006 08:38, gabor.horvath <at> konicaminolta.hu wrote:
> I'd appreciate if someone could answer my questions. Former I used 
wrapper 
> roles to start the rsbac system. They worked OK. Now I want to test 
the 
> boot role to reduce the number of necessary 'wrapper' roles.
> 
> 1. When does the run of the boot role end? I mean if it starts 
anything 
> which doesn't have a force role then it will run with Boot Role, 
won't it?

Exactly. I recommend a global "System Setup" role as force role on rcS 
etc., so that only kernel threads and init run with boot role.

> 2. How can I be sure that all process with boot role ended?

I have a little script for secoff to show all roles:

ps ax|cut -c 1-6,28-|while read pid name
do
  echo -n $pid $name": "
  attr_get_process RC $pid rc_role
done

Once in a while I use it to check that all roles are as expected. BTW, 
I have a similar one for jails:

ps ax|cut -c 1-6,28-|while read pid name
do

(Continue reading)

gabor.horvath | 7 Apr 2006 10:09

Picon

Válasz: Re: Boot Role question

Thank you, that's very good. Though I thought forcing a role to e.g. rcS 
is inefficient 'cause only binaries can change their role not scripts. Or 
did I miss something?

Gábor Horváth 
mailto:gabor.horvath <at> konicaminolta.hu

Amon Ott <ao <at> rsbac.org>
Feladó: rsbac-bounces <at> rsbac.org
2006.04.07 09:53
Kérem, válaszoljon ennek a személynek: RSBAC Discussion and Announcements

       Címzett:         RSBAC Discussion and Announcements 
<rsbac <at> rsbac.org>
         Másolat: 
             Tárgy:     Re: [rsbac] Boot Role question

On Freitag 07 April 2006 08:38, gabor.horvath <at> konicaminolta.hu wrote:
> I'd appreciate if someone could answer my questions. Former I used 
wrapper 
> roles to start the rsbac system. They worked OK. Now I want to test 
the 
> boot role to reduce the number of necessary 'wrapper' roles.
> 
> 1. When does the run of the boot role end? I mean if it starts 
anything 
> which doesn't have a force role then it will run with Boot Role, 
won't it?

Exactly. I recommend a global "System Setup" role as force role on rcS

(Continue reading)

Amon Ott | 7 Apr 2006 10:17

Re: Válasz: Re: [rsbac] Boot Role question

On Freitag 07 April 2006 10:09, gabor.horvath <at> konicaminolta.hu wrote:
> Thank you, that's very good. Though I thought forcing a role to e.g. 
rcS 
> is inefficient 'cause only binaries can change their role not 
scripts. Or 
> did I miss something?

rcS is started with exec, so the force role works fine. And all 
daemons get started by this script or by rc, so they get the role, 
too.

Some distros source init scripts, so the force role does not work for 
them. I changed them to real exec here. A bit slower, but more 
secure.

Amon.
--

-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22

gabor.horvath | 7 Apr 2006 10:21

Picon

Válasz: Re: Válasz: Re: Boot Role question

OK, and what about getty (mgetty)? Isn't it dangerous having the terminals 
run by Boot Role? Though I know if so logs in than s/he switches to 
security officer role.

Thank you.

Gábor Horváth
mailto:gabor.horvath <at> konicaminolta.hu

Amon Ott <ao <at> rsbac.org>
Feladó: rsbac-bounces <at> rsbac.org
2006.04.07 10:17
Kérem, válaszoljon ennek a személynek: RSBAC Discussion and Announcements

       Címzett:         RSBAC Discussion and Announcements 
<rsbac <at> rsbac.org>
         Másolat: 
             Tárgy:     Re: Válasz: Re: [rsbac] Boot Role question

On Freitag 07 April 2006 10:09, gabor.horvath <at> konicaminolta.hu wrote:
> Thank you, that's very good. Though I thought forcing a role to e.g. 
rcS 
> is inefficient 'cause only binaries can change their role not 
scripts. Or 
> did I miss something?

rcS is started with exec, so the force role works fine. And all 
daemons get started by this script or by rc, so they get the role, 
too.

(Continue reading)

gabor.horvath | 7 Apr 2006 13:41

Picon

Delete rsbac settings easily?

Is there an 'easy' way to delete rsbac settings completely? I'm 
reorganizing my settings and it's exhausting to reboot with a non-rsbac 
kernel, remove all rsbac.dat dirs, reboot again and restore settings.

Thank you !

Gábor Horváth 
mailto:gabor.horvath <at> konicaminolta.hu

Amon Ott | 7 Apr 2006 14:07

Re: Delete rsbac settings easily?

On Freitag 07 April 2006 13:41, gabor.horvath <at> konicaminolta.hu wrote:
> Is there an 'easy' way to delete rsbac settings completely? I'm 
> reorganizing my settings and it's exhausting to reboot with a 
non-rsbac 
> kernel, remove all rsbac.dat dirs, reboot again and restore 
settings.

You could make a script for this. attr_rm_* can help a bit.

Amon.
--

-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22

gabor.horvath | 7 Apr 2006 14:24

Picon

Válasz: Re: Delete rsbac settings easily?

Thank you for your help! Unfortunately I'm not very familiar with the 
command line tools but I'll have a look at them.
Üdvözlettel / Kind regards,

Horváth Gábor
hálózati és rendszeradminisztrátor / IT specialist

Konica Minolta Magyarország / Hungary
Tel:+36-1-4649-013

mailto:gabor.horvath <at> konicaminolta.hu
http://www.konicaminolta.hu

Érdeklődik a legújabb Konica Minolta hírek iránt? Iratkozzon fel a 
rendszeres hírlevelünkre! http://www.konicaminolta.hu/hirlevel

Amon Ott <ao <at> rsbac.org>
Feladó: rsbac-bounces <at> rsbac.org
2006.04.07 14:07
Kérem, válaszoljon ennek a személynek: RSBAC Discussion and Announcements

       Címzett:         RSBAC Discussion and Announcements 
<rsbac <at> rsbac.org>
         Másolat: 
             Tárgy:     Re: [rsbac] Delete rsbac settings easily?

On Freitag 07 April 2006 13:41, gabor.horvath <at> konicaminolta.hu wrote:
> Is there an 'easy' way to delete rsbac settings completely? I'm 
> reorganizing my settings and it's exhausting to reboot with a 
non-rsbac

(Continue reading)

Group

gmane.linux.rsbac.

Project Web Page

Rule set based access control (rsbac) for linux

Search Archive

Page

1 | 2 | 3

Articles in period: 23

April 2006

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

CVE-2013-2094: Linux privilege escalation (18 May 2013)
A problem when pulling linux-3.8.y (13 May 2013)
PaX options required by clamav (24 Apr 2013)
Invitation to connect on LinkedIn (26 Feb 2013)
git pull has conflicts (10 Feb 2013)
3.1.5 kernel crashes when using CAP policy module (5 Feb 2013)
hi Amon (1 Feb 2013)
X (24 Jan 2013)
Happy New Year! (31 Dec 2012)
Xorg restart (13 Dec 2012)
reset internal list (28 Nov 2012)
rsbac_cap_learn not work (26 Nov 2012)
user audit (25 Nov 2012)
Convert user from PAM to UM not import groups for user (25 Nov 2012)
switch module on boot not working (28 Oct 2012)
UM not working on linux-3.4.y (.9) (29 Sep 2012)
no rsbac directry on linux-3.5.y (29 Sep 2012)
UM local login does not work (19 Aug 2012)
general rc_fd_types numbering schema (19 Aug 2012)
kernel-rsbac-3.0.41 build error (16 Aug 2012)
git pull (4 Aug 2012)

Archives

14	May 2013
6	April 2013
5	March 2013
14	February 2013
2	January 2013
8	December 2012
4	November 2012
10	October 2012
2	September 2012
8	August 2012
18	July 2012
7	June 2012
7	May 2012
17	April 2012
31	March 2012
6	February 2012
3	January 2012
2	December 2011
18	November 2011
6	October 2011
1	September 2011
17	August 2011
11	July 2011
13	June 2011
6	May 2011
1	April 2011
8	March 2011
14	February 2011
10	January 2011
3	December 2010
3	November 2010
2	October 2010
8	August 2010
2	July 2010
3	May 2010
27	April 2010
7	March 2010
8	February 2010
1	January 2010
10	December 2009
6	November 2009
15	October 2009
22	September 2009
15	August 2009
6	June 2009
8	May 2009
14	April 2009
1	March 2009
8	February 2009
70	January 2009
13	December 2008
37	November 2008
12	October 2008
4	September 2008
3	August 2008
11	July 2008
13	June 2008
1	May 2008
5	February 2008
2	January 2008
3	December 2007
12	November 2007
9	October 2007
20	September 2007
13	August 2007
36	July 2007
13	June 2007
34	May 2007
30	April 2007
12	March 2007
8	February 2007
10	January 2007
10	December 2006
11	November 2006
10	October 2006
28	September 2006
44	August 2006
56	July 2006
37	June 2006
8	May 2006
23	April 2006
27	March 2006
21	February 2006
36	January 2006
15	December 2005
15	November 2005
18	October 2005
30	September 2005
25	August 2005
58	July 2005
39	June 2005
37	May 2005
27	April 2005
39	March 2005
58	February 2005
43	January 2005
20	December 2004
21	November 2004
42	October 2004
21	September 2004
48	August 2004
28	July 2004
59	June 2004
46	May 2004
48	April 2004
57	March 2004
28	February 2004
27	January 2004
60	December 2003
36	November 2003
59	October 2003
63	September 2003
23	August 2003

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template