gmane.linux.rsbac

Re: (no subject)

somayeh razeghi — 2013-05-23T03:25:23

iLearn H0w t0 Make health 0nl1ne Fast http://classicthairidgeback.com/www.foxnews.com.addmoneynews.homebuisness3.php

linux-3.9.y

Jens Kasten — 2013-05-22T21:42:30

Hi,

latest pull on linux-3.9.y(3.9.3) produce this error.
 
rsbac/data_structures/gen_lists.c: In Funktion »rsbac_list_ta_commit«:
rsbac/data_structures/gen_lists.c:8166:29: Fehler: Ungültige Operanden
für binäres != (haben »rsbac_uid_t« und »kuid_t«)
rsbac/data_structures/gen_lists.c: In Funktion »rsbac_list_ta_forget«:
rsbac/data_structures/gen_lists.c:8276:29: Fehler: Ungültige Operanden
für binäres != (haben »rsbac_uid_t« und »kuid_t«)
rsbac/data_structures/gen_lists.c: In Funktion »rsbac_list_ta_refresh«:
rsbac/data_structures/gen_lists.c:8381:29: Fehler: Ungültige Operanden
für binäres != (haben »rsbac_uid_t« und »kuid_t«)
rsbac/adf/adf_main.c: In Funktion »rsbac_fake_uid«:
rsbac/adf/adf_main.c:3204:8: Fehler: Argument falschen Typs für unäres
Ausrufungszeichen
rsbac/adf/adf_main.c:3207:7: Fehler: unverträgliche Typen bei Rückgabe
von Typ »kuid_t«, aber »rsbac_uid_t« wurde erwartet
rsbac/adf/adf_main.c:3213:9: Fehler: unverträgliche Typen bei Rückgabe
von Typ »k

Re: A problem when pulling linux-3.8.y

Jens Kasten — 2013-05-22T11:51:50

Am Mittwoch, den 22.05.2013, 09:25 +0200 schrieb Amon Ott:

Just for info. I have enabled the secure delete and don't get this
error. I use the ext4 filesystem.

Re: A problem when pulling linux-3.8.y

Amon Ott — 2013-05-22T07:25:02

Am 14.05.2013 05:28, schrieb Mikko Rinne:

Could you please retry with "secure delete" support disabled in kernel
config? I suspect there might be something related.

Amon.

Re: CVE-2013-2094: Linux privilege escalation

Amon Ott — 2013-05-18T07:18:27

Am 18.05.2013 03:25, schrieb Mikko Rinne:

Just pushed latest 3.0, 3.2 and 3.4 to git repos.


Amon.

CVE-2013-2094: Linux privilege escalation

Mikko Rinne — 2013-05-18T01:25:14

Hi,

few days ago a quite serious linux kernel vulnerability was announced that
goes all the way from 2.6.37 to 3.8.9;

-
https://isc.sans.edu/diary/CVE-2013-2094%3A+Linux+privilege+escalation/15803

Has this been fixed in RSBAC enabled kernels?

Re: A problem when pulling linux-3.8.y

Jens Kasten — 2013-05-16T22:51:33

Hi,

I try the lastest git from linux-3.9.y.
Somehow its feel slow with this kernel.
 
Am Mittwoch, den 15.05.2013, 12:15 +0200 schrieb Amon Ott:

Re: A problem when pulling linux-3.8.y

Mikko Rinne — 2013-05-15T13:18:40

Actually,

Sorry for spamming this mailing list, but I didnt test 3.9 completely before
posting last time;

I still get same error I reported yesterday regarding FF policy module. It's
not fixed when using it on hardmode.

Now Imma go stfu, before you guys ignore me. :)



-----Original Message-----
From: rsbac-bounces< at >rsbac.org [mailto:rsbac-bounces< at >rsbac.org] On Behalf Of
Mikko Rinne
Sent: 15. toukokuuta 2013 15:22
To: 'RSBAC Discussion and Announcements'
Subject: Re: [rsbac] A problem when pulling linux-3.8.y

Thanks,

I just tried latest 3.9 series from git repo, and it seems that a problem
with FF policy module I reported yesterday is fixed, I managed to pull a
test server up with it. 

Which is funny, I spent all night / this morning migrating FF rules to ACL,
and got it to work just as smoothly. :)

Thanks a lot tho!


-----Original Message-----
From: rsbac-bounces< at >rsbac.org [mailto:rsbac-bounces< at >rsbac.org] On Behalf Of
Amon Ott
Sent: 15. toukokuuta 2013 13:15
To: RSBAC Discussion and Announcements
Su

Re: A problem when pulling linux-3.8.y

Mikko Rinne — 2013-05-15T12:21:35

Thanks,

I just tried latest 3.9 series from git repo, and it seems that a problem
with FF policy module I reported yesterday is fixed, I managed to pull a
test server up with it. 

Which is funny, I spent all night / this morning migrating FF rules to ACL,
and got it to work just as smoothly. :)

Thanks a lot tho!


-----Original Message-----
From: rsbac-bounces< at >rsbac.org [mailto:rsbac-bounces< at >rsbac.org] On Behalf Of
Amon Ott
Sent: 15. toukokuuta 2013 13:15
To: RSBAC Discussion and Announcements
Subject: Re: [rsbac] A problem when pulling linux-3.8.y

Am 14.05.2013 01:56, schrieb Mikko Rinne:

git pull --rebase

After updating the git version on the server, I have successfully cloned
3.8 as well as the new 3.9 uploaded yesterday. Please retry.

BTW, in 3.8 and 3.9, the missing log character has been fixed.


Amon.
--
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22
_______________________________________________
rsbac mailing list
rsbac< at >rsbac.org
http://www.rsbac.org/mailman/listinfo/rsbac

Re: A problem when pulling linux-3.8.y

Amon Ott — 2013-05-15T10:15:04

Am 14.05.2013 01:56, schrieb Mikko Rinne:

git pull --rebase

After updating the git version on the server, I have successfully cloned
3.8 as well as the new 3.9 uploaded yesterday. Please retry.

BTW, in 3.8 and 3.9, the missing log character has been fixed.


Amon.

Re: A problem when pulling linux-3.8.y

Jens Kasten — 2013-05-14T09:15:07

Hi,

on evening I will look on my setup. I think I have the FF module 
enabled too but is booting.


Am 2013-05-14 05:28, schrieb Mikko Rinne:

Re: A problem when pulling linux-3.8.y

Mikko Rinne — 2013-05-14T02:16:14

Hey,

Sorry for spamming this mailing list, but;

I finally managed to clone linux-3.8.y (dont know if someone fixed it or
so), but I've came across a new problem which seems to persist in 3.7.y as
well, I tried to clone 3.7.y which currently runs in rsbac-3.7.10+ version.

- I have AUTH, ACL, FF and CAP modules enabled
- Whenever I boot with softmode on, I got no problems
- Regardless which options I try with these modules enabled, I always get
"rsbac boot cannot set terminal process group (-1) inappropriate ioctl for
device" -error on boot. And like I said, when I have rsbac_softmode enabled
in the command line, it boots with no problem, so it's not a problem with
the system, but within a kernel
- I'm not using any initrd files

My grub.conf goes pretty much like this:

Re: A problem when pulling linux-3.8.y

Mikko Rinne — 2013-05-14T03:28:28

Hi,

Regarding this, I did some more digging. I disabled all the modules, enabled
one at a time rebooteed and see where the error occurs.

It seems that FF policy module is doing the trick. When I have FF enabled,
system hangs on that error message. Basicly all I need FF for is pretty much
preventing people from executing nothing but allowed binaries, but I think I
can use ACL for that as well, have to do some digging.

Either way I think FF should be fixed, at some point.



-----Original Message-----
From: Mikko Rinne [mailto:blackop< at >blackop.net] 
Sent: 14. toukokuuta 2013 5:16
To: 'RSBAC Discussion and Announcements'
Subject: RE: [rsbac] A problem when pulling linux-3.8.y

Hey,

Sorry for spamming this mailing list, but;

I finally managed to clone linux-3.8.y (dont know if someone fixed it or
so), but I've came across a new problem which seems to persist in 3.7.y as
well, I tried to clone 3.7.y which currently runs in rsbac-3.7.10+ version.

- I have AUTH, ACL, FF and CAP modules enabled
- Whenever I boo

Re: A problem when pulling linux-3.8.y

Mikko Rinne — 2013-05-13T23:56:37

Hey,

working.

A stupid question, but how exactly you do that?:P I'm a git noob, only know
how to clone as Amon instructed me a few months back :)




-----Original Message-----
From: rsbac-bounces< at >rsbac.org [mailto:rsbac-bounces< at >rsbac.org] On Behalf Of
Jens Kasten
Sent: 13. toukokuuta 2013 21:19
To: rsbac< at >rsbac.org
Subject: Re: [rsbac] A problem when pulling linux-3.8.y

Hi,

Yes I try too and its break but just pull in an existing repository is
working.
I update to .13 and so far the kernel is running.

Btw, there is on logging some wrong chars :)

Mon May 13 18:16:31 2013 :<6>0000000101|sbac_list_auto_rehash():
changing list process_gen hash size on device 99:99 from 8 to 16 Mon May 13
18:16:31 2013 :<6>0000000102|sbac_list_auto_rehash(): 2 lists rehashed Mon
May 13 19:00:26 2013 :40000000000|rsbac_mount(): RSBAC not initialized
while mounting DEV 00:00, fs-type sysfs, delaying Mon May 13 19:00:26 2013
:40000000001|rsbac_mount(): RSBAC not initialized while mounting DEV 00:01,
fs-type rootfs, delaying

Re: A problem when pulling linux-3.8.y

Jens Kasten — 2013-05-13T18:18:36

Hi,

Yes I try too and its break but just pull in an existing repository is
working.
I update to .13 and so far the kernel is running.

Btw, there is on logging some wrong chars :)

Mon May 13 18:16:31 2013 :<6>0000000101|sbac_list_auto_rehash():
changing list process_gen hash size on device 99:99 from 8 to 16
Mon May 13 18:16:31 2013 :<6>0000000102|sbac_list_auto_rehash(): 2 lists
rehashed
Mon May 13 19:00:26 2013 :40000000000|rsbac_mount(): RSBAC not
initialized while mounting DEV 00:00, fs-type sysfs, delaying
Mon May 13 19:00:26 2013 :40000000001|rsbac_mount(): RSBAC not
initialized while mounting DEV 00:01, fs-type rootfs, delaying

Am Montag, den 13.05.2013, 21:02 +0300 schrieb Mikko Rinne:

Re: A problem when pulling linux-3.8.y

Mikko Rinne — 2013-05-13T18:02:54

Hi,

Just tried cloning it again, still seems to crash.


-----Original Message-----
From: rsbac-bounces< at >rsbac.org [mailto:rsbac-bounces< at >rsbac.org] On Behalf Of
Amon Ott
Sent: 13. toukokuuta 2013 17:18
To: RSBAC Discussion and Announcements
Subject: Re: [rsbac] A problem when pulling linux-3.8.y

Am 13.05.2013 14:23, schrieb Mikko Rinne:

The syslog noted the crash, too. I have just pushed 3.8.13, maybe that works
again. Will also try a test cloning myself soon.

Amon.
--
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22
_______________________________________________
rsbac mailing list
rsbac< at >rsbac.org
http://www.rsbac.org/mailman/listinfo/rsbac

Re: A problem when pulling linux-3.8.y

Amon Ott — 2013-05-13T14:17:50

Am 13.05.2013 14:23, schrieb Mikko Rinne:

The syslog noted the crash, too. I have just pushed 3.8.13, maybe that
works again. Will also try a test cloning myself soon.

Amon.

A problem when pulling linux-3.8.y

Mikko Rinne — 2013-05-13T12:23:08

Hey,

I just ran in to a small problem when trying to clone linux-3.8.y;

# git clone git://rsbac.org/linux-3.8.y linux-3.8
Cloning into 'linux-3.8'...
remote: fatal: Out of memory, realloc failed
remote: aborting due to possible repository corruption on the remote side.
fatal: early EOF
fatal: index-pack failed

I tried cloning with two different comps, both saying that.

But when pulling down linux-3.7.y, that one works. Still thought to mention
this,

Regards,
Mikko Rinne

Re: PaX options required by clamav

Javier Juan Martínez Cabezón — 2013-04-29T15:37:13




Don't spend your time with this Amon, just the information about what
PaX softmode does is needed to don't get confused if you suppose
something that don't happen (I got check disabling PaX Flags with clamd,
but it stills got killed), my mistake was to think after this that PaX
Softmode would do something that was not. I finished testing PaX as the
trouble source when I switch it Softmode and it stills killing it.
Knowing this It's trivial to change PaX Flags to perms to testing and
with ldd test one by one any library it uses searching for and if not
check some hardcoded PaX options (as UDEREF could be).


If you wish I could try as volunteer, I'm just a Laboratory technician
(healthcare personnel), and because of this I have not studies in
computer science area, and in consequence I can't give you warranties
about what I'm doing (if a is secure at this way or not). I can warrant
you one thing, I will do my best.

If you want we can use the mail list to send the "patches" in
documentation and if approve

Re: PaX options required by clamav

Amon Ott — 2013-04-29T07:58:24

Am 24.04.2013 00:25, schrieb Javier Juan Martínez Cabezón:

Thank you for finding this out and clarifying!


Right, softmode is a difficult thing. We could do this, similar to CAP
behaviour. However, if you switch it off afterwards, the processes keep
running with more rights that they should have, leaving you with a false
sense of security. So we would have to go through the process list and
reset the flags according to the executed program. Possible, but
annoying with potential to kill half finished jobs.


Thanks once more for all this info. Our handbook could need a lot of
caring attention. So much work to do and so little time. We would need
some volunteer or some funded worker to do all the docs properly - and
continuously over years. So far we have had several volunteers for docs,
but all of them could not go on for various reasons.

Amon.

PaX options required by clamav

Javier Juan Martínez Cabezón — 2013-04-23T22:25:27








After almost being crazy because of this question I finished with my
Dazuko problems related, CONFIG_PAX_USERCOPY and
CONFIG_PAX_MEMORY_UDEREF must be disabled in the kernel config.

I think this point should be introduced in the handbook in DAZ module,
until this will be truth, I expect this could serve as a substitution if
someone search info related about this.

Thanks a lot Amon for your points I got disoriented at all before this.

PD: I think that PaX Softmode should be put in the handbook too, at
least a point that it does only permit anyone to set/read PaX Flags
until my Known without disabling any functionality (one softmode
approach could be for example setting all flags to permxs, but others as
uderef, usercopy etc etc got free to kill whatever they want)

Another question useful to the handbook (I will not finish until our
beloved "handbook" would need 300 kg of paper to print....at least) is
some tips about configuration of su, removing for example pam_rootok
(incompatible with the follo