Public SourceMage Discussion List

[Arjan Bouter <abouter AT sourcemage.org>]

Note that I'm writing this as a warning to everybody. It is not my intention 
to
make fun of or be rude to someone or you (Craig) in particular. Keep in mind
though that english isn't my native language ;)

* WARNING *

selinux support is incomplete! 
DO NOT INSTALL IT UNLESS YOU WANT TO HELP MAKING IT WORK!

Well, with that out of the way allow me to answer the questions ;)

On Sun, 13 Mar 2005 19:28:43 +0100
Arwed von Merkatz <v.merkatz AT gmx.net> wrote:

> On Mon, Mar 14, 2005 at 01:10:35AM +0800, Craig Dyke wrote:
> > Howdy all
> > 
> > Not sure if I missed something along the way with all the emails about 
> > glibc 2.3.4,
> > but, I have been unable to get it to cast successfully.
> > 
> > Here is the end of my compile log (which I have replicated several times):
> > 

<snip>

> > nscd_stat.c:34:30: selinux/selinux.h: No such file or directory
> > nscd_stat.c:35:26: selinux/avc.h: No such file or directory
> > nscd_stat.c:81: error: field `cstats' has incomplete type
> > make[3]: Leaving directory `/usr/src/glibc-2.3.4/nscd'
> > make[3]: *** [/usr/src/glibc-2.3.4.bld/nscd/nscd_stat.o] Error 1
> > make[2]: Leaving directory `/usr/src/glibc-2.3.4'
> > make[2]: *** [nscd/others] Error 2
> > make[1]: Leaving directory `/usr/src/glibc-2.3.4.bld'
> > make[1]: *** [all] Error 2
> 
> Do you have libselinux installed? I just checked my compile log of glibc
> and saw that it does check for it. I guess this are really two bugs: 
> 1) glibc should optional_depend on libselinux

Which I didn't yet do for the same reason as not including the missing init
script for selinux: selinux doesn't work yet on smgl.
I'm getting close to getting it to work though. coreutils is the most 
important
part left. Unfortunately that's the hardest part as well so far.

> 2) it should work with libselinux installed

It does. and i've got the logs to prove it. Why it fails for you I don't know
Probably because the right options to configure were missing or the kernel
doesn't have selinux support.

> That's the only reason I can imagine that would make glibc look for
> selinux headers.

selinux needs to be enabled in the kernel, glibc and in spells like coreutils,
pam, ssh, ...
If one of these is missing it won't ever work.

> 
> > I am running the following:
> > 
> > Athlon64 (3200)
> > Sorcery: devel
> > Grimoire: test

I'm using an athlon 1,4 with devel sorcery and test grimoire.

> > 
> > The only thing I found familiar was the reference to selinux in the fact 
> > that I had previously said
> > 'yes' when casting udev and shadow to have selinux support.

Ok, since you're obviously interested in trying out selinux, care to help me
write a patch for coreutils?

> > 
> > I have tried recasting both these spells and removing the support and 
> > then recasting glibc,
> > but to no avail.

If you want to remove selinux support, you'll need the following 2 commands
(note that you only have to cast linux-pam again if it was installed):

dispel libselinux libsepol policy policycoreutils checkpolicy setools
cast -c -r linux udev linux-pam shadow glibc

that should provide you with a working glibc and make sure you can actually
still login when you reboot ;)

> > 
> > Would be happy if someone would point me in the right direction :)

If this doesn't work, let me know. I'll gladly help you resolve remaining
selinux related problems.

> > 
> > Craig
> > 
> > PS. Really sorry if it is just my domestic blindness and someone else 
> > has already raised this.

Thanks for bringing this up on the mailing list. So far it only came up on 
IRC.

> > 
> > _______________________________________________
> > SM-Discuss mailing list
> > SM-Discuss AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-discuss
> > 
> 
> -- 
> Arwed v. Merkatz                              Source Mage GNU/Linux 
> developer
>                                                     
> http://www.sourcemage.org
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss


One small note, selinux is almost working in smgl which is why the relevant
spells have selinux questions added. However, currently all you can achieve 
with
it is locking up your box completely. That is, no keyboard and mouse access.
Any running daemon/service will continue to work just fine.

To protect our innocent users, I've kept the init script from the grimoires.
(even p4 devel). The only thing what can happen atm is indeed spells failing
during configure or compilation. As far as I know it does not make spalls fail
during the actual installation so should be safe.

I hope this answers some questions about selinux on smgl, feel free to ask if
something is unclear.

Arjan Bouter
( I'm abouter in #sourcemage )

+=======
Source Mage GNU/Linux developer,
Linux so advanced, it may as well be magic.
http://www.sourcemage.org

Registered as user #310617 with the Linux Counter,
http://counter.li.org.

GnuPG Key 79D4B14E = 94AD 3FD1 E259 67ED 632E  2B06 CFBE 1154 79D4 B14E
+===

Attachment: pgp6j3kQktfta.pgp
Description: PGP signature