Public SourceMage Discussion List

[Craig Dyke <grail AT westnet.com.au>]

Arjan Bouter wrote:

> On Mon, 14 Mar 2005 18:31:14 +0800
> Craig Dyke <grail AT westnet.com.au> wrote:
>
>  
>
> > Arjan
> >
> > Thankyou for all the details below.
> >    
>
> you're welcome
>
>  
>
> > I am in no way upset about your warning as I figured it was probably 
> > something I might have
> > done anyway :))
> >    
>
> *phew* when i read my email before sending it i thought it might me considered 
> a bit harsh, so i added that line just in case :)
>
>  
>
> > I am happy to help with coreutils patch, just tell me what you would 
> > like me to do?
> >    
>
> I'm hunting for a working coreutils patch. so far i've tried the patches from
> redhat, fedora, suse, selinux.sourceforge.net and the nsa website.
> They all fail :(
> I also tried fixing the patches but as i'm not a programmer i get stuck at the
> very same point as the patches from fedora and suse (the rest fails much
> earlier).
>
>  
>
> > Please also let me know what items need to be included in kernel, in 
> > case I missed any?
> >    
>
> for selinux support you want to enable auditing support and the selinux 
> security
> options:
>
> CONFIG_AUDIT=y
> CONFIG_SECURITY_SELINUX=y
> CONFIG_SECURITY_SELINUX_BOOTPARAM=y
> CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
> # CONFIG_SECURITY_SELINUX_DISABLE is not set
> CONFIG_SECURITY_SELINUX_DEVELOP=y
> CONFIG_SECURITY_SELINUX_AVC_STATS=y
> # CONFIG_SECURITY_SELINUX_MLS is not set
>
> and you'll want to cast the following spells:
> libselinux libsepol policy policycoreutils checkpolicy
>
> and rebuild (if installed)
> linux-pam udev shadow psmisc procps glibc
>
> glibc will probably only compile once you're booted into an selinux enabled
> kernel and with libselinux installed. I can mail you the missing init script i
> was talking about, but i'd rather not until you're sure you understand the
> documentation. Again no offense, but there's a real risk you lock yourself out
> of your box when you enable a half implemented selinux environment. Trust me,
> i've done so numerous times ;)
> Let me know when/if you want them.
>
> Also, if you use a display manager like gdm, rebuild that as well and enable 
> the
> selinux options. for gdm i'm sure there's options, the others you'd have to
> check for yourself.
>
> ABout coreutils:
> If you could try to fix one of the patches or help looking for a working one
> that would be great. I've spend weeks google'ing for patches and info and 2
> people have more chance of discovering something than me on my own ;)
>
> The patches for the different distro's can be found in their respective CVS 
> web
> client on their homepages
>
> Some other URLs:
> http://www.nsa.gov/selinux
> http://selinux.sourceforge.net
>  
>
> > >      
> > >
> > > > > nscd_stat.c:34:30: selinux/selinux.h: No such file or directory
> > > > > nscd_stat.c:35:26: selinux/avc.h: No such file or directory
> > > > > nscd_stat.c:81: error: field `cstats' has incomplete type
> > > > > make[3]: Leaving directory `/usr/src/glibc-2.3.4/nscd'
> > > > > make[3]: *** [/usr/src/glibc-2.3.4.bld/nscd/nscd_stat.o] Error 1
> > > > > make[2]: Leaving directory `/usr/src/glibc-2.3.4'
> > > > > make[2]: *** [nscd/others] Error 2
> > > > > make[1]: Leaving directory `/usr/src/glibc-2.3.4.bld'
> > > > > make[1]: *** [all] Error 2
> > > > >     
> > > > >          
Arjan

Sorry it has taken me so long to get back to you.
I see you have already fixed the cracklib problem.

However, my compile of glibc 2.3.5 seems to have ended as before even 
though I have followed all of
your steps above.

I am using 2.6.11.7 with options selected as above.
I then recast all spells listed which completed successfully except glibc.

Any suggestions?

Craig