[gentoo-hardened] SELinux bughunt

[gentoo-hardened] SELinux bughunt

[Sven Vermeulen]

Hi guys,

The SELinux bugs are "piling" up but most of them are resolved and I'd like to
use the STATUS field to keep track of which bugs are actually still open...

Considering the available states in the status field in bugzilla, I think it
is a nice idea to say:

  UNCONFIRMED = reported, not taken up
  CONFIRMED   = reported and considered valid
  IN_PROGRESS = taken up by a developer, fix might be available (ask developer)
  RESOLVED    = fix available, waiting QA. Fix might be in hardened-dev.git
                or another overlay
  VERIFIED    = fix available and accepted. Fix might be in ~arch
  FIXED       = fix available and in portage tree "arch" status

I know it looks like some bureaucratic nonesense for some, but at least that
allows poor developers like me to see which bugs are still open for grabs,
which are awaiting stabilization, which still needs to be pushed to portage
tree, etc.

Considering the above (but also recent updates and fixes), the following
bugs need to be altered. Perhaps someone can take care of this for me?

#283274 - Mark as FIXED
#134129 - Mark as WONTFIX (we do not support SELinux and PPC)
#274239 - Mark as FIXED
#306393 - Mark as VERIFIED
#257111 - Mark as VERIFIED
#275085 - Mark as RESOLVED
#211374 - Mark as IN_PROGRESS
#368795 - Mark as RESOLVED
#365761 - Mark as CONFIRMED
#370765 - Mark as RESOLVED NEEDINFO + comment that the bug needs to be reopened then
#371831 - Mark as RESOLVED
#369089 - Mark as VERIFIED
#371425 - Mark as VERIFIED
#374991 - Mark as FIXED
#375475 - Mark as CONFIRMED
#375617 - Mark as IN_PROGRESS
#373381 - Mark as CONFIRMED

Thanks in advance.

Wkr,
	Sven Vermeulen

Re: [gentoo-hardened] SELinux bughunt

[Chris Richards]

On Thu, July 21, 2011 5:06 am, Sven Vermeulen wrote:
> Hi guys,
>
> The SELinux bugs are "piling" up but most of them are resolved and I'd
> like to
> use the STATUS field to keep track of which bugs are actually still
> open...
>
> Considering the available states in the status field in bugzilla, I think
> it
> is a nice idea to say:

Is there not already a standard definition of what these statuses mean? 
If so, why not use that, rather than defining our own definitions within
the SELinux team?

Later,
Gizmo

Re: [gentoo-hardened] SELinux bughunt

[Sven Vermeulen]

[-- Attachment #1: Type: text/plain, Size: 380 bytes --]

On Thu, Jul 21, 2011 at 3:47 PM, Chris Richards <gizmo@giz-works.com> wrote:

> Is there not already a standard definition of what these statuses mean?
> If so, why not use that, rather than defining our own definitions within
> the SELinux team?
>
>
There is, and the definition I gave earlier matches on it. Problem is that
the definitions are ambiguous.

Wkr,
  Sven Vermeulen

[-- Attachment #2: Type: text/html, Size: 639 bytes --]

Re: [gentoo-hardened] SELinux bughunt

[Anthony G. Basile]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 07/21/2011 06:06 AM, Sven Vermeulen wrote:
> Hi guys,
> 
> The SELinux bugs are "piling" up but most of them are resolved and I'd like to
> use the STATUS field to keep track of which bugs are actually still open...
> 
> Considering the available states in the status field in bugzilla, I think it
> is a nice idea to say:
> 
>   UNCONFIRMED = reported, not taken up
>   CONFIRMED   = reported and considered valid
>   IN_PROGRESS = taken up by a developer, fix might be available (ask developer)
>   RESOLVED    = fix available, waiting QA. Fix might be in hardened-dev.git
>                 or another overlay
>   VERIFIED    = fix available and accepted. Fix might be in ~arch
>   FIXED       = fix available and in portage tree "arch" status
> 
> I know it looks like some bureaucratic nonesense for some, but at least that
> allows poor developers like me to see which bugs are still open for grabs,
> which are awaiting stabilization, which still needs to be pushed to portage
> tree, etc.
> 
> Considering the above (but also recent updates and fixes), the following
> bugs need to be altered. Perhaps someone can take care of this for me?
> 
> #283274 - Mark as FIXED
> #134129 - Mark as WONTFIX (we do not support SELinux and PPC)
> #274239 - Mark as FIXED
> #306393 - Mark as VERIFIED
> #257111 - Mark as VERIFIED
> #275085 - Mark as RESOLVED
> #211374 - Mark as IN_PROGRESS
> #368795 - Mark as RESOLVED
> #365761 - Mark as CONFIRMED
> #370765 - Mark as RESOLVED NEEDINFO + comment that the bug needs to be reopened then
> #371831 - Mark as RESOLVED
> #369089 - Mark as VERIFIED
> #371425 - Mark as VERIFIED
> #374991 - Mark as FIXED
> #375475 - Mark as CONFIRMED
> #375617 - Mark as IN_PROGRESS
> #373381 - Mark as CONFIRMED
> 
> Thanks in advance.
> 
> Wkr,
> 	Sven Vermeulen

I'll get them.



- -- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREIAAYFAk4pUvcACgkQl5yvQNBFVTUjUwCff769Pq00bDYBgmWSqhnLxFVN
POEAnj1UsjVzPS4k61W+IVElkK1L8k/0
=J3Sv
-----END PGP SIGNATURE-----

Re: [gentoo-hardened] SELinux bughunt

[d hee]

Hello,

Bug #283274 is NOT FIXED. I just updated my system last night and I got a segment fault with trying to encrypt a partition in luks format. Not only that, but I used to copy the patch and patch the ebuild to over come this. For some strange reason, the patch no longer works. In addition, it would of been nice if the patch was included in the original ebuild as it will be a long time before glibc-12.3-r2 will be unmasked. I have posted the results in the bug report.


Thank you,
-Darin Hensley





----- Original Message -----
From: Anthony G. Basile <basile@opensource.dyc.edu>
To: gentoo-hardened@lists.gentoo.org
Cc: 
Sent: Friday, July 22, 2011 5:37 AM
Subject: Re: [gentoo-hardened] SELinux bughunt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 07/21/2011 06:06 AM, Sven Vermeulen wrote:
> Hi guys,
> 
> The SELinux bugs are "piling" up but most of them are resolved and I'd like to
> use the STATUS field to keep track of which bugs are actually still open...
> 
> Considering the available states in the status field in bugzilla, I think it
> is a nice idea to say:
> 
>   UNCONFIRMED = reported, not taken up
>   CONFIRMED   = reported and considered valid
>   IN_PROGRESS = taken up by a developer, fix might be available (ask developer)
>   RESOLVED    = fix available, waiting QA. Fix might be in hardened-dev.git
>                 or another overlay
>   VERIFIED    = fix available and accepted. Fix might be in ~arch
>   FIXED       = fix available and in portage tree "arch" status
> 
> I know it looks like some bureaucratic nonesense for some, but at least that
> allows poor developers like me to see which bugs are still open for grabs,
> which are awaiting stabilization, which still needs to be pushed to portage
> tree, etc.
> 
> Considering the above (but also recent updates and fixes), the following
> bugs need to be altered. Perhaps someone can take care of this for me?
> 
> #283274 - Mark as FIXED
> #134129 - Mark as WONTFIX (we do not support SELinux and PPC)
> #274239 - Mark as FIXED
> #306393 - Mark as VERIFIED
> #257111 - Mark as VERIFIED
> #275085 - Mark as RESOLVED
> #211374 - Mark as IN_PROGRESS
> #368795 - Mark as RESOLVED
> #365761 - Mark as CONFIRMED
> #370765 - Mark as RESOLVED NEEDINFO + comment that the bug needs to be reopened then
> #371831 - Mark as RESOLVED
> #369089 - Mark as VERIFIED
> #371425 - Mark as VERIFIED
> #374991 - Mark as FIXED
> #375475 - Mark as CONFIRMED
> #375617 - Mark as IN_PROGRESS
> #373381 - Mark as CONFIRMED
> 
> Thanks in advance.
> 
> Wkr,
>     Sven Vermeulen

I'll get them.



- -- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREIAAYFAk4pUvcACgkQl5yvQNBFVTUjUwCff769Pq00bDYBgmWSqhnLxFVN
POEAnj1UsjVzPS4k61W+IVElkK1L8k/0
=J3Sv
-----END PGP SIGNATURE-----

Re: [gentoo-hardened] SELinux bughunt

[Sven Vermeulen]

On Fri, Jul 22, 2011 at 07:27:23AM -0700, d hee wrote:
> Bug #283274 is NOT FIXED. I just updated my system last night and I got a
> segment fault with trying to encrypt a partition in luks format. Not only
> that, but I used to copy the patch and patch the ebuild to over come this.
> For some strange reason, the patch no longer works. In addition, it would
> of been nice if the patch was included in the original ebuild as it will
> be a long time before glibc-12.3-r2 will be unmasked. I have posted the
> results in the bug report.

Bug #283274 is about app-admin/setools-3.3.6 not being able to be built,
which was confirmed fixed by the reporter. It doesn't talk about encryption
or luks.

I guess you mean bug #361911, which is about cryptsetup. This one is still
open.

Wkr,
	Sven Vermeulen

Re: [gentoo-hardened] SELinux bughunt

[d hee]

No, Bug #283274 is about segmentation fault when encrypting a Luks partition :


From the original poster:

"

Trying to run the following command always results in the following: luffy ~ # /sbin/cryptsetup --cipher=aes-cbc-essiv:sha256 -s 256 luksFormat
/dev/md0 WARNING!
========
This will overwrite data on /dev/md0 irrevocably. Are you sure? (Type uppercase yes): YES
Segmentation fault (core dumped) I have two nearly identical systems (CPU,Mobo,etc) one running gentoo-sources
(phoenix) and hardened-sources (luffy).  Reproducible: Always Steps to Reproduce:
1. luffy ~ # /sbin/cryptsetup --cipher=aes-cbc-essiv:sha256 -s 256 luksFormat
/dev/md0
2. Type "YES"
3. View segfalt Actual Results:  
luffy ~ # /sbin/cryptsetup --cipher=aes-cbc-essiv:sha256 -s 256 luksFormat
/dev/md0 WARNING!
========
This will overwrite data on /dev/md0 irrevocably. Are you sure? (Type uppercase yes): YES
Segmentation fault (core dumped)"


This was dated back in 2009. Then a patch fixed the problem. But the patch no longer works. This happened on my system last night after a rebuild from a world update.

Thank you,
Darin







----- Original Message -----
From: Sven Vermeulen <sven.vermeulen@siphos.be>
To: gentoo-hardened@lists.gentoo.org
Cc: 
Sent: Friday, July 22, 2011 10:08 AM
Subject: Re: [gentoo-hardened] SELinux bughunt

On Fri, Jul 22, 2011 at 07:27:23AM -0700, d hee wrote:
> Bug #283274 is NOT FIXED. I just updated my system last night and I got a
> segment fault with trying to encrypt a partition in luks format. Not only
> that, but I used to copy the patch and patch the ebuild to over come this.
> For some strange reason, the patch no longer works. In addition, it would
> of been nice if the patch was included in the original ebuild as it will
> be a long time before glibc-12.3-r2 will be unmasked. I have posted the
> results in the bug report.

Bug #283274 is about app-admin/setools-3.3.6 not being able to be built,
which was confirmed fixed by the reporter. It doesn't talk about encryption
or luks.

I guess you mean bug #361911, which is about cryptsetup. This one is still
open.

Wkr,
    Sven Vermeulen

Re: [gentoo-hardened] SELinux bughunt

[Anthony G. Basile]

On 07/22/2011 02:07 PM, d hee wrote:
> No, Bug #283274 is about segmentation fault when encrypting a Luks partition :

Please look at the following links:

   https://bugs.gentoo.org/show_bug.cgi?id=283274

   https://bugs.gentoo.org/show_bug.cgi?id=283470



-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197

Re: [gentoo-hardened] SELinux bughunt

[d hee]

Can anything be done about this bug(that is originally 2 years old)? Since the patch no longer works, and I can not install glibc-2.13-r2 because of it's own problems, I can not create a Luks partition that I need to create. 





----- Original Message -----
From: Anthony G. Basile <basile@opensource.dyc.edu>
To: gentoo-hardened@lists.gentoo.org
Cc: 
Sent: Friday, July 22, 2011 2:33 PM
Subject: Re: [gentoo-hardened] SELinux bughunt

On 07/22/2011 02:07 PM, d hee wrote:
> No, Bug #283274 is about segmentation fault when encrypting a Luks partition :

Please look at the following links:

  https://bugs.gentoo.org/show_bug.cgi?id=283274

  https://bugs.gentoo.org/show_bug.cgi?id=283470



-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197

Re: [gentoo-hardened] SELinux bughunt

[Mike Edenfield]

On 7/23/2011 4:54 PM, d hee wrote:
> Can anything be done about this bug(that is originally 2 years old)? Since the patch no longer works, and I can not install glibc-2.13-r2 because of it's own problems, I can not create a Luks partition that I need to create.

You did the right thing by posting an update to the bug 
tracker, but you missed a step from the error message:

  * Include in your bugreport the contents of:
  *
  * 
/var/tmp/portage/sys-fs/cryptsetup-1.1.3-r3/temp/newpatch.patch.out

The patch is failing because the source is too different 
from what it's expecting; someone just needs to re-roll the 
patch. Posting the output of that file into the bug report 
may improve the chances of that happening quickly.

--Mike

Re: [gentoo-hardened] SELinux bughunt

[Magnus Granberg]

lördag 23 juli 2011 13.54.47 skrev  d hee:
> Can anything be done about this bug(that is originally 2 years old)? Since
> the patch no longer works, and I can not install glibc-2.13-r2 because of
> it's own problems, I can not create a Luks partition that I need to create.
Make a dir /etc/portage/patches/sys-libs/glibc
Put the last patch from the bug in there and then recompile glibc.
Works fine for me.
* Done with patching
 * Applying user patches from /etc/portage/patches/sys-libs/glibc ...
 *   __restore_rt_attribute_hidden.patch ...                                                                               [ ok ]
 * Done with patching


/Magnus (Zorry)

Re: [gentoo-hardened] SELinux bughunt

[d hee]

I'm currently not able to recompile glibc. I tried and I keep getting a force unwind config error(this is a multi lib system). This is a pretty new system built about a month and a half ago. I checked with gcc-config and I am using the latest non masked compiler available from portage.



----- Original Message -----
From: Magnus Granberg <zorry@gentoo.org>
To: gentoo-hardened@lists.gentoo.org
Cc: 
Sent: Sunday, July 24, 2011 7:16 AM
Subject: Re: [gentoo-hardened] SELinux bughunt

lördag 23 juli 2011 13.54.47 skrev  d hee:
> Can anything be done about this bug(that is originally 2 years old)? Since
> the patch no longer works, and I can not install glibc-2.13-r2 because of
> it's own problems, I can not create a Luks partition that I need to create.
Make a dir /etc/portage/patches/sys-libs/glibc
Put the last patch from the bug in there and then recompile glibc.
Works fine for me.
* Done with patching
* Applying user patches from /etc/portage/patches/sys-libs/glibc ...
*   __restore_rt_attribute_hidden.patch ...                                                                               [ ok ]
* Done with patching


/Magnus (Zorry)

Re: [gentoo-hardened] SELinux bughunt

[d hee]

Opened bug #376431 with necessary system information attached. 



----- Original Message -----
From: d hee <coolio@ymail.com>
To: "gentoo-hardened@lists.gentoo.org" <gentoo-hardened@lists.gentoo.org>
Cc: 
Sent: Sunday, July 24, 2011 3:29 PM
Subject: Re: [gentoo-hardened] SELinux bughunt

I'm currently not able to recompile glibc. I tried and I keep getting a force unwind config error(this is a multi lib system). This is a pretty new system built about a month and a half ago. I checked with gcc-config and I am using the latest non masked compiler available from portage.



----- Original Message -----
From: Magnus Granberg <zorry@gentoo.org>
To: gentoo-hardened@lists.gentoo.org
Cc: 
Sent: Sunday, July 24, 2011 7:16 AM
Subject: Re: [gentoo-hardened] SELinux bughunt

lördag 23 juli 2011 13.54.47 skrev  d hee:
> Can anything be done about this bug(that is originally 2 years old)? Since
> the patch no longer works, and I can not install glibc-2.13-r2 because of
> it's own problems, I can not create a Luks partition that I need to create.
Make a dir /etc/portage/patches/sys-libs/glibc
Put the last patch from the bug in there and then recompile glibc.
Works fine for me.
* Done with patching
* Applying user patches from /etc/portage/patches/sys-libs/glibc ...
*   __restore_rt_attribute_hidden.patch ...                                                                               [ ok ]
* Done with patching


/Magnus (Zorry)

Re: [gentoo-hardened] SELinux bughunt

[d hee]

Ok, I attached all the information...including the patch output. 


I'm not sure why, but I might of gotten the bug number wrong or there was some kind of mix up with the bug numbers but it is bug #283470.


----- Original Message -----
From: Mike Edenfield <kutulu@kutulu.org>
To: gentoo-hardened@lists.gentoo.org
Cc: d hee <coolio@ymail.com>
Sent: Saturday, July 23, 2011 8:30 PM
Subject: Re: [gentoo-hardened] SELinux bughunt

On 7/23/2011 4:54 PM, d hee wrote:
> Can anything be done about this bug(that is originally 2 years old)? Since the patch no longer works, and I can not install glibc-2.13-r2 because of it's own problems, I can not create a Luks partition that I need to create.

You did the right thing by posting an update to the bug tracker, but you missed a step from the error message:

* Include in your bugreport the contents of:
*
* /var/tmp/portage/sys-fs/cryptsetup-1.1.3-r3/temp/newpatch.patch.out

The patch is failing because the source is too different from what it's expecting; someone just needs to re-roll the patch. Posting the output of that file into the bug report may improve the chances of that happening quickly.

--Mike

Re: [gentoo-hardened] SELinux bughunt

[d hee]

 https://bugs.gentoo.org/376485 "Selinux policycoreutils-2.0.82 fails to compile because of python"

Added




----- Original Message -----
From: Anthony G. Basile <basile@opensource.dyc.edu>
To: gentoo-hardened@lists.gentoo.org
Cc: 
Sent: Friday, July 22, 2011 5:37 AM
Subject: Re: [gentoo-hardened] SELinux bughunt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 07/21/2011 06:06 AM, Sven Vermeulen wrote:
> Hi guys,
> 
> The SELinux bugs are "piling" up but most of them are resolved and I'd like to
> use the STATUS field to keep track of which bugs are actually still open...
> 
> Considering the available states in the status field in bugzilla, I think it
> is a nice idea to say:
> 
>   UNCONFIRMED = reported, not taken up
>   CONFIRMED   = reported and considered valid
>   IN_PROGRESS = taken up by a developer, fix might be available (ask developer)
>   RESOLVED    = fix available, waiting QA. Fix might be in hardened-dev.git
>                 or another overlay
>   VERIFIED    = fix available and accepted. Fix might be in ~arch
>   FIXED       = fix available and in portage tree "arch" status
> 
> I know it looks like some bureaucratic nonesense for some, but at least that
> allows poor developers like me to see which bugs are still open for grabs,
> which are awaiting stabilization, which still needs to be pushed to portage
> tree, etc.
> 
> Considering the above (but also recent updates and fixes), the following
> bugs need to be altered. Perhaps someone can take care of this for me?
> 
> #283274 - Mark as FIXED
> #134129 - Mark as WONTFIX (we do not support SELinux and PPC)
> #274239 - Mark as FIXED
> #306393 - Mark as VERIFIED
> #257111 - Mark as VERIFIED
> #275085 - Mark as RESOLVED
> #211374 - Mark as IN_PROGRESS
> #368795 - Mark as RESOLVED
> #365761 - Mark as CONFIRMED
> #370765 - Mark as RESOLVED NEEDINFO + comment that the bug needs to be reopened then
> #371831 - Mark as RESOLVED
> #369089 - Mark as VERIFIED
> #371425 - Mark as VERIFIED
> #374991 - Mark as FIXED
> #375475 - Mark as CONFIRMED
> #375617 - Mark as IN_PROGRESS
> #373381 - Mark as CONFIRMED
> 
> Thanks in advance.
> 
> Wkr,
>     Sven Vermeulen

I'll get them.



- -- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
(716) 829-8197
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEAREIAAYFAk4pUvcACgkQl5yvQNBFVTUjUwCff769Pq00bDYBgmWSqhnLxFVN
POEAnj1UsjVzPS4k61W+IVElkK1L8k/0
=J3Sv
-----END PGP SIGNATURE-----