[gentoo-hardened] Problems with su on 20120215 policy and latest policycoreutils

2012-03-10 Thread Krzysztof Nowicki
Hi, Recently I've upgraded the policy to the latest testing version. I've also had to upgrade policycoreutils (+deps) to the versions from the overlay, since they're required by the policies. Everything seems to be working fine for now, but I noticed a problem with su. Every time I try to use i

RE: Re: [gentoo-hardened] Problems with su on 20120215 policy and latest policycoreutils

2012-03-11 Thread Krzysztof Nowicki
W dniu 2012-03-10 20:42:07 użytkownik Sven Vermeulen napisał: > On Sat, Mar 10, 2012 at 07:07:54PM +0100, Krzysztof Nowicki wrote: > > Recently I've upgraded the policy to the latest testing version. I've also > > had to upgrade policycoreutils (+deps) to the

[gentoo-hardened] Using sys-kernel/dracut with SELinux

2013-03-06 Thread Krzysztof Nowicki
Hi, I'm trying to migrate a machine to SELinux. I was able to run all the steps related to the kernel, packages and filesystem. The system boots fine in permissive mode but I'm getting a lot of AVC denials related to /run. The obvious suspect would the lack of proper labelling so I checked the

Re: [gentoo-hardened] Using sys-kernel/dracut with SELinux

2013-03-06 Thread Krzysztof Nowicki
On 06.03.2013 15:13, Sven Vermeulen wrote: If dracut doesn't use the fstab options then you'll need to find where it gets mounted and update that. Perhaps creating an additional dracut module to remount with the correct options works as well and is more manageable in the longer term? -- Sent f

Re: [gentoo-hardened] Using sys-kernel/dracut with SELinux

2013-03-06 Thread Krzysztof Nowicki
On 06.03.2013 20:06, Krzysztof Nowicki wrote: [...] (it will call is_selinux_running() from libselinux). Actually I meant is_selinux_enabled().

Re: [gentoo-hardened] "grsec: denied RWX mprotect" doesn't kill app anymore

2014-11-08 Thread Krzysztof Nowicki
On 01.11.2014 11:08, Alex Efros wrote: Hi! I wonder is something was changed in handling "grsec: denied RWX mprotect"? Previously when I see this in kernel log it usually result in killing app (and I've to run `paxctl-ng -m /that/app`), but now it looks like this doesn't happens anymore. For exa