|Summary:||/proc/net bug related to selinux|
|Product:||File System||Reporter:||Rafael J. Wysocki (rjw)|
|Severity:||normal||CC:||florian, rjw, sds|
|Kernel Version:||commit fbb16e243887332dd5754e48ffe5b963378f3cd2||Tree:||Mainline|
|Bug Depends on:|
Description Rafael J. Wysocki 2008-09-04 14:42:28 UTC
Comment 1 Stephen Smalley 2008-09-08 05:57:30 UTC
Output of: # /sbin/ausearch -m AVC -sv no would be of interest.
Comment 2 Rafael J. Wysocki 2008-09-14 17:12:50 UTC
On Saturday, 13 of September 2008, Andrew Morton wrote: > On Sat, 13 Sep 2008 10:15:43 +1000 (EST) James Morris <email@example.com> > wrote: > > > On Fri, 12 Sep 2008, Andrew Morton wrote: > > > > > > > Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=11500 > > > > > Subject : /proc/net bug related to selinux > > > > > Submitter : Andrew Morton <firstname.lastname@example.org> > > > > > Date : 2008-09-04 17:45 (9 days old) > > > > > References : > http://marc.info/?l=linux-kernel&m=122055041313270&w=4 > > > > > > > > I think this might be a regression caused by namespace changes which we > > > > By which I mean, this was caused by a non-SELinux change to the upstream > > kernel many, many eons ago. > > hm, seems that 2.6.24 is OK but 2.6.25 is not. I must have missed the > bug when testing 2.6.25-based kernels. > > I started a git bisection search but after half an hour I hit bad > bisection breakage: a complete machine hang in fib_rules_init().
Comment 3 Florian Mickler 2010-08-16 13:00:46 UTC
In http://marc.info/?l=linux-kernel&m=122056291403378&w=4 it seems to be resolved as a wont-fix: | Andrew Morton <email@example.com> writes: | | > On Thu, 04 Sep 2008 13:31:01 -0700 | > firstname.lastname@example.org (Eric W. Biederman) wrote: | > | >> >> are you sure it's a plain tree of mine, without any of the patches | >> >> floating around between Eric/Al? | >> > | >> > yup, it's yesterday's mainline. | >> | >> Does the problem happen if you disable selinux? | >> | >> This feels like a case of selinux being over zealous. | > | > yeah, adding `selinux=0' to the boot command line fixes it. | | The proc generic directory back structure is the same. As requested by | the selinux folks. So I don't expect there is much more we can do on | the /proc side. | | When we get the interaction bug between the VFS and /proc/net fixed I wonder | if there will be some more selinux fall out. Something to think about. | | Eric So this should be closed, probably...
Comment 4 Florian Mickler 2010-08-18 11:24:14 UTC
Ah, reading up on some discussion about this regression I found this patch to fix symlink-issues with selinux in /proc which got merged for 2.6.28: | | commit ea6b184f7d521a503ecab71feca6e4057562252b | Author: Stephen Smalley <email@example.com> | Date: Mon Sep 22 15:41:19 2008 -0400 | | selinux: use default proc sid on symlinks |