Kernel Bug Tracker – Bug 11500
/proc/net bug related to selinux
Last modified: 2010-09-02 20:00:03 UTC
Subject : linux-next: Tree for September 3
Submitter : Andrew Morton <email@example.com>
Date : 2008-09-04 17:45
References : http://marc.info/?l=linux-kernel&m=122055041313270&w=4
This entry is being used for tracking a regression from 2.6.26. Please don't
close it until the problem is fixed in the mainline.
# /sbin/ausearch -m AVC -sv no
would be of interest.
On Saturday, 13 of September 2008, Andrew Morton wrote:
> On Sat, 13 Sep 2008 10:15:43 +1000 (EST) James Morris <firstname.lastname@example.org> wrote:
> > On Fri, 12 Sep 2008, Andrew Morton wrote:
> > > > > Bug-Entry : http://bugzilla.kernel.org/show_bug.cgi?id=11500
> > > > > Subject : /proc/net bug related to selinux
> > > > > Submitter : Andrew Morton <email@example.com>
> > > > > Date : 2008-09-04 17:45 (9 days old)
> > > > > References : http://marc.info/?l=linux-kernel&m=122055041313270&w=4
> > > >
> > > > I think this might be a regression caused by namespace changes which we
> > By which I mean, this was caused by a non-SELinux change to the upstream
> > kernel many, many eons ago.
> hm, seems that 2.6.24 is OK but 2.6.25 is not. I must have missed the
> bug when testing 2.6.25-based kernels.
> I started a git bisection search but after half an hour I hit bad
> bisection breakage: a complete machine hang in fib_rules_init().
In http://marc.info/?l=linux-kernel&m=122056291403378&w=4 it seems to be resolved as a wont-fix:
| Andrew Morton <firstname.lastname@example.org> writes:
| > On Thu, 04 Sep 2008 13:31:01 -0700
| > email@example.com (Eric W. Biederman) wrote:
| >> >> are you sure it's a plain tree of mine, without any of the patches
| >> >> floating around between Eric/Al?
| >> >
| >> > yup, it's yesterday's mainline.
| >> Does the problem happen if you disable selinux?
| >> This feels like a case of selinux being over zealous.
| > yeah, adding `selinux=0' to the boot command line fixes it.
| The proc generic directory back structure is the same. As requested by
| the selinux folks. So I don't expect there is much more we can do on
| the /proc side.
| When we get the interaction bug between the VFS and /proc/net fixed I wonder
| if there will be some more selinux fall out. Something to think about.
So this should be closed, probably...
Ah, reading up on some discussion about this regression I found this patch to fix symlink-issues with selinux in /proc which got merged for 2.6.28:
| commit ea6b184f7d521a503ecab71feca6e4057562252b
| Author: Stephen Smalley <firstname.lastname@example.org>
| Date: Mon Sep 22 15:41:19 2008 -0400
| selinux: use default proc sid on symlinks