sds@xxxxxxxxxxxxxx (Stephen Smalley) writes:
>> * policy can not be rebuilt ('checkpolicy' has compatibility range
>> 15-17, but kernel is 18)
> ...
> Newer SELinux kernels still accept older policy versions, so it should be
> possible to fix the first problem just by modifying the policy Makefile
> and spec file to load whatever version was built by checkpolicy rather
> than always using the kernel's policy version (which just represents the
> latest version it understands). /sbin/init should already contain the
> code to try older policy versions.
Yes, the policy seems to get loaded. But rebuilding does not work
out-of-the-box anymore.
> I'm not sure about your reference to sshd and ptys, but I have seen an
> occasional problem with devpts where I have had to unmount it and
> re-mount it to get things working again.
I can login once without problems. But on the second login, I do
not get a prompt because sshd fails to allocate a new pty. See
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=129990.
Recent 2.6.8-1.521 kernel (permissive mode) gives additional
information:
| sshd[1864]: Warning! Could not relabel with system_u:object_r:sshd_devpts_t, not relabeling.
Enrico
