Nall Design Works

VMWare Fusion port forwarding

admin — Mon, 14 Jun 2010 01:32:42 +0000

I needed to forward port 2020 on my laptop to a VM for test

 sudo vi "/Library/Application Support/VMware Fusion/vmnet8/nat.conf"

Edit the [incomingtcp] stanza and add the port forward. 192.168.243.138 is the VM IP address.

[incomingtcp]
2020 = 192.168.243.138:2020

Restart VMware Fusion networking.

 sudo "/Library/Application Support/VMware Fusion/boot.sh" --restart

MacBook Pro VMWare xorg.conf for Fedora 10 Enforcing

admin — Fri, 11 Jun 2010 15:42:59 +0000

Turning on MLS in Fedora 13 (v2)

admin — Thu, 10 Jun 2010 15:36:40 +0000

Download Fedora 13 from http://fedoraproject.org/get-fedora
Boot and install a gnome desktop (I haven’t tested KDE).
Login and do the following:

 su -
 yum update
 yum install selinux-policy-mls policycoreutils-gui
 yum erase setroubleshoot-server
 sed -i -e "s/targeted/mls/" /etc/selinux/config
 touch /.autorelabel
 chkconfig mcstrans on
 reboot

Per Dan Walsh, setroubleshoot needs to be removed because sedispatch, a component of setroubleshoot-server runs at SystemHigh and can’t talk to the SystemLow system DBus, generating an endless stream of AVCs. After the reboot, login as root on a VT and

 semanage user -a -r SystemLow-SystemHigh -L SystemLow -R staff_r staff_u
 semanage login -a -s staff_u joe
 setsebool allow_execmem on
 newrole -r secadm_r
 rm -f /var/log/audit/audit.log
 reboot

Replace joe with your user name.

You can login as yourself through gdm at this point. The allow_execmem boolean allows firefox to work when run as staff_t.

Turning on MLS in Fedora 13

admin — Thu, 10 Jun 2010 03:13:22 +0000

Download Fedora 13 from http://fedoraproject.org/get-fedora
Boot and install a gnome desktop (I haven’t tested KDE).
Login and do the following:

 su -
 yum update
 yum install selinux-policy-mls
 yum erase setroubleshoot-server
 sed -i -e "s/targeted/mls/" /etc/selinux/config
 touch /.autorelabel
 chkconfig mcstrans on
 reboot

sedispatch, a component of setroubleshoot-server generates an endless stream of AVCs (Bug 602502) that resemble

sedispatch avc

so I chose to remove it. After the reboot, login as root on a VT and

 semanage user -a -r SystemLow-SystemHigh -L SystemLow -R staff_r staff_u
 semanage login -a -s staff_u joe
 newrole -r secadm_r -l SystemHigh
 rm -f /var/log/audit/audit.log
 reboot

Replace joe with your user name.

You can login as yourself through gdm at this point. I tried to start firefox, but it died with a segmentation violation (Bug 602518).

Firefox dies

I’m pretty impressed that something so out of the mainstream works so well on a first try.