SELinux and kernel 2.6.19.2

SELinux and kernel 2.6.19.2

[Vincenzo Ciaglia]

Hello, like i said i had no problems to load SeLinux with a 2.6.14.5
kernel. 

So today i decided to upgrade to the latest 2.6.19.2. I built the kernel
succesfully but under "Security Options" i can't see the old "NSA
SELinux Support". Where is it ? How can i give to my system full support
with this kernel? I added Security Hooks support and security labels
too.

So i tried to add in my .config the following lines:

CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1

But nothing happened. I still have no SELinux support.

Maybe this is a dumb question, sorry, but i never tried to add the
SELinux support to one of the latest kernels. And i think there's
something that i still don't know about this.

Any help would be appreciated. Thank you!

-- 
Vincenzo Ciaglia, <vin(at)netwosix(dot)org>
Linux Netwosix - <www.netwosix.org>



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux and kernel 2.6.19.2

[Stephen Smalley]

On Sat, 2007-01-20 at 10:40 +0100, Vincenzo Ciaglia wrote:
> Hello, like i said i had no problems to load SeLinux with a 2.6.14.5
> kernel. 
> 
> So today i decided to upgrade to the latest 2.6.19.2. I built the kernel
> succesfully but under "Security Options" i can't see the old "NSA
> SELinux Support". Where is it ? How can i give to my system full support
> with this kernel? I added Security Hooks support and security labels
> too.
> 
> So i tried to add in my .config the following lines:
> 
> CONFIG_SECURITY_SELINUX=y
> CONFIG_SECURITY_SELINUX_BOOTPARAM=y
> CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
> CONFIG_SECURITY_SELINUX_DEVELOP=y
> CONFIG_SECURITY_SELINUX_AVC_STATS=y
> CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
> 
> But nothing happened. I still have no SELinux support.
> 
> Maybe this is a dumb question, sorry, but i never tried to add the
> SELinux support to one of the latest kernels. And i think there's
> something that i still don't know about this.
> 
> Any help would be appreciated. Thank you!

SELinux depends on the following options:  SECURITY_NETWORK (network
security hooks), AUDIT (basic audit support), NET && INET (network
support).  It also now selects NETWORK_SECMARK (new security marking
scheme for per-packet access control, obsoletes old netif/node/port
per-packet controls).  SECURITY_NETWORK_XFRM (xfrm/IPSEC hooks for
labeled IPSEC) is optional, as is NETLABEL (CIPSO labeling).

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux and kernel 2.6.19.2

[Vincenzo Ciaglia]

Il giorno lun, 22/01/2007 alle 08.56 -0500, Stephen Smalley ha scritto:

> SELinux depends on the following options:  SECURITY_NETWORK (network
> security hooks), AUDIT (basic audit support), NET && INET (network
> support).  It also now selects NETWORK_SECMARK (new security marking
> scheme for per-packet access control, obsoletes old netif/node/port
> per-packet controls).  SECURITY_NETWORK_XFRM (xfrm/IPSEC hooks for
> labeled IPSEC) is optional, as is NETLABEL (CIPSO labeling).

Oh...thank you, now i see the SELinux support. I didn't set the "audit
support".

And thank you for the "pam library" suggestion. Now it works!

-- 
Vincenzo Ciaglia, <vin(at)netwosix(dot)org>
Linux Netwosix - <www.netwosix.org>



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.