Re: SELinux on Wheezy

[Stephen Smalley <sds@tycho.nsa.gov>]

On Tue, 2012-02-07 at 13:05 -0800, C.J. Adams-Collier wrote:
> cjac@foxtrot:~$ sudo which seinfo
> cjac@foxtrot:~$ apt-file search seinfo | grep bin | wc -l
> 0

seinfo is part of the setools package.

> Sounds reasonable.  Do I get policy from my distribution, or should I
> generate one myself?

Normally from your distribution, assuming the selinux packages for
Debian are still being maintained.

IIRC, the Debian selinux policy package tries to minimize the set of
installed policy modules based on the set of installed packages, but
that isn't an exact mapping and might be leaving you without a complete
policy.  Whereas Fedora installs all policy modules unconditionally.

If the .pp files are on your filesystem and just not installed into the
policy store, you can manually add them by running semodule -i on them.
Try listing the files installed from your policy packages and see if
xserver.pp is among them.  

> cjac@foxtrot:~$ dpkg -l | grep selinux-policy
> ii  selinux-policy-default               2:2.20110726-3                 Strict and Targeted variants of the SELinux policy
> ii  selinux-policy-dev                   2:2.20110726-3                 Headers from the SELinux reference policy for building modules
> ii  selinux-policy-doc                   2:2.20110726-3                 Documentation for the SELinux reference policy
> 
> cjac@foxtrot:~$ apt-cache search selinux-policy
> selinux-policy-default - Strict and Targeted variants of the SELinux policy
> selinux-policy-dev - Headers from the SELinux reference policy for building modules
> selinux-policy-doc - Documentation for the SELinux reference policy
> selinux-policy-mls - MLS (Multi Level Security) variant of the SELinux policy
> selinux-policy-src - Source of the SELinux reference policy for customization
> 
> If I'm going to generate one myself, I need to understand them a bit
> better.  I would like anything I generate to be useable by the rest of
> the Debian world.  There seem to be some examples I ran review in the
> selinux-policy-doc and selinux-policy-mls packages.
> 
> Regarding re-labeling, every time I boot without the selinux arguments
> to my kernel and then boot with them, the filesystem seems to get
> re-labeled.  Is there a better way to do this?

On Fedora, you could touch /.autorelabel or pass "autorelabel" on the
kernel command line to force a relabel at boot.  You can also run
fixfiles relabel as a command after booting.  No need to disable SELinux
and then re-enable it.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.