Re: State of Debian SELinux

[Dale Amon <amon@vnl.com>]

[-- Attachment #1: Type: text/plain, Size: 2377 bytes --]

On Sun, Sep 18, 2005 at 11:42:19AM +0100, Luke Kenneth Casson Leighton wrote:
> On Sun, Sep 18, 2005 at 10:58:07AM +0100, Dale Amon wrote:
> > Ouch. Well, I'm only interested in getting it up on rack mount
> > server class machines with no fancy workstation apps on them. 
> > Nothing but LAMP's.
>   then you would do well to consider gentoo/hardened instead!!

Not an option. The software driving the active the site was
written specifically for debian and in debian packages. I'd
hate to have to go back to them and say, well, you know those
really neat debian packages I did last year...

> > I'm picking that up from Russel's repository during the upgrade
> > and it does install okay.
> 
>  look for manoj's stuff.

I will, but just in case, do you have a url?
 
>  okay, you need to reboot first with ... damn it's been a while...
> 
>  selinux=1 enabled=0

Actually, its enforcing=0. And unfortuneately that doesn't help.
I still get the same error messages as before.  
 
>  it's something to do with failures in the make process which i never
>  got to the bottom of - probably some of the libselinux / sepol
>  libraries detecting that selinux wasn't enabled, and not allowing
>  the build process to proceed properly.

There is definitely something I am missing with libsepol because
there is an error about it which means absolutely nothing to me
that causes dselect to give up on installing the default policy.
It also seems to mean nothing to Google so I guess it has not come
up on the mail list either:

	/usr/bin/checkpolicy: loading policy configuration from policy.conf
	libsepol.expand_avtab_insert: Type conflict!
	Out of memory - unable to check assertions.
	Check assertions failed.

Highly informative, n'est-ce pas? I can reproduce it manually:

	cd /etc/selinux/src/
	/usr/bin/checkpolicy

>  most people only build and install selinux on already-useable
>  selinux systems.

*amon turns to watch a chicken racing an egg across the road...

-- 
------------------------------------------------------
   Dale Amon     amon@islandone.org    +44-7802-188325
       International linux systems consultancy
     Hardware & software system design, security
    and networking, systems programming and Admin
	      "Have Laptop, Will Travel"
------------------------------------------------------

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]