Re: Re: Need information on building embedded systems.

[Don Hoefer <don.hoefer@verizon.net>]

 We are using kernel 3.8.13, busybox 1.20.2.  init says that it is version 2.88, along with that we have the typical Sys-V init with /etc/rc?.d startup scripts.

 Thank you for the links, we'll digest the Android stuff.
 
 Don Hoefer 


On 10/24/13, Stephen Smalley<sds@tycho.nsa.gov> wrote:
 
On 10/24/2013 01:15 PM, Don Hoefer wrote:
> We are building an embedded system where the customer requires SELinux. It is our own hardware so we build our own kernel and drivers and use the ext2, jfs and tempfs file systems. This is not new for us, but incorporating SELinux is.
> 
> Does anyone know of a good knowledge resource for building embedded systems with SELinux?
> 
> We are currently plowing through a frustrating step ahead/step back process. We are either unable to build a policy, or a minimal policy we build often causes the development system to fail to boot. Any policy we get onto the embedded system appears to fail to load properly. We think that some pieces may be missing but we are unable to debug due to lack of knowledge.
> 
> I suspect that our boot process with SELinux is incomplete and that we are missing some libraries, for example:
> 
> root@generic-powerpc:~#semanage
> Traceback (most recent call last):
> File "/usr/sbin/semanage", line 24, in <module>
> import seobject
> File "/usr/lib/python2.7/site-packages/seobject.py", line 24,in <module>
> import pwd, grp, string, selinux, tempfile, os, re, sys,stat
> ImportError: No module named selinux
> 
> Also, the selinux fs is not mounted and policies are not loaded during boot. We can do this with init scripts but isn't it too late by then?
> 
> Any help would be welcome.

I'd suggest you have a look at what we did in porting SELinux to
Android, both regard to our approach and possible reuse of some of our
minimalist port of libselinux and other components. See:
http://selinuxproject.org/page/SEAndroid

There is a published technical paper linked from that page that
describes the approach in detail, along with several presentations
describing it and of course how to obtain the code itself.

You really don't need much of the SELinux userspace for an embedded
system. Aside from our minimalist port of libselinux and a
reimplementation of specific utilities as part of the Android init
built-in commands and toolbox, we left the rest of the SELinux userspace
either completely unused or only used on the build host itself, not on
the device. We certainly didn't bother porting semanage or any other
python components.

We also wrote a policy from scratch tailored to Android and to a very
well-defined set of security goals, as described in the paper and
presentations. We did not use the SELinux reference policy nor did we
use anything generated by mdp as a starting point.

It would help to know your kernel (version) and what userspace you are
using as your baseline (e.g. are you using busybox? what is providing
your init program?).






--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.