SELinux on Slackware 9 with PAM

SELinux on Slackware 9 with PAM

[Diyab]

Hello all,

      I just finished writing up a howto style document that explains 
how to install SELinux on Slackware 9 along with the installation of 
PAM.  Thus far you will be able to boot into enforcing mode with some 
minimal services like ssh but I have not tested much else.  So mainly 
all I have to do now is to try running some services and alter the 
policy as needed.  I would appreciate some feedback if anyone has time 
to look at it, suggestions always welcome.  Also I would be more than 
happy to add policy changes that anyone else who might be using 
slackware has made.

The document is available in plain text format here:
http://www.diyab.net/selinux/SELinux_on_Slackware9.txt

A PDF version is soon to follow.  Check my selinux page in a couple of 
days for the PDF version.
http://www.diyab.net/selinux/index.html

Timothy,

-- 
I put instant coffee in a microwave and almost went back in time.
		-- Steven Wright


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux on Slackware 9 with PAM

[Kerry Thompson]

I just got around to reading this, after carrying it around with me for
almost a week now.

Its very useful document for anyone deploying SELinux on Slackware. The
document pretty much follows the README and describes what changes need to
be made for Slackware.

A few comments:

- you should mention that the Vixie crond in the SE release has been
modified for SELinux and really needs to be installed if you want cron.
Alternatively the user would need to modify Dillon's crond code to support
the SELinux extensions.

- you don't seem to configure the kernel ( make menuconfig, or edit
.config ) before compiling it - which may cause problems if the user has
devices not in the standard config.

- be careful about specifying line numbers when describing changes to
files - the line numbers will probably change in new releases of
Slack/SELinux.

- I recommend converting the document to HTML, even if you just wrap <Hx>
tages around the headers. Search engines give preference to keywords in
HTML files and headers.

All in all a very useful document. Anyone installing on Slackware will
save themselves a lot of time by referring to this.

Kerry

-- 
Kerry Thompson, CCNA CISSP
Information Systems Security Consultant
http://www.crypt.gen.nz  kerry@crypt.gen.nz

Diyab said:
> Hello all,
>
>       I just finished writing up a howto style document that explains
> how to install SELinux on Slackware 9 along with the installation of
> PAM.  Thus far you will be able to boot into enforcing mode with some
> minimal services like ssh but I have not tested much else.  So mainly
> all I have to do now is to try running some services and alter the
> policy as needed.  I would appreciate some feedback if anyone has time
> to look at it, suggestions always welcome.  Also I would be more than
> happy to add policy changes that anyone else who might be using
> slackware has made.
>
> The document is available in plain text format here:
> http://www.diyab.net/selinux/SELinux_on_Slackware9.txt
>
> A PDF version is soon to follow.  Check my selinux page in a couple of
> days for the PDF version.
> http://www.diyab.net/selinux/index.html
>
> Timothy,
>
> --
> I put instant coffee in a microwave and almost went back in time.
> 		-- Steven Wright



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux on Slackware 9 with PAM

[Russell Coker]

On Mon, 18 Aug 2003 13:27, Kerry Thompson wrote:
> - you should mention that the Vixie crond in the SE release has been
> modified for SELinux and really needs to be installed if you want cron.
> Alternatively the user would need to modify Dillon's crond code to support
> the SELinux extensions.

http://archives.neohapsis.com/archives/linux/lsap/2001-q1/0142.html
Solar Designer says some nice things about Dillon Cron at the above URL (the 
Linux Security Auditing Project mailing list - which should be of interest to 
people on this list).

It would be good to have some SE Linux patches to Dillon Cron if someone's got 
the time for the coding.

Especially as Vixie cron seems as good as dead upstream.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux on Slackware 9 with PAM

[Diyab]

Russell Coker wrote:
> On Mon, 18 Aug 2003 13:27, Kerry Thompson wrote:
> 
>>- you should mention that the Vixie crond in the SE release has been
>>modified for SELinux and really needs to be installed if you want cron.
>>Alternatively the user would need to modify Dillon's crond code to support
>>the SELinux extensions.
> 
> 
> http://archives.neohapsis.com/archives/linux/lsap/2001-q1/0142.html
> Solar Designer says some nice things about Dillon Cron at the above URL (the 
> Linux Security Auditing Project mailing list - which should be of interest to 
> people on this list).
> 
> It would be good to have some SE Linux patches to Dillon Cron if someone's got 
> the time for the coding.
> 
> Especially as Vixie cron seems as good as dead upstream.
> 

I noticed Vixie looks dead also, so I guess I'll try fixing Dillon's 
crond.  I can learn to code along the way and the rest of you can at 
least tell me if I did it right once I'm finished.  Of course if anyone 
else wants to do this or if anyone wants this soon you can go right 
ahead and do it.

Timothy,

-- 
I put instant coffee in a microwave and almost went back in time.
		-- Steven Wright


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux on Slackware 9 with PAM

[Diyab]

Kerry Thompson wrote:
> I just got around to reading this, after carrying it around with me for
> almost a week now.
> 
> Its very useful document for anyone deploying SELinux on Slackware. The
> document pretty much follows the README and describes what changes need to
> be made for Slackware.
> 
> A few comments:
> 
> - you should mention that the Vixie crond in the SE release has been
> modified for SELinux and really needs to be installed if you want cron.
> Alternatively the user would need to modify Dillon's crond code to support
> the SELinux extensions.

I do kind of mention how it is modified just not in the introduction 
where I explain the changing of cronds.  I can fix that, it's just that 
I don't imagine many people running a machine without a crond of some sort.

> 
> - you don't seem to configure the kernel ( make menuconfig, or edit
> .config ) before compiling it - which may cause problems if the user has
> devices not in the standard config.
> 

In the instructions I direct the user to start at the "Step-by-Step 
Building and Installing" section and continue until they hit step one. 
The text between the step-by-step title and step one details applying 
the SELinux patch to the kernel tree as well as configuring and building 
the kernel.

> - be careful about specifying line numbers when describing changes to
> files - the line numbers will probably change in new releases of
> Slack/SELinux.

The line numbers won't be a problem even if the policies change since 
the policy will still compile.  I don't really see a better way to do 
this and still keep it simple for the reader though.  Did you have 
something in mind?

> 
> - I recommend converting the document to HTML, even if you just wrap <Hx>
> tages around the headers. Search engines give preference to keywords in
> HTML files and headers.

I had planned on this I just haven't had the time yet.  I made the 
initial document text so that everyone could read it no matter what they 
were using.  The PDF version is available now also.

> All in all a very useful document. Anyone installing on Slackware will
> save themselves a lot of time by referring to this.
> 
> Kerry
> 

Thanks for your feedback Kerry.

Timothy,

-- 
I put instant coffee in a microwave and almost went back in time.
		-- Steven Wright


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.