Fedora policies on Gentoo?

Fedora policies on Gentoo?

[bjorn.padding]

[-- Attachment #1: BDY.RTF --]
[-- Type: text/plain, Size: 443 bytes --]

Hi,

I was wondering... I am currently running on Gentoo.
I see that there are way less existing policies on Gentoo than
there are on Fedora. Can I unpunished cp these policies to my
/etc/security/selinux/src/policy dir? The only consequence
That I can think of is that I might have to change some
./file_contexts/program/*.fc according to my Gentoo sys.
But other than that it wouldn't create any problem, right?
Somebody with some advice?



[-- Attachment #2: BDY.RTF --]
[-- Type: application/rtf, Size: 617 bytes --]

Re: Fedora policies on Gentoo?

[petre rodan]

[-- Attachment #1: Type: text/plain, Size: 1030 bytes --]


Hi

bjorn.padding@ifsav.nl wrote:
> Hi,
>
> I was wondering... I am currently running on Gentoo.
> I see that there are way less existing policies on Gentoo than
> there are on Fedora. Can I unpunished cp these policies to my
> /etc/security/selinux/src/policy dir? The only consequence
> That I can think of is that I might have to change some
> ./file_contexts/program/*.fc according to my Gentoo sys.
> But other than that it wouldn't create any problem, right?

since gentoo is all about choice, depending on your USE flags you will
end up having programs with a different behavior than what is present in
fedora/debian.

this means that sometimes you will also have to tweak the type
enforcement files by adding capabilities or rules that permit
interactions between domains.

> Somebody with some advice?

you can use the nsa policies as a starting point. they are available
over annon cvs. see http://selinux.sourceforge.net/devel/cvs.php3

bye,
peter

--
petre rodan
<kaiowas@gentoo.org>
Developer,
Hardened Gentoo Linux

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 265 bytes --]

Re: Fedora policies on Gentoo?

[petre rodan]

[-- Attachment #1: Type: text/plain, Size: 2159 bytes --]


Hi Bjorn,

bjorn.padding@ifsav.nl wrote:
> Thanks for the tip Peter.
>
> My only question left is;
> Which policycoreutils && libselinux version are you running?
> I run 1.16 here and the Makefile from cvs is for 1.20
> If I try to emerge the 1.20 version of policycoreutils && libselinux, I
> get a mask
> error. Can I safely KEYWORDS='~x86' emerge them anyway?

sure. this is exactly what I do on all my (otherwise non-~x86) machines.

you can simply define

sys-apps/checkpolicy ~x86
sys-apps/policycoreutils ~x86
sys-libs/libsepol ~x86
sys-libs/libselinux ~x86

in /etc/portage/package.keywords

> Or do I modify the Makefile for 1.16?
>
> Thanks in advance...
>
> Bjorn

bye,
peter

>
> Peter wrote:
> -----------
> Hi
>
> bjorn.padding@ifsav.nl wrote:
>
>>Hi,
>>
>>I was wondering... I am currently running on Gentoo.
>>I see that there are way less existing policies on Gentoo than
>>there are on Fedora. Can I unpunished cp these policies to my
>>/etc/security/selinux/src/policy dir? The only consequence
>>That I can think of is that I might have to change some
>>./file_contexts/program/*.fc according to my Gentoo sys.
>>But other than that it wouldn't create any problem, right?
>
>
> since gentoo is all about choice, depending on your USE flags you will
> end up having programs with a different behavior than what is present in
> fedora/debian.
>
> this means that sometimes you will also have to tweak the type
> enforcement files by adding capabilities or rules that permit
> interactions between domains.
>
>
>>Somebody with some advice?
>
>
> you can use the nsa policies as a starting point. they are available
> over annon cvs. see http://selinux.sourceforge.net/devel/cvs.php3
>
> bye,
> peter
>
> --
> petre rodan
> <kaiowas@gentoo.org>
> Developer,
> Hardened Gentoo Linux
>
>
>> -----Original Message-----
>>From: 	kaiowas [mailto:kaiowas@gentoo.org]
>>Sent:	vrijdag 25 februari 2005 18:30
>>To:	BjornPadding
>>Cc:	SELinux
>>Subject:	Re: Fedora policies on Gentoo?
>>
>> << File: Re_ Fedora policies on Gentoo_.TXT >>  << File:
>
> smime_clearsigned.txt >>
>
>


--
petre rodan
<kaiowas@gentoo.org>
Developer,
Hardened Gentoo Linux

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 265 bytes --]

RE: Fedora policies on Gentoo?

[Simpson, Richard]

>Hi,
>
>I was wondering... I am currently running on Gentoo.
>I see that there are way less existing policies on Gentoo than
>there are on Fedora. Can I unpunished cp these policies to my
>/etc/security/selinux/src/policy dir? The only consequence
>That I can think of is that I might have to change some
>./file_contexts/program/*.fc according to my Gentoo sys.
>But other than that it wouldn't create any problem, right?
>Somebody with some advice?

I have done that, but there are some caveats. The Gentoo policy tends to lag behind the Fedora implementation, and there are distro customizations. Best bet is to download the FC3 policy source rpm (strict, not targeted) so that you have a complete policy source to use for troubleshooting. I actually use a working installation of FC3 to compare against.

Richard.




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.