Re: Problems installing current version of refpolicy with FC6

[Karl MacMillan <kmacmillan@mentalrootkit.com>]

Catalin DIMA wrote:
> Karl MacMillan wrote:
> 
>> Just to check - are you certain that you want the full policy? You may 
>> be able to do the teaching you need with policy modules only.
> 
> Do you mean I should compile&load the modular policy ? I certainly would 
> like to do this, as it's supposed to be easily configurable & suitable 
> for experimenting small modules.
> 
>> Did you enable mcs? The standard FC6 policy is targeted-mcs and the 
>> presence of the mcs components in the file system labels may be the 
>> cause of your problems.
> 
> I tried again this build.conf format :
> 
> TYPE = targeted-mcs
> NAME = refpolicy
> DISTRO = redhat
> DIRECT_INITRC=n
> MONOLITHIC=n
> MLS-SENS=16
> MLS_CATS=256
> 
> Done make conf, make install and make load, then configured for 
> refpolicy & asked for relabeling, and the system gets stuck...
> 

Could you elaborate on where it gets stuck. Does the labeling happen? 
You might try relabeling in permissive.

> Btw, forgot to mention the libsepol.sepol_genbools: error while reading 
> /etc/selinx/refpolicy/booleans error...
> 

In permissive or enforcing?

> In permissive refpolicy mode, the only selinux message talks about 
> NetworkManager.
> 

Just to clarify, things work fine in permissive mode and you are only 
getting a single AVC message, correct? Could you check /var/log/messages 
and /var/log/audit/audit.log for avc messages after a permissive boot. 
Also check the selinux messages in dmesg for errors.

>> The unknown boolean messages should be harmless I believe.
>>
>> You can extract the build.conf from the policy source rpm as well, 
>> which is likely a good starting point.
> 
> The problem is the same with the rpm and the bz2...
> 

Not certain what you mean here - the source rpm or the binary rpm? I was 
suggesting that you rebuild refpolicy using the configuration from the 
source rpm - which means extracting the correct build.conf, 
modules.conf, and booleans.conf, seusers, and users_extra files and 
installing the in the source tree. You can read the spec file to see how 
this is done during the build process.

Dan - do you have better directions on how to get a patched and 
configured refpolicy tree out of the source rpm?

Karl

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.