Re: Rebuilding Modified Base Policy on RHEL6 (was on-Computing Abstractions & An Issue Thereof)

[Dominick Grift <domg472@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2679 bytes --]

On 06/27/2010 01:06 AM, Joshua Kramer wrote:
> 
>> Is the method for rebuilding policy explained in the following guide,
>> still effective for RHEL6?
>> http://danwalsh.livejournal.com/26428.html
>>
> Ok, so I followed the instructions on the noted page; specifically, near
> the bottom.  This line works to rebuild policy on RHEL6:
> 
> *make validate UNK_PERMS=allow NAME=strict TYPE=mcs DISTRO=redhat UBAC=n
> DIRECT_INITRC=y MONOLITHIC=n POLY=y MLS_CATS=1024 MCS_CATS=1024 base
> 
> However, if I do this*, to switch the build from strict to targeted:
> 
> cd ~/sources/BUILD/serefpolicy-VERSION
> make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=redhat UBAC=n
> DIRECT_INITRC=y MONOLITHIC=n POLY=y MLS_CATS=1024 MCS_CATS=1024 bare
> make conf
> make UNK_PERMS=allow NAME=targeted TYPE=mcs DISTRO=redhat UBAC=n
> DIRECT_INITRC=y MONOLITHIC=n POLY=y MLS_CATS=1024 MCS_CATS=1024 conf
> 
> ...the make breaks with this error:
> 
> Creating targeted base module base.conf
> cat tmp/pre_te_files.conf tmp/all_attrs_types.conf tmp/global_bools.conf
> tmp/only_te_rules.conf tmp/all_post.conf > base.conf
> Compiling targeted base module
> /usr/bin/checkmodule -M -U allow base.conf -o tmp/base.mod
> /usr/bin/checkmodule:  loading policy configuration from base.conf
> policy/modules/kernel/domain.te":195:ERROR 'type selinux_config_t is not
> within scope' at token ';' on line 9468:
> #line 195
>     dontaudit domain selinux_config_t:dir { getattr search open };
> /usr/bin/checkmodule:  error(s) encountered while parsing configuration
> make: *** [tmp/base.mod] Error 1
> 
> It breaks even with a non-modified policy (i.e. install src.rpm and run
> this make command).
> 
> Do I need to do this, even if I only want to build a modified "targeted"
> version of the policy?  Is it "strict" by default?
> 
> Thanks,
> -Josh

that is because with redhat policy some of the modules need to be in
base i believe. You should use the selinux-policy.spec that is shipped
in the selinux-policy.src.rpm, modify it if required.

The spec replaces the modules*.conf. redhat ships modules.conf files
that are modified (some modules get moved to base to avoid these out of
scope issues)

in short, use the selinux-policy.spec provided by redhat.

basically you download the source rpm, extract it, apply the include
patch to the serefpolicy.tgz (extract it, apply patch, edit it, create
new serefpolicy.tgz. Than copy all of it to ~/rpmbuild/SOURCES/ (minus
the patch). modify the spec : (remove all patch entries (two i think).
Also copy the spec to ~/rpmbuild/SPECS/

rpmbuild -ba ~/rpmbuild/SPECS/selinux-policy.spec




[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 261 bytes --]