Re: Plz ask for help :)

Re: Plz ask for help :)

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 1896 bytes --]

You need to subscribe to the SELinux upstream list
<selinux@tycho.nsa.gov> for kernel questions.

http://www.nsa.gov/research/selinux/subscribe.shtml

On 03/31/2014 09:44 PM, 오대성 wrote:
>
> Hi all,
>
> My name is Daesung and i am Korean.
>
> I am studying selinux and i have difficulty doing it.
>
> So i send email to you.
>
> Now, i am trying selinux porting on embedded Linux.
>
> Kernel version is 3.10.19-32.
>
> and configuration about selinux is as in the following:
>
> CONFIG_AUDIT=y
>
> CONFIG_AUDIT_GENERIC=y
>
> CONFIG_NETWORK_SECMARK=y
>
> CONFIG_EXT2_FS_SECURITY=y
>
> CONFIG_EXT3_FS_SECURITY=y
>
> CONFIG_EXT4_FS_SECURITY=y
>
> CONFIG_JFS_SECURITY=y
>
> CONFIG_REISERFS_FS_SECURITY=y
>
> CONFIG_JFFS2_FS_SECURITY=y
>
> CONFIG_SECURITY=y
>
> CONFIG_SECURITY_NETWORK=y
>
> CONFIG_SECURITY_SELINUX=y
>
> CONFIG_SECURITY_NETWORK_XFRM=y
>
> CONFIG_NETLABEL=y
>
> CONFIG_SECURITY_SELINUX_BOOTPARAM=y
>
> CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
>
> CONFIG_SECURITY_SELINUX_DISABLE=y
>
> CONFIG_SECURITY_SELINUX_DEVELOP=y
>
> CONFIG_SECURITY_SELINUX_AVC_STATS=y
>
> CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
>
> CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT=y
>
> CONFIG_SECURITY_FILE_CAPABILITIES=y
>
> CONFIG_DEFAULT_SECURITY_SELINUX=y
>
> CONFIG_DEFAULT_SECURITY="selinux"
>
> CONFIG_EXT2_FS_XATTR=y
>
> CONFIG_EXT3_FS_XATTR=y
>
> CONFIG_EXT4_FS_XATTR=y
>
> CONFIG_REISERFS_FS_XATTR=y
>
> But, selinux_complete_init function of security/selinux/hook.c is not
> called.
>
> And if i run “ls -Z“ command, security context is not printed.
>
> $ ls -Z
>
> ? apparmor ? capability.c
>
> selinux_init function is called. but selinux_complete_init function is
> not called and security context is not printed.
>
> *what should i try ? please help me.*
>
> Best Regards.
>
> Daesung.
>


[-- Attachment #2: Type: text/html, Size: 8388 bytes --]

Re: Plz ask for help :)

[Stephen Smalley]

On 04/01/2014 08:42 AM, Daniel J Walsh wrote:
>> But, selinux_complete_init function of security/selinux/hook.c is not
>> called.
>>
>> And if i run “ls -Z“ command, security context is not printed.
>>
>> $ ls -Z
>>
>> ? apparmor    ? capability.c
>>
>>  
>>
>> selinux_init function is called. but selinux_complete_init function is
>> not called and security context is not printed.
>>
>>  
>>
>> *what should i try ? please help me.*

You need to load a policy into the kernel.   Normally this is done by
the init program.

Was your init program built with SELinux support enabled?  And do you
have a policy file in the expected location?

Look for output from init as well to help debug.