[gentoo-hardened] SELinux 2.6

[Chris PeBenito]

Ok, there have been a couple people looking to use SELinux 2.6,
especially since it works on so many more arch's.  This is a short
description of whats happening.

The current SELinux userland (selinux-small) and all of the
selinux-patched utilities will not work.  There is a new userland api
based on libselinux.  The core userland components are in portage, but
masked.  Selinux-small is replaced with sys-libs/libselinux,
sys-apps/checkpolicy, and sys-apps/policycoreutils.  The rest of the
se-patched programs will not be put into portage until the 2.6 API is
ported back to 2.4 in the next NSA release.

Note: big endian users make sure you've got checkpolicy-1.0-r1
installed, as there is a critical endian-ness fix in it.

There is a experimental snapshot of the se-patched ebuilds and
(highly-experimental) policy:
http://dev.gentoo.org/~pebenito/libselinux-overlay.tar.bz2
http://dev.gentoo.org/~pebenito/selinux-base-policy-cvs-20030813.tar.bz2

The initial policy load is no longer handled by the kernel, but in an
initrd.  sys-apps/mkinitrd has also been patched for creating a policy
initrd which gets placed in /boot, and you have to set your bootloader
to load it.

I suggest trying this on a test system :).  You may run into a problem,
because tar has a selinux patch in the old selinux api, but not in the
new api.  Just comment out the dependancy on selinux-small, and the
epatch in the ebuild.

Thats all I can think of right now :) , so if you have problems, come by
the #gentoo-hardened channel on freenode, and I'll try to help if I'm
around.

-- 
Chris PeBenito
<pebenito@g.o>
Developer, SELinux
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243