RE: [gentoo-hardened] building gentoo hardened - selinux

[Chris PeBenito]

I just modified the current livecd and put in a new policy.  I'm
uploading it to http://dev.gentoo.org/~pebenito/.  I've got slow upload,
so check back in at least an hour.  Someone please test to verify it
fixes the load problem.

On Wed, 2004-09-15 at 06:59, Chris PeBenito wrote:
> This all has to do with the headers update that has been going on for
> the last couple weeks.  The livecd has to be updated too, and I
> overlooked this fact.  I'll try to get a new livecd out ASAP.
>
>
> On Tue, 2004-09-14 at 20:04, Richard Simpson wrote:
> > Brian-
> >
> > Look in /usr/src/linux/security/selinux/include/security.h to see what
> > policy versions your kernel is compatible with. My 2.6.7-r8 kernel
> > lists 15 min and 17 max, so I was able to use POLICYCOMPAT = -c 17.
> > AFAIK the policy compiler is only backwards compatible 1 version
> > level.
> >
> > For some reason emerge chose to merge selinux-base-policy-20040906 on
> > my system too even though that package is flagged ~x86, and I found
> > out after the fact that it's not compatible with my kernel. I would
> > like to see hardened-dev-sources noted in the changelog what policy
> > versions it supports, rather than having to dig through the headers
> > after its emerged.
> >
> > Richard.
> >         -----Original Message-----
> >         From: Brian Fernald [mailto:bfernald@×××××.com]
> >         Sent: Tuesday, September 14, 2004 4:47 PM
> >         To: gentoo-hardened@l.g.o
> >         Subject: [gentoo-hardened] building gentoo hardened - selinux
> >
> >
> >         Hi,
> >
> >         I have just walked through the Gentoo SELinux handbook to
> >         build a new system.    Whenever I come to the point of loading
> >         the security policy,  it attempts to build a Policy of version
> >         18 ..  It reports the following :
> >
> >          make load
> >          * Creating policy.conf
> >          * Policy version: 18
> >          * Kernel version: 16
> >          * WARNING: Policy version mismatch.  Is your POLICYCOMPAT set
> >         correctly?
> >          *  See
> >         http://hardened.gentoo.org/selinux/selinux-policy.xml#doc_chap6
> >          *  for more information.
> >          * Compiling and installing policy.18
> >         /usr/bin/checkpolicy:  loading policy configuration from
> >         /etc/security/selinux/src/policy.conf
> >         security:  3 users, 5 roles, 367 types, 1 bools
> >         security:  51 classes, 24552 rules
> >         /usr/bin/checkpolicy:  policy configuration loaded
> >         /usr/bin/checkpolicy:  writing binary representation (version
> >         18) to /etc/security/selinux/policy.18
> >          * Building file_contexts
> >          * Installing file_contexts
> >          * Loading policy.18
> >         /usr/sbin/load_policy:  security_load_policy failed
> >         make: *** [tmp/load] Error 3
> >
> >
> >         ... i then changed   POLICYCOMPAT  to be 16 and tried again :
> >
> >          make load
> >          * Policy version: 16
> >          * Kernel version: 16
> >          * Compiling and installing policy.16
> >         /usr/bin/checkpolicy:  loading policy configuration from
> >         /etc/security/selinux/src/policy.conf
> >         security:  3 users, 5 roles, 367 types, 1 bools
> >         security:  51 classes, 24552 rules
> >         /usr/bin/checkpolicy:  policy configuration loaded
> >         /usr/bin/checkpolicy:  writing binary representation (version
> >         16) to /etc/security/selinux/policy.16
> >          * Loading policy.16
> >         /usr/sbin/load_policy:  security_load_policy failed
> >         make: *** [tmp/load] Error 3
> >
> >
> >         it still fails.
> >
> >         The system is currently booted to the LiveCD (as per
> >         instructions)..  the kernel downloaded and build was
> >         2.6.7-hardened-r8  (emerge hardened-dev-sources)  ..
> >
> >         Could anyone shed some light on what I am doing incorrectly ?
> >
> >         Thanks,
> >
> >         Brian
> >
-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243