1 |
Victor Banatean wrote: |
2 |
|
3 |
> Hi everyone, |
4 |
> |
5 |
> again me I think I got an idea,maybe it will work. |
6 |
> |
7 |
> I want to try the following: |
8 |
> - do a make in than boot in the new selinux system |
9 |
> - login as root |
10 |
> - cd /etc/security/selinux/src/policy/ |
11 |
> - make load |
12 |
> - make relabel |
13 |
fine. |
14 |
|
15 |
> - make policy |
16 |
> - make install |
17 |
unnecessary, the policy has already been built and installed (by the |
18 |
make load target) |
19 |
|
20 |
|
21 |
> |
22 |
> So I will try and report in a second. |
23 |
> |
24 |
> See you. |
25 |
> |
26 |
> Victor |
27 |
> |
28 |
> Victor Banatean wrote: |
29 |
> |
30 |
>> Hi Chris, |
31 |
>> |
32 |
>> is there a work around,e.g. to mount a part of |
33 |
>> the new iso and try make load again? |
34 |
>> |
35 |
>> Thanks in advance. |
36 |
>> |
37 |
>> Victor |
38 |
>> |
39 |
>> Chris PeBenito wrote: |
40 |
>> |
41 |
>>> I just modified the current livecd and put in a new policy. I'm |
42 |
>>> uploading it to http://dev.gentoo.org/~pebenito/. I've got slow upload, |
43 |
>>> so check back in at least an hour. Someone please test to verify it |
44 |
>>> fixes the load problem. |
45 |
>>> |
46 |
>>> On Wed, 2004-09-15 at 06:59, Chris PeBenito wrote: |
47 |
>>> |
48 |
>>> |
49 |
>>>> This all has to do with the headers update that has been going on for |
50 |
>>>> the last couple weeks. The livecd has to be updated too, and I |
51 |
>>>> overlooked this fact. I'll try to get a new livecd out ASAP. |
52 |
>>>> |
53 |
>>>> |
54 |
>>>> On Tue, 2004-09-14 at 20:04, Richard Simpson wrote: |
55 |
>>>> |
56 |
>>>> |
57 |
>>>>> Brian- |
58 |
>>>>> |
59 |
>>>>> Look in /usr/src/linux/security/selinux/include/security.h to see what |
60 |
>>>>> policy versions your kernel is compatible with. My 2.6.7-r8 kernel |
61 |
>>>>> lists 15 min and 17 max, so I was able to use POLICYCOMPAT = -c 17. |
62 |
>>>>> AFAIK the policy compiler is only backwards compatible 1 version |
63 |
>>>>> level. |
64 |
>>>>> |
65 |
>>>>> For some reason emerge chose to merge selinux-base-policy-20040906 on |
66 |
>>>>> my system too even though that package is flagged ~x86, and I found |
67 |
>>>>> out after the fact that it's not compatible with my kernel. I would |
68 |
>>>>> like to see hardened-dev-sources noted in the changelog what policy |
69 |
>>>>> versions it supports, rather than having to dig through the headers |
70 |
>>>>> after its emerged. |
71 |
>>>>> |
72 |
>>>>> Richard. |
73 |
>>>>> -----Original Message----- |
74 |
>>>>> From: Brian Fernald [mailto:bfernald@×××××.com] |
75 |
>>>>> Sent: Tuesday, September 14, 2004 4:47 PM |
76 |
>>>>> To: gentoo-hardened@l.g.o |
77 |
>>>>> Subject: [gentoo-hardened] building gentoo hardened - selinux |
78 |
>>>>> Hi, |
79 |
>>>>> I have just walked through the Gentoo SELinux |
80 |
>>>>> handbook to |
81 |
>>>>> build a new system. Whenever I come to the point of loading |
82 |
>>>>> the security policy, it attempts to build a Policy of version |
83 |
>>>>> 18 .. It reports the following : |
84 |
>>>>> make load |
85 |
>>>>> * Creating policy.conf |
86 |
>>>>> * Policy version: 18 |
87 |
>>>>> * Kernel version: 16 |
88 |
>>>>> * WARNING: Policy version mismatch. Is your POLICYCOMPAT set |
89 |
>>>>> correctly? |
90 |
>>>>> * See |
91 |
>>>>> http://hardened.gentoo.org/selinux/selinux-policy.xml#doc_chap6 |
92 |
>>>>> * for more information. |
93 |
>>>>> * Compiling and installing policy.18 |
94 |
>>>>> /usr/bin/checkpolicy: loading policy configuration from |
95 |
>>>>> /etc/security/selinux/src/policy.conf |
96 |
>>>>> security: 3 users, 5 roles, 367 types, 1 bools |
97 |
>>>>> security: 51 classes, 24552 rules |
98 |
>>>>> /usr/bin/checkpolicy: policy configuration loaded |
99 |
>>>>> /usr/bin/checkpolicy: writing binary representation (version |
100 |
>>>>> 18) to /etc/security/selinux/policy.18 |
101 |
>>>>> * Building file_contexts |
102 |
>>>>> * Installing file_contexts |
103 |
>>>>> * Loading policy.18 |
104 |
>>>>> /usr/sbin/load_policy: security_load_policy failed |
105 |
>>>>> make: *** [tmp/load] Error 3 |
106 |
>>>>> ... i then changed POLICYCOMPAT to be 16 |
107 |
>>>>> and tried again : |
108 |
>>>>> make load |
109 |
>>>>> * Policy version: 16 |
110 |
>>>>> * Kernel version: 16 |
111 |
>>>>> * Compiling and installing policy.16 |
112 |
>>>>> /usr/bin/checkpolicy: loading policy configuration from |
113 |
>>>>> /etc/security/selinux/src/policy.conf |
114 |
>>>>> security: 3 users, 5 roles, 367 types, 1 bools |
115 |
>>>>> security: 51 classes, 24552 rules |
116 |
>>>>> /usr/bin/checkpolicy: policy configuration loaded |
117 |
>>>>> /usr/bin/checkpolicy: writing binary representation (version |
118 |
>>>>> 16) to /etc/security/selinux/policy.16 |
119 |
>>>>> * Loading policy.16 |
120 |
>>>>> /usr/sbin/load_policy: security_load_policy failed |
121 |
>>>>> make: *** [tmp/load] Error 3 |
122 |
>>>>> it still fails. The system |
123 |
>>>>> is currently booted to the LiveCD (as per |
124 |
>>>>> instructions).. the kernel downloaded and build was |
125 |
>>>>> 2.6.7-hardened-r8 (emerge hardened-dev-sources) .. |
126 |
>>>>> Could anyone shed some light on what I am doing |
127 |
>>>>> incorrectly ? |
128 |
>>>>> Thanks, |
129 |
>>>>> Brian |
130 |
>>>>> |
131 |
>>>> |
132 |
>>>> |
133 |
>> |
134 |
>> -- |
135 |
>> gentoo-hardened@g.o mailing list |
136 |
>> |
137 |
>> |
138 |
> |
139 |
> -- |
140 |
> gentoo-hardened@g.o mailing list |
141 |
> |
142 |
> |
143 |
|
144 |
|
145 |
-- |
146 |
gentoo-hardened@g.o mailing list |