Re: [gentoo-hardened] selinux 2004.1

[Chris PeBenito]

On Wed, 2004-05-26 at 10:33, Emre wrote:
> 1. After I su to root and try /etc/init.d/xxx restart, I get:
>
> cannot find your entry in the passwd file.
> authentication failed.
>
> But if I login from console, then it works ok. I made sure I installed selinux
> version of required packages.

You probably aren't using a selinux-enabled display manager, so when you
log in to X, your identity is not set.  GDM is the only one for sure
thats in portage.  KDM supposedly works with pam_selinux, and XDM and
WDM might have upstream support, but I'm not sure.

> 2. I had moved several portage directories to some other partitions. Because
> of that this happens:
>
> euse -i selinux

I've never used euse.  It may not work right with stacked profiles.

> 3. Several times I had to go and modify /etc/make.profile/virtuals. Default
> virtuals only has:
[cut]
> I have the latest portage 2.0.50-r6.

Unfortunately that version has broken stacked profile support :(  It
looks like portage-2.0.51_pre9 has been marked stable.  Merge that, and
it should all work again.

> 4. Is there a graphical tool to create custom .fc, .te? Any pointer to sample
> policy creation? I will go ahead try to vi some, but it would be nice to have
> one guide. Any directions to posting new custom security policies, or
> obtaining test-versions from a pool would also help.

The only graphical SELinux tools in portage are app-admin/setools, but
the policy editor that package has (sepcut), is at it's heart, just a
text editor.  If you're looking for policy thats not in portage, you can
check out the NSA example policy or the Russell Coker's debian policy. 
You can submit policies for inclusion in portage, see our project page
for details.  There really isn't any documentation on policy creation
beyond the very dry NSA policy whitepaper.

http://www.nsa.gov/selinux/code/download5.cfm
http://www.coker.com.au/selinux/policy.tgz

> 5. How much overhead labeling create on a filesystem with millions of files ?
> If I ever want to remove those xattrs from a filesystem, how can I unlabel
> those millions of files, if there is any way to reclaim space those extended
> atrributes sits on?

On ext[23], xattrs are stored in a block.  So each label takes a block. 
However, for space savings, the xattr blocks that have the same label
are shared.  So if you have 1 million files with the same label, it will
have a 1 block overhead.  Basically, there is an overhead of 1 block per
different label, per fs.

On XFS, the inode size should be increased to 512 (from 256), so that
the label can fit in the inode.  Then there is no overhead, though
inodes will be a little larger.  If the inode size is not increased,
then there will be a 1 block per file overhead (i.e. huge waste) because
the label will not fit in the inode, and a performance hit.

As long as you are in a kernel with selinux enabled, you will not be
able to unlabel a file.  It will be denied regardless of
permissive/enforcing.  If you wanted to remove selinux, you could use
rmfilecon (in a non-selinux kernel), which I will be adding in
policycoreutils.  Time permitting I will put a chapter in the quickstart
guide for removing selinux.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
Embedded Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243