Re: [gentoo-hardened] SELinux and no-multilib

[Anthony G. Basile]

Hi Sven,

Did you identify what the wierdness was.  I'd like to eventually clean
up the profiles.  Rather than

  [1]   default/linux/amd64/10.0
  [2]   default/linux/amd64/10.0/desktop
  [3]   default/linux/amd64/10.0/desktop/gnome
  [4]   default/linux/amd64/10.0/desktop/kde
  [5]   default/linux/amd64/10.0/developer
  [6]   default/linux/amd64/10.0/no-multilib
  [7]   default/linux/amd64/10.0/server
  [8]   hardened/linux/amd64
  [9]   hardened/linux/amd64/no-multilib
  [10]  selinux/2007.0/amd64
  [11]  selinux/2007.0/amd64/hardened
  [12]  selinux/v2refpolicy/amd64
  [13]  selinux/v2refpolicy/amd64/desktop
  [14]  selinux/v2refpolicy/amd64/developer
  [15]  selinux/v2refpolicy/amd64/hardened *
  [16]  selinux/v2refpolicy/amd64/server

I'd like the selinux to conform to the hardened/linux/amd64, ie change
10-16 to just

    selinux/v2refpolicy/amd64
    selinux/v2refpolicy/amd64/no-multilib

The /desktop /developer /server would not be deprecated, but present
silently as they are for hardened/linux/amd64.


On 03/18/2011 02:12 AM, Sven Vermeulen wrote:
> Hi all,
>
> I had no issues turing a no-multilib (hardened/linux/amd64/no-multilib)
> system into a SELinux enabled one. I did not however change profiles, as the
> feedback I've received earlier indicates that the profiles might have
> some... weird things happening ;-)
>
> So I just made local overrides in /etc/portage/profile:
>
> - make.defaults
>   	USE="selinux -acl"
> 	FEATURES="selinux sesandbox sfperms"
> 	PORTAGE_T="portage_t"
> 	PORTAGE_FETCH_T="portage_fetch_t"
> 	PORTAGE_SANDBOX_T="portage_sandbox_t"
> - package.mask
>   	* Unmask sec-policy/*
> 	* Mask sec-policy/selinux-*-3 and higher (to force the use of the
> 	  2.20101213 ones)
> 	* Unmask setools, sepolgen, checkpolicy, libselinux, libsemanage,
> 	  policycoreutils
> - package.use.force
>   	sys-apps/portage python2
> - package.use.mask
>   	sys-apps/portage python3
> - profile.bashrc
>   	SANDBOX_WRITE="${SANDBOXWRITE}:/selinux/"
> 	SANDBOX_WRITE="${SANDBOXWRITE}:/proc/self/"
> - use.force
>   	selinux
> - use.mask
>   	-hardened
> 	-selinux
> 	emul-linux-x86
> 	multilib
> 	x264
> 	tcc
>
> Runs in enforcing mode (strict policy), gcc -v shows "--disable-multilib".
>
> Wkr,
> 	Sven Vermeulen


-- 
Anthony G. Basile, Ph. D.
Chair of Information Technology
D'Youville College
Buffalo, NY 14201
[phone]