1 |
On Tue, Mar 20, 2012 at 8:32 PM, Tom Petri <tom.petri@××××××××××.com> wrote: |
2 |
> On Sun, Mar 18, 2012 at 12:27 PM, Tom Petri <tom.petri@××××××××××.com> wrote: |
3 |
>> On Sun, Mar 18, 2012 at 11:36 AM, Sven Vermeulen <swift@g.o> wrote: |
4 |
>>> On Sun, Mar 18, 2012 at 10:36:53AM +0100, Tom Petri wrote: |
5 |
>>>> Yes, extended attributes along with security labels are activated. |
6 |
>>>> |
7 |
>>>> # attr -s test -V test /var && attr -r test /var |
8 |
>>>> Attribute "test" set to a 4 byte value for /var: test |
9 |
>>>> |
10 |
>>>> I should probably tell how I proceeded during the installation: |
11 |
>>>> 1. created the filesystems (as usual) |
12 |
>>>> 2. got a hardened stage3 tarball and portage |
13 |
>>>> 3. portage sync, re-emerge portage, created a hardened-sources kernel, |
14 |
>>>> booted up. |
15 |
>>>> 4. emerge policys (checkpolicy, policycoreutils, selinux-base-policy [-selinux]) |
16 |
>>>> 5. emerge -uDN world |
17 |
>>>> 6. reboot and tried rlpkg -a -r |
18 |
>>> |
19 |
>>> Did the setfiles commands (mentioned in the installation instructions before |
20 |
>>> the "rlpkg -a -r") succeed, or did they give the same error? |
21 |
>>> |
22 |
>>> Wkr, |
23 |
>>> Sven Vermeulen |
24 |
>>> |
25 |
>>> |
26 |
>>> |
27 |
>> Yes, I got the same errors then: |
28 |
>> # setfiles -r /mnt/gentoo |
29 |
>> /etc/selinux/strict/contexts/files/file_contexts /mnt/gentoo/dev |
30 |
>> setfiles set context /mnt/gentoo/dev->system_u:object_r:device_t |
31 |
>> failed:'Operation not supported' |
32 |
>> # setfiles -r /mnt/gentoo |
33 |
>> /etc/selinux/strict/contexts/files/file_contexts /mnt/gentoo/lib |
34 |
>> setfiles set context /mnt/gentoo/lib->system_u:object_r:lib_t |
35 |
>> failed:'Operation not supported' |
36 |
> I just did a fresh gentoo install (configuration) and proceeded with |
37 |
> the instructions from the gentoo hardened documentation. |
38 |
> After compiling re-emerging world the system doesn't get up. I'm able |
39 |
> to ping it but udev seems to have problems as /dev/console and the |
40 |
> tty's aren't found: |
41 |
> |
42 |
> /etc/init.d/sshd[1205]: ERROR: sshd failed to start |
43 |
> /etc/init.d/urandom[1219]: ERROR: urandom failed to start |
44 |
> init: open(/dev/console): No such file or directory |
45 |
> agetty[1233]: /dev/tty2: not a character device |
46 |
> agetty[1232]: /dev/tty1: not a character device |
47 |
> |
48 |
> My mdadm RAID is recognized properly, in case it matters. |
49 |
> |
50 |
> I did everything the instructions say, however I'm always getting new |
51 |
> errors. Is there a viable solution to this? Thanks in advance! |
52 |
The udev from the hardened documentation seems to be the problem (udev |
53 |
/dev tmpfs rw,rootcontext=system_u:object_r:device_t,seclabel,nosuid,relatime,size=10m,mode=755 |
54 |
0 0). |
55 |
|
56 |
The systems boots without this entry, however `sestatus` says "disabled". |