| 1 |
Hi all, |
| 2 |
|
| 3 |
I had no issues turing a no-multilib (hardened/linux/amd64/no-multilib) |
| 4 |
system into a SELinux enabled one. I did not however change profiles, as the |
| 5 |
feedback I've received earlier indicates that the profiles might have |
| 6 |
some... weird things happening ;-) |
| 7 |
|
| 8 |
So I just made local overrides in /etc/portage/profile: |
| 9 |
|
| 10 |
- make.defaults |
| 11 |
USE="selinux -acl" |
| 12 |
FEATURES="selinux sesandbox sfperms" |
| 13 |
PORTAGE_T="portage_t" |
| 14 |
PORTAGE_FETCH_T="portage_fetch_t" |
| 15 |
PORTAGE_SANDBOX_T="portage_sandbox_t" |
| 16 |
- package.mask |
| 17 |
* Unmask sec-policy/* |
| 18 |
* Mask sec-policy/selinux-*-3 and higher (to force the use of the |
| 19 |
2.20101213 ones) |
| 20 |
* Unmask setools, sepolgen, checkpolicy, libselinux, libsemanage, |
| 21 |
policycoreutils |
| 22 |
- package.use.force |
| 23 |
sys-apps/portage python2 |
| 24 |
- package.use.mask |
| 25 |
sys-apps/portage python3 |
| 26 |
- profile.bashrc |
| 27 |
SANDBOX_WRITE="${SANDBOXWRITE}:/selinux/" |
| 28 |
SANDBOX_WRITE="${SANDBOXWRITE}:/proc/self/" |
| 29 |
- use.force |
| 30 |
selinux |
| 31 |
- use.mask |
| 32 |
-hardened |
| 33 |
-selinux |
| 34 |
emul-linux-x86 |
| 35 |
multilib |
| 36 |
x264 |
| 37 |
tcc |
| 38 |
|
| 39 |
Runs in enforcing mode (strict policy), gcc -v shows "--disable-multilib". |
| 40 |
|
| 41 |
Wkr, |
| 42 |
Sven Vermeulen |
Archives