RE: [gentoo-hardened] building gentoo hardened - selinux

[Richard Simpson]

MessageBrian-

Look in /usr/src/linux/security/selinux/include/security.h to see what
policy versions your kernel is compatible with. My 2.6.7-r8 kernel lists 15
min and 17 max, so I was able to use POLICYCOMPAT = -c 17.  AFAIK the policy
compiler is only backwards compatible 1 version level.

For some reason emerge chose to merge selinux-base-policy-20040906 on my
system too even though that package is flagged ~x86, and I found out after
the fact that it's not compatible with my kernel. I would like to see
hardened-dev-sources noted in the changelog what policy versions it
supports, rather than having to dig through the headers after its emerged.

Richard.
  -----Original Message-----
  From: Brian Fernald [mailto:bfernald@×××××.com]
  Sent: Tuesday, September 14, 2004 4:47 PM
  To: gentoo-hardened@l.g.o
  Subject: [gentoo-hardened] building gentoo hardened - selinux


  Hi,

  I have just walked through the Gentoo SELinux handbook to build a new
system.    Whenever I come to the point of loading the security policy,  it
attempts to build a Policy of version 18 ..  It reports the following :

   make load
   * Creating policy.conf
   * Policy version: 18
   * Kernel version: 16
   * WARNING: Policy version mismatch.  Is your POLICYCOMPAT set correctly?
   *  See http://hardened.gentoo.org/selinux/selinux-policy.xml#doc_chap6
   *  for more information.
   * Compiling and installing policy.18
  /usr/bin/checkpolicy:  loading policy configuration from
/etc/security/selinux/src/policy.conf
  security:  3 users, 5 roles, 367 types, 1 bools
  security:  51 classes, 24552 rules
  /usr/bin/checkpolicy:  policy configuration loaded
  /usr/bin/checkpolicy:  writing binary representation (version 18) to
/etc/security/selinux/policy.18
   * Building file_contexts
   * Installing file_contexts
   * Loading policy.18
  /usr/sbin/load_policy:  security_load_policy failed
  make: *** [tmp/load] Error 3


  ... i then changed   POLICYCOMPAT  to be 16 and tried again :

   make load
   * Policy version: 16
   * Kernel version: 16
   * Compiling and installing policy.16
  /usr/bin/checkpolicy:  loading policy configuration from
/etc/security/selinux/src/policy.conf
  security:  3 users, 5 roles, 367 types, 1 bools
  security:  51 classes, 24552 rules
  /usr/bin/checkpolicy:  policy configuration loaded
  /usr/bin/checkpolicy:  writing binary representation (version 16) to
/etc/security/selinux/policy.16
   * Loading policy.16
  /usr/sbin/load_policy:  security_load_policy failed
  make: *** [tmp/load] Error 3


  it still fails.

  The system is currently booted to the LiveCD (as per instructions)..  the
kernel downloaded and build was 2.6.7-hardened-r8  (emerge
hardened-dev-sources)  ..

  Could anyone shed some light on what I am doing incorrectly ?

  Thanks,

  Brian