| 1 |
Indeed, the step "Configure the SELinux policy" needs to be done the moment |
| 2 |
that /etc/selinux/config is made available and before the world upgrade. |
| 3 |
|
| 4 |
Strict isn't a requirement but it is of course important to configure it |
| 5 |
(the policy type) correctly beforehand. |
| 6 |
On Feb 25, 2014 3:33 AM, "Erik Mackdanz" <erikmack@×××××.com> wrote: |
| 7 |
|
| 8 |
> Thank you. I confirmed that portage had been running under python 2.7. |
| 9 |
> |
| 10 |
> I found the problem, though... I'd set POLICY_TYPES="targeted" in |
| 11 |
> make.conf, and therefore portage installed policies into |
| 12 |
> /etc/selinux/targeted only. However, running /usr/sbin/selinuxconfig and |
| 13 |
> catting /etc/selinux/config both made clear that 'strict' was a requirement. |
| 14 |
> |
| 15 |
> I've worked through it by setting POLICY_TYPES="strict targeted", then |
| 16 |
> rebuilding selinux-base and selinux-base-policy. I feel like this is |
| 17 |
> another documentation bug - the user should be told either that 'strict' is |
| 18 |
> initially required in make.conf, or that /etc/selinux/config must be edited |
| 19 |
> before the selinux-base-policy install. |
| 20 |
> |
| 21 |
> Anyway, thanks again. I'm sure I'll be back... |
| 22 |
> |
| 23 |
> Erik |
| 24 |
> |
| 25 |
> |
| 26 |
> On Sun, Feb 23, 2014 at 8:00 PM, Dustin C. Hatch <admiralnemo@×××××.com>wrote: |
| 27 |
> |
| 28 |
>> On 02/23/2014 06:18 PM, Erik Mackdanz wrote: |
| 29 |
>> > I'm attempting to convert my laptop to SELinux using the conversion |
| 30 |
>> > guide, and I've run into a few snags with documentation. I've consulted |
| 31 |
>> > the troubleshooting page, archives and forums, and now am reaching out |
| 32 |
>> > directly. |
| 33 |
>> > |
| 34 |
>> > 1) When I get to the world update ('emerge -uDN world'), every package |
| 35 |
>> > fails at install with 'Failed to set SELinux security labels.' Don't I |
| 36 |
>> > also need 'FEATURES="-selinux"' for that step (like the preceding step)? |
| 37 |
>> > |
| 38 |
>> I am fairly sure FEATURES=selinux is pretty important at this step; this |
| 39 |
>> is where you are re-installing all packages with SELinux support, and |
| 40 |
>> the security labels are supposed to be set. |
| 41 |
>> |
| 42 |
>> I had the same problem, though, on a recent conversion. In my case, the |
| 43 |
>> problem was emerge was using python3, but the selinux module only exists |
| 44 |
>> for python2. Try setting python2.7 as your default interpreter, or |
| 45 |
>> re-emerge portage with USE=python2. The latter is what I did and now |
| 46 |
>> everything works fine. |
| 47 |
>> |
| 48 |
>> -- |
| 49 |
>> ♫Dustin |
| 50 |
>> http://dustin.hatch.name/ |
| 51 |
>> |
| 52 |
>> |
| 53 |
> |
Archives