[gentoo-hardened] SELinux n00b questions

[Dale Pontius]

I've already done some searching on these, to no avail. I have several 
years experience with Linux, but only about a week, part-time with SELinux.

1: Probably most severe... I'm used to syslog-ng, but for some reason 
decided to do my SELinux install with metalog. After using it a little, 
I decided to remove it and install syslog-ng. That appeared to work at 
first. But as far as I can tell, nothing has been logged since the first 
time I put the systeminto enforcing mode. At shutdown I still get a 
little piece of hatemail about metalog, and I suspect I should have shut 
down metalog during the emerge -C - I suspect there are some droppings 
of it left over in /var. But I don't see why syslog-ng wouldn't work, 
when ps shows it's in there and running.

2: Can't ssh in when the system is enforcing. I've checked the sestatus 
-v results, and everything looks ok. I've never seen a bogus console or 
log message, but then again, see (1). Here's what I get:
user1@here ~ $ ssh -v user2@there
OpenSSH_4.2p1, OpenSSL 0.9.7e 25 Oct 2004
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to there [192.168.154.38] port 22.
debug1: Connection established.
debug1: identity file /home/user1/.ssh/identity type -1
debug1: identity file /home/user1/.ssh/id_rsa type -1
debug1: identity file /home/user1/.ssh/id_dsa type -1
ssh_exchange_identification: Connection closed by remote host
user1@here ~ $

3: There isn't much about "standard practice".
What kinds of admin tasks can I perform while the system is enforcing?
What kinds of admin tasks do I have to drop out of enforcing for?
I presume emerging a new policy requres "make load". What requires "make 
relabel"?
What about things that don't have a policy? Like dovecot, leafnode, etc?
On my old system I ran things chroot'ed. Can I still, under SELinux?

Thanks,
Dale Pontius
-- 
gentoo-hardened@g.o mailing list