Re: [gentoo-hardened] Idea behind different ebuilds sec-policy/selinux-*

[Petre Rodan]

Hi,

On Sun, Jun 10, 2007 at 02:32:35PM +0200, Krzysztof Kozłowski wrote:
> Marek Wróbel wrote:
> > But there are many modules that are included in refpolicy, but they are
> > not packaged in gentoo packages and have to be installed by hand. You
> > can make local portage overlay and create ebuilds for them. It isn't
> > much work, because of selinux-policy-2 eclass.
> I figured it out and I still wonder why such easy to write ebuilds are not in
> Portage... Is there any reason for that?

it's true, it would be easy to add a bunch of new ebuilds for the refpolicy modules.

on the other hand it is not easy to make sure that the newly covered software (as installed by gentoo) actually works with the policy. 

if you have a software package not covered by a sec-policy/selinux-~ ebuild, you are encouraged to do the following:
 - test if the refpolicy module works with your setup
 - open a bug report stating that module foo should have a selinux-foo ebuild, assign it to selinux@g.o

to accomplish the first task, you can do the following:
 - see if a module for package foo exists by consulting [1]
 - create a tiny ebuild that uses the selinux-policy-2 eclass and emerge that
 - relabel files that belong to package foo (using either `rlpkg foo` or `/usr/sbin/setfiles -v /etc/selinux/strict/contexts/files/file_contexts $PATH`)
 - use foo as you normally would and look for problems

that being said, it's not like you'll need to do any of this for most software, that has been taken care of. but you have to understand that we do not actively use all the available modules on our servers, and thus not all modules have a sec-policy ebuild associated.

[1] http://oss.tresys.com/docs/refpolicy/api/

-- 
petre rodan
<kaiowas@g.o>
Developer,
Hardened Gentoo Linux