Re: [gentoo-hardened] SELinux and kernel version 2.6.x

[Chris PeBenito]

On Tue, 2003-09-09 at 07:50, Bryan D. Stine wrote:
> There's currently a showstopper with ReiserFS preventing full deployment
> of the new SELinux API. Reiser3 doesn't support extended attributes with
> which SELinux can apply labels, so unfortunately it would never be able
> to work. Unfortunately, nobody has taken up a project to modify Reiser3,
> so it looks like we're left waiting for Reiser4. PeBenito can offer you
> more information about the new SELinux API.

Yes, this is correct.  However, we're going to have to go forward with
the new API anyway.  The old API isn't maintained anymore, and it would
be impossible for us to support both APIs, since there are different
kernels and sets of userland patches, and slightly different policy
(Basically only changes in base-policy).


> Peter Simons wrote:
>
> >I hear the Linux kernel version 2.6 includes most of the SELinux
> >patches already and that some parts of the internal API security where
> >changed for that. Thus I wonder: Is there any estimate when a
> >2.6-based SELinux profile will be available for Gentoo?

SELinux was accepted into 2.6 as of -test3, except the networking hooks
were dropped (which we didn't support yet anyway).  This is a new API
which is incompatible to the stuff thats in portage.  This API was
backported to 2.4, and is in (masked) selinux-sources-2.4.21-r2.  The
new API does not run on libsecure (selinux-small), it now runs on
libselinux.  Selinux-small will be replaced in the new API by
sys-libs/libselinux, sys-apps/checkpolicy, and sys-apps/policycoreutils,
which are currently in portage, but masked.

We're not planning on having a separate profile for 2.6, since the API
will be the same as selinux-sources-2.4.21-r2.  We will be switching our
support over to the new API as soon as our portage labeling is updated,
and we have the documentation for people to convert their installations.

Non-x86 architectures will also begin to be supported in 2.6.  I've got
SELinux running on my PPC.  Method and some others are looking into
sparc support (once the kernel starts behaving).

Again, I must emphasize that reiserfs people should convert to ext3 if
possible.  We've been trying to create the needed support for reiserfs,
but haven't been successful.

-- 
Chris PeBenito
<pebenito@g.o>
Developer, SELinux
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243