RE: [gentoo-hardened] building gentoo hardened - selinux

[Richard Simpson]

Brian-

Upon further investigation it looks like the policy exports the headers to
the kernel, so maybe you will have to unmerge and then merge the older
policy. 0702 should work.

Richard.

> -----Original Message-----
> From: Brian Fernald [mailto:bscottfernald@×××××.com]
> Sent: Tuesday, September 14, 2004 6:22 PM
> To: Richard Simpson
> Cc: gentoo-hardened@l.g.o
> Subject: Re: [gentoo-hardened] building gentoo hardened - selinux
>
>
> Hi Richard,
>
> my security.h lists   15 - 17..  however, no matter which I build
> (POLICYCOMPAT), it still fails to load.   I am quite perplexed..  have
> re-completed multiple rebuilds of gentoo just to make sure I am not
> missing something...    yet, everytime, can't load any policy...
>
> Brian
>
>
>
> ----- Original Message -----
> From: Richard Simpson <richard.simpson@×××××.com>
> Date: Tue, 14 Sep 2004 18:04:15 -0600
> Subject: RE: [gentoo-hardened] building gentoo hardened - selinux
> To: Brian Fernald <bfernald@×××××.com>, gentoo-hardened@l.g.o
>
>
> Brian-
>
> Look in /usr/src/linux/security/selinux/include/security.h to see what
> policy versions your kernel is compatible with. My 2.6.7-r8 kernel
> lists 15 min and 17 max, so I was able to use POLICYCOMPAT = -c 17.
> AFAIK the policy compiler is only backwards compatible 1 version
> level.
>
> For some reason emerge chose to merge selinux-base-policy-20040906 on
> my system too even though that package is flagged ~x86, and I found
> out after the fact that it's not compatible with my kernel. I would
> like to see hardened-dev-sources noted in the changelog what policy
> versions it supports, rather than having to dig through the headers
> after its emerged.
>
> Richard.
>
>
>
> -----Original Message-----
> From: Brian Fernald [mailto:bfernald@×××××.com]
> Sent: Tuesday, September 14, 2004 4:47 PM
> To: gentoo-hardened@l.g.o
> Subject: [gentoo-hardened] building gentoo hardened - selinux
>
>
> Hi,
>
> I have just walked through the Gentoo SELinux handbook to build a new
> system.    Whenever I come to the point of loading the security
> policy,  it attempts to build a Policy of version 18 ..  It reports
> the following :
>
>  make load
>  * Creating policy.conf
>  * Policy version: 18
>  * Kernel version: 16
>  * WARNING: Policy version mismatch.  Is your POLICYCOMPAT set correctly?
>  *  See http://hardened.gentoo.org/selinux/selinux-policy.xml#doc_chap6
>  *  for more information.
>  * Compiling and installing policy.18
> /usr/bin/checkpolicy:  loading policy configuration from
> /etc/security/selinux/src/policy.conf
> security:  3 users, 5 roles, 367 types, 1 bools
> security:  51 classes, 24552 rules
> /usr/bin/checkpolicy:  policy configuration loaded
> /usr/bin/checkpolicy:  writing binary representation (version 18) to
> /etc/security/selinux/policy.18
>  * Building file_contexts
>  * Installing file_contexts
>  * Loading policy.18
> /usr/sbin/load_policy:  security_load_policy failed
> make: *** [tmp/load] Error 3
>
>
> ... i then changed   POLICYCOMPAT  to be 16 and tried again :
>
>  make load
>  * Policy version: 16
>  * Kernel version: 16
>  * Compiling and installing policy.16
> /usr/bin/checkpolicy:  loading policy configuration from
> /etc/security/selinux/src/policy.conf
> security:  3 users, 5 roles, 367 types, 1 bools
> security:  51 classes, 24552 rules
> /usr/bin/checkpolicy:  policy configuration loaded
> /usr/bin/checkpolicy:  writing binary representation (version 16) to
> /etc/security/selinux/policy.16
>  * Loading policy.16
> /usr/sbin/load_policy:  security_load_policy failed
> make: *** [tmp/load] Error 3
>
>
> it still fails.
>
> The system is currently booted to the LiveCD (as per instructions)..
> the kernel downloaded and build was 2.6.7-hardened-r8  (emerge
> hardened-dev-sources)  ..
>
> Could anyone shed some light on what I am doing incorrectly ?
>
> Thanks,
>
> Brian
>
>


--
gentoo-hardened@g.o mailing list