Re: [gentoo-hardened] hardened installation troubles

[Chris PeBenito]

On Mon, 2006-10-30 at 16:31 +0100, Bart Van Loon wrote:
> I just got my hands on a server on which I installed gentoo. I have
> quite some experience with Linux and gentoo, but it is the first time
> that I engaged in a gentoo-hardened installation.
>
> I have linux-headers-2.6.17-r1 installed and am running a
> 2.6.17-hardened-r1 kernel in the selinux/x86/2006.1 profile.
>
> I am following the instructions on
> http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml?part=2&chap=1
> but encouter a few problems:

You didn't follow the instructions, because if you were, you would not
be using the 2006.1 SELinux profile.  It is still in testing.

> 1/
> emerging glibc always fails with
>
> !!! nptl glibc did not pass make check
>
> my USE flags vor glibc are "glibc-omitfp nptl nptlonly selinux -build
> -glibc-compat20 hardened -multilib -nls -profile"
>
> I tried compiling with nptlonly, but portage wouldn't accept that.
> emerging without the hardened flag, results in the same error.

Need more error messages.

> 2/
> after emerging selinux-base-policy, checkpolicy and policyresources, the
> HOWTO states that I should run "make load"
> in /etc/security/selinux/src/policy, but this directory does not exist
> (only /etc/security/ does).

Because of the wrong profile.

> 3/
> then, later on, many ebuilds fail to emerge: pam, coreutils,
> device-mapper, etc... the same ebuilds, on the same architecture, emerge
> fine on other systems.

Need error messages.

> 4/
> finally, I'm completely stuck when I want to label my filesystems,
> because of the empty (non-existing) /etc/security/selinux/src/policy
> directory.

Wrong profile.

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243