Failed profile change to add selinux to hardened/systemd

[tithom]

Hello all,

Perhaps a thread similar to this one. I have installed a system with the hardened systemd stage3. As there are no stage3 with all hardened + selinux + systemd, I thought switching to selinux is easier than changing init. I followed the installation guide though I had initially tried to go straight for mcs. After a number of trial and errors, I can narrow down the possible issue to modules not compiling.

In the portage output I have the following for all sec-policy modules:
342 │ WARN: postinst
343 │ SELinux module load failed. Trying full reload...
344 │ Failed to reload SELinux policies.
...
355 │ To reload, run the following command from within /usr/share/selinux/mcs:
356 │ semodule -i base.pp -i $(ls *.pp | grep -v base.pp)

Runing the above command gives the following:
1 │ Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/selinuxutil/cil:234
2 │ Failed to resolve AST
3 │ semodule: Failed!

And if I exclude selinuxutil, I have the same for acpi, apache, git, etc. Looking up what statements are at these lines, respectively:
selinuxutil: (typeattributeset cil_gen_require policykit_t)
acpi: (typeattributeset cil_gen_require selinux_config_t)
apache: (typeattributeset cil_gen_require selinux_config_t)
git: (booleanif (and (and (httpd_enable_cgi) (httpd_unified)) (httpd_builtin_scripting))

So I am not seeing any specific logic to it? Except that using seinfo -t policykit_t returns 0 (same for selinux_config_t). While I don't have the first 3 installed, I do have git so not seeing a logic there either (and tried to install acpi thinking that perhaps that'll sort out the issue).

Also, perhaps anecdotally, I noted the following weird things:
- first attempt did not work out, could not even mount mountpoints, I followed the installed guide to the letter so rebooted before relabelling. Perhaps this?
- currently, id -Z returns system_u:system_r:kernel_t... Also ps -eZ | grep systemd returns kernel_t. When I set to enforcing, selinux blocks the boot refusing all actions to systemd (which then has a kernel_t type)
- /etc/selinux/targeted/contexts does not have a file for systemd while my Fedora laptop has one, this and the above makes me think something is missing with regards to systemd...

Well, considering that the only semodule that seem to have installed is base.pp, perhaps that makes sense.

Let me know if anything from the system may be useful beyond emerge --info:

[BurningMemory]

[tithom]

Hello, thanks for this.

I have tried, but that fails at the same points. So I did change profile (eselect profile set ....) back to only hardened/systemd. I did emerge changed-use and then depclean, this did remove all selinux bits of which it did remove selinux-base and selinux-base-policy. Then, in a live CD / chroot, switched back profile. I am not sure what you meant by emerge both packages normally (the install manual speaks of using FEATURES=-selinux and -sesandbox, but so I emerged without this bit.

I noticed the same issues as the initial install, eg. portage failing to reload modules:
WARN: postinst
SELinux module load failed. Trying full reload...
Failed to reload SELinux policies.

I rebooted in permissive, this fails to boot at all with lsm=selinux. Removing it, booting it, and then running: semodule -i base.pp -i $(ls *.pp | grep -v base.pp) in /usr/share/selinux/strict gives the same error warning as before, eg:
Failed to resolve typeattributeset statement at /var/lib/selinux/strict/tmp/modules/400/selinuxutil/cil:234
Failed to resolve AST
semodule: Failed!

However, loading base.pp at least lets me reboot in permissive mode (lsm=selinux on the kernel cmdline). Then, same issues, a lot of my processes (incl systemd) are labelled "kernel_t" and things don't work.

Looking more into details, emerging selinux-base-policy gives the following issues
Inserting the following modules, with base, into the strict module store: application authlogin bootloader clock consoletype cron dmesg fstools getty hostname init iptables libraries locallogin logging lvm miscfiles modutils mount mta netutils nscd portage raid rsync selinuxutil setrans ssh staff storage su sysadm sysnetwork systemd tmpfiles udev userdomain usermanage unprivuser xdg
Failed to resolve typeattributeset statement at /var/lib/selinux/strict/tmp/modules/400/authlogin/cil:134
Failed to resolve AST
semodule: Failed!

So still the same issues but perhaps earlier on than when I noticed. If that matters, I have not yet created users so running everything as root, though I don't see why that should give issues?

PS: on the comparison with Fedora, I believe they're running a heavily adapted version of targeted because running ls -Z on qemu images would give:
-rw-------+ 1 qemu qemu system_u:object_r:svirt_image_t:s0:c729,c872
So seems like it has mcs to me...

Edit: continuing to dig, this is seems very similar to the following 2023 bug: https://bugs.gentoo.org/show_bug.cgi?id=891771

Installing selinux policies fails to load modules and before running manually semodule -i base.pp (which succeeds although loading other modules fail), /etc/selinux/*/contexts/files/file_contexts were also all missing.

[tithom]

As an update, after checking on IRC, I was advised to install selinux-dbus and selinux-policykit. I did so and then reinstalled selinux-base-policy.

Indeed that did (part) of the trick, now I can load modules without problems. I'm still not booting but that may be due to other issues or trying to get the system to work. I'll try with another clean install one of these days to see if I can get everything in order.