kgdrenefort
Guru
Joined: 19 Sep 2023
Posts: 326
Location: Somewhere in the 77
|
 Posted: Sun Feb 23, 2025 11:53 am Post subject: [SELinux] Needs help to sets it up to enforcing |
 |
|
Hello,
A fresh installation on an old laptop, where I would like to setup SELinux.
This is the actual state of this Gentoo :
1. It's booting.
2. Profile : default/linux/amd64/23.0/hardened/selinux/systemd
3. emerge --info below this list
4. I can loggin from TTY and SSH if SELinux is not enforced, otherwise I get rejected.
emerge --info :
| Code: |
Portage 3.0.66.1 (python 3.12.9-final-0, default/linux/amd64/23.0/hardened/selinux/systemd, gcc-14, glibc-2.40-r8, 6.6.74-gentoo-dist-hardened x86_64)
=================================================================
System uname: Linux-6.6.74-gentoo-dist-hardened-x86_64-Intel-R-_Core-TM-_i7-2820QM_CPU_@_2.30GHz-with-glibc2.40
KiB Mem: 8065532 total, 7644508 free
KiB Swap: 4194300 total, 4194300 free
Timestamp of repository gentoo: Sun, 23 Feb 2025 09:45:00 +0000
Head commit of repository gentoo: ac95cd510f2fb64931a0c472a641a04e64d53840
sh bash 5.2_p37
ld GNU ld (Gentoo 2.43 p3) 2.43.1
app-misc/pax-utils: 1.3.8::gentoo
app-shells/bash: 5.2_p37::gentoo
dev-build/autoconf: 2.72-r1::gentoo
dev-build/automake: 1.16.5-r2::gentoo
dev-build/cmake: 3.31.5::gentoo
dev-build/libtool: 2.5.4::gentoo
dev-build/make: 4.4.1-r100::gentoo
dev-build/meson: 1.6.1::gentoo
dev-lang/perl: 5.40.0-r1::gentoo
dev-lang/python: 3.12.9::gentoo, 3.13.2::gentoo
dev-lang/rust-bin: 1.83.0-r1::gentoo, 1.84.1-r2::gentoo
sec-policy/selinux-base: 2.20240916-r1::gentoo
sys-apps/baselayout: 2.17::gentoo
sys-apps/sandbox: 2.39::gentoo
sys-apps/systemd: 256.10::gentoo
sys-devel/binutils: 2.43-r2::gentoo
sys-devel/binutils-config: 5.5.2::gentoo
sys-devel/gcc: 14.2.1_p20241221::gentoo
sys-devel/gcc-config: 2.12.1::gentoo
sys-kernel/linux-headers: 6.6-r1::gentoo (virtual/os-headers)
sys-libs/glibc: 2.40-r8::gentoo
sys-libs/libselinux: 3.7-r1::gentoo
Repositories:
gentoo
location: /var/db/repos/gentoo
sync-type: rsync
sync-uri: rsync://rsync.gentoo.org/gentoo-portage
priority: -1000
volatile: False
sync-rsync-verify-metamanifest: yes
sync-rsync-verify-max-age: 3
sync-rsync-extra-opts:
sync-rsync-verify-jobs: 1
Binary Repositories:
gentoobinhost
priority: 1
sync-uri: https://distfiles.gentoo.org/releases/amd64/binpackages/23.0/x86-64_hardened
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="@FREE"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=native -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/gconf /etc/gentoo-release /etc/sandbox.d"
CXXFLAGS="-march=native -O2 -pipe"
DISTDIR="/var/cache/distfiles"
ENV_UNSET="CARGO_HOME DBUS_SESSION_BUS_ADDRESS DISPLAY GDK_PIXBUF_MODULE_FILE GOBIN GOPATH PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR XDG_STATE_HOME"
FCFLAGS="-march=native -O2 -pipe"
FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs binpkg-multi-instance buildpkg-live config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync merge-wait multilib-strict network-sandbox news parallel-fetch pkgdir-index-trusted preserve-libs protect-owned qa-unresolved-soname-deps sandbox selinux sesandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-march=native -O2 -pipe"
GENTOO_MIRRORS="https://mirrors.ircam.fr/pub/gentoo-distfiles/ rsync://mirrors.ircam.fr/pub/gentoo-distfiles/ https://gentoo.mirrors.ovh.net/gentoo-distfiles/ https://mirrors.soeasyto.com/distfiles.gentoo.org/"
LANG="fr_FR.utf8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,-z,pack-relative-relocs"
LEX="flex"
MAKEOPTS="-j8"
PKGDIR="/var/cache/binpkgs"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
RUSTFLAGS=" -C target-cpu=native"
SHELL="/bin/bash"
USE="acl acpi amd64 asm audit bash-completion bzip2 caps cet clamav colord crypt curl dist-kernel fam gdbm grub hardened hddtemp http2 iconv ipv6 jit libtirpc lto man multilib native-extensions ncurses nls openmp pam pcre pic pie policykit posix readline samba seccomp selinux spell ssl ssp syslog systemd test-rust udev udisks unicode upower vim-syntax xattr xtpax zlib" ABI_X86="64" ADA_TARGET="gcc_14" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_anon authn_dbm authn_file authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir env expires ext_filter file_cache filter headers include info log_config logio mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 aes avx pclmul popcnt sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax navcom oceanserver oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 tsip tripmate tnt ublox" GRUB_PLATFORMS="pc" GUILE_SINGLE_TARGET="3-0" GUILE_TARGETS="3-0" INPUT_DEVICES="libinput" KERNEL="linux" L10N="fr en-GB" LCD_DEVICES="bayrad cfontz glk hd44780 lb216 lcdm001 mtxorb text" LUA_SINGLE_TARGET="lua5-1" LUA_TARGETS="lua5-1" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php8-2" POSTGRES_TARGETS="postgres16" PYTHON_SINGLE_TARGET="python3_12" PYTHON_TARGETS="python3_12" RUBY_TARGETS="ruby32" VIDEO_CARDS="amdgpu fbdev intel nouveau radeon radeonsi vesa dummy" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipp2p iface geoip fuzzy condition tarpit sysrq proto logmark ipmark dhcpmac delude chaos account"
Unset: ADDR2LINE, AR, ARFLAGS, AS, ASFLAGS, CC, CCLD, CONFIG_SHELL, CPP, CPPFLAGS, CTARGET, CXX, CXXFILT, ELFEDIT, EMERGE_DEFAULT_OPTS, EXTRA_ECONF, F77FLAGS, FC, GCOV, GPROF, INSTALL_MASK, LC_ALL, LD, LFLAGS, LIBTOOL, LINGUAS, MAKE, MAKEFLAGS, NM, OBJCOPY, OBJDUMP, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PYTHONPATH, RANLIB, READELF, SIZE, STRINGS, STRIP, YACC, YFLAGS
|
The installation was made, then I tried to setup from this page everything that sounded important, but I failed.
I tried to setup mcs with enforcing, it boots but I can't log from TTY or from SSH.
Same problem with targeted, which seemed… more permissive possibly, than MCS, not better, same issue.
I might have done things the wrong way, it's kind of complicated to be honnest.
This is the actual status of SELinux:
| Code: | shaitan ~ # sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: permissive
Mode from config file: permissive
Policy MLS status: disabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
|
I guess the many errors reported on the screen's laptop is simply showing me that everything I try on the system will be rejected by SELinux if enforced.
Example :
| Code: | | avc: denied { getattr } for pid=774 comm="eselect" path="/etc/portage/make.profile" dev="sda2" etc… |
So far, i understand this is denied and reported but only reported, since I'm on permissive mode, it only logs what bother SELinux.
My opinion would be I need to read further in SELinux documentations, understand how it works a bit better and allow manually most stuff required by SELinux.
But to be honnest, it's kind of blurry and easy to get lost in it.
Could someone simply redirect me ? Instead of read everything (it simply does not help me most of the time), I simply would like a direction… Where should I next hit to make it works ?
I'm happy with the idea to learn it and understand it, simply I'm lost in the fog right now :).
If you need more info, please, ask.
Regards,
GASPARD DE RENEFORT Kévin
_________________
Traduction wiki, pour praticiper.
Custom logos/biz card/website. |
|
Networking & Security
