* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2011-06-09 18:56 JosA MarAa Alonso (nimiux)
0 siblings, 0 replies; 15+ messages in thread
From: JosA MarAa Alonso (nimiux) @ 2011-06-09 18:56 UTC (permalink / raw
To: gentoo-commits
nimiux 11/06/09 18:56:37
Modified: hb-using-install.xml
Log:
Fixed small typo. No version bump
Revision Changes Path
1.5 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.5&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.5&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.4&r2=1.5
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- hb-using-install.xml 7 Jun 2011 19:46:52 -0000 1.4
+++ hb-using-install.xml 9 Jun 2011 18:56:37 -0000 1.5
@@ -4,7 +4,7 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.4 2011/06/07 19:46:52 klondike Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.5 2011/06/09 18:56:37 nimiux Exp $ -->
<sections>
<version>10</version>
@@ -207,7 +207,7 @@
<body>
<p>
-Edit your <path>/etc/make.conf</path> file. If you ues the older SELinux
+Edit your <path>/etc/make.conf</path> file. If you use the older SELinux
profiles (like <path>selinux/v2refpolicy/amd64/hardened</path>), set
<c>FEATURES="-loadpolicy"</c>. These SELinux profiles enable the
loadpolicy feature, but this isn't supported anymore so can be safely ignored.
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2011-08-16 17:00 JosA MarAa Alonso (nimiux)
0 siblings, 0 replies; 15+ messages in thread
From: JosA MarAa Alonso (nimiux) @ 2011-08-16 17:00 UTC (permalink / raw
To: gentoo-commits
nimiux 11/08/16 17:00:56
Modified: hb-using-install.xml
Log:
Updated selinux docs
Revision Changes Path
1.8 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.8&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.8&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.7&r2=1.8
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- hb-using-install.xml 11 Aug 2011 21:38:44 -0000 1.7
+++ hb-using-install.xml 16 Aug 2011 17:00:56 -0000 1.8
@@ -4,7 +4,7 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.7 2011/08/11 21:38:44 blueness Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.8 2011/08/16 17:00:56 nimiux Exp $ -->
<sections>
<version>12</version>
@@ -599,7 +599,7 @@
<p>
When you have made your choice between the SELinux policy types, save
this in your <path>/etc/make.conf</path> file as well. That way, Portage will
-only install the policy modules for that SELinux type rather than both.
+only install the policy modules for that SELinux type.
</p>
<pre caption="Setting the policy type in make.conf">
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-04-05 20:39 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-04-05 20:39 UTC (permalink / raw
To: gentoo-commits
swift 12/04/05 20:39:13
Modified: hb-using-install.xml
Log:
Add in reference to sandbox write requirement on /sys/fs/selinux/context until fix in upstream is stabilized
Revision Changes Path
1.13 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.13&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.13&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.12&r2=1.13
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -r1.12 -r1.13
--- hb-using-install.xml 28 Mar 2012 18:54:56 -0000 1.12
+++ hb-using-install.xml 5 Apr 2012 20:39:13 -0000 1.13
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.12 2012/03/28 18:54:56 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.13 2012/04/05 20:39:13 swift Exp $ -->
<sections>
-<version>17</version>
-<date>2012-01-29</date>
+<version>18</version>
+<date>2012-04-05</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -272,6 +272,10 @@
</p>
<ul>
+ <!--
+ TODO When 2.20120215-r5 or higher is stabilized, the LVM change is not needed
+ anymore
+ -->
<li>
If you use LVM for one or more file systems, you need to edit
<path>/lib/rcscripts/addons/lvm-start.sh</path> (or <path>/lib64/..</path>)
@@ -288,6 +292,16 @@
which mess up the file labelling. For instance, <c>cp /bin/hostname
/bin/hostname.old</c>.
</li>
+ <!--
+ TODO When the fix is accepted in the portage code and that portage version is
+ stabilized, the change is not needed anymore.
+ -->
+ <li>
+ Edit <path>/etc/sandbox.conf</path> and add in
+ <path>/sys/fs/selinux/context</path> to the <c>SANDBOX_WRITE</c> parameter.
+ This is currently needed to work around bug <uri
+ link="https://bugs.gentoo.org/410687">410687</uri>.
+ </li>
</ul>
</body>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-05-05 19:01 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-05-05 19:01 UTC (permalink / raw
To: gentoo-commits
swift 12/05/05 19:01:39
Modified: hb-using-install.xml
Log:
Update on SELinux docs (mainly /selinux versus /sys/fs/selinux state of affairs)
Revision Changes Path
1.16 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.16&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.16&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.15&r2=1.16
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.15
retrieving revision 1.16
diff -u -r1.15 -r1.16
--- hb-using-install.xml 29 Apr 2012 14:26:40 -0000 1.15
+++ hb-using-install.xml 5 May 2012 19:01:39 -0000 1.16
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.15 2012/04/29 14:26:40 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.16 2012/05/05 19:01:39 swift Exp $ -->
<sections>
-<version>21</version>
-<date>2012-04-29</date>
+<version>23</version>
+<date>2012-05-06</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -296,6 +296,15 @@
</li>
</ul>
+<p>
+Previously (before <path>sys-libs/libselinux-2.1.9</path> was stabilized) the
+location of the SELinux file system was <path>/selinux</path>. This location can
+still be used (the recent libselinux implementations are currently backwards
+compatible with it) and, due to <uri link="https://bugs.gentoo.org/14779">bug
+14779</uri>, is still the location to use if you do not boot with an initramfs
+that premounts <path>/sys</path>.
+</p>
+
</body>
</subsection>
<subsection>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-05-07 20:08 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-05-07 20:08 UTC (permalink / raw
To: gentoo-commits
swift 12/05/07 20:08:14
Modified: hb-using-install.xml
Log:
Reverting change from /sys/fs/selinux to /selinux until portage is stable
Revision Changes Path
1.17 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.17&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.17&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.16&r2=1.17
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -r1.16 -r1.17
--- hb-using-install.xml 5 May 2012 19:01:39 -0000 1.16
+++ hb-using-install.xml 7 May 2012 20:08:14 -0000 1.17
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.16 2012/05/05 19:01:39 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.17 2012/05/07 20:08:14 swift Exp $ -->
<sections>
-<version>23</version>
-<date>2012-05-06</date>
+<version>24</version>
+<date>2012-05-07</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -285,26 +285,10 @@
/bin/hostname.old</c>.
</li>
<!--
- TODO When the fix is accepted in the portage code and that portage version is
- stabilized, the change is not needed anymore.
+ TODO When portage fix is stabilized, convert docs to /sys/fs/selinux
-->
- <li>
- Edit <path>/etc/sandbox.conf</path> and add in
- <path>/sys/fs/selinux/context</path> to the <c>SANDBOX_WRITE</c> parameter.
- This is currently needed to work around bug <uri
- link="https://bugs.gentoo.org/410687">410687</uri>.
- </li>
</ul>
-<p>
-Previously (before <path>sys-libs/libselinux-2.1.9</path> was stabilized) the
-location of the SELinux file system was <path>/selinux</path>. This location can
-still be used (the recent libselinux implementations are currently backwards
-compatible with it) and, due to <uri link="https://bugs.gentoo.org/14779">bug
-14779</uri>, is still the location to use if you do not boot with an initramfs
-that premounts <path>/sys</path>.
-</p>
-
</body>
</subsection>
<subsection>
@@ -412,7 +396,7 @@
<pre caption="Enabling selinux-specific file system options">
<comment># The udev mount is due to bug #373381</comment>
udev /dev tmpfs rw,rootcontext=system_u:object_r:device_t,seclabel,nosuid,relatime,size=10m,mode=755 0 0
-none /sys/fs/selinux selinuxfs defaults 0 0
+none /selinux selinuxfs defaults 0 0
</pre>
<note>
@@ -428,7 +412,7 @@
<p>
With the above changes made, reboot your system. Assert yourself that you are
-now running a Linux kernel with SELinux enabled (the <path>/sys/fs/selinux</path> file
+now running a Linux kernel with SELinux enabled (the <path>/selinux</path> file
system should be mounted). Don't worry - SELinux is at this point not activated.
</p>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-05-07 20:20 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-05-07 20:20 UTC (permalink / raw
To: gentoo-commits
swift 12/05/07 20:20:42
Modified: hb-using-install.xml
Log:
Adding back in sandbox fix, still needed, even with /selinux
Revision Changes Path
1.18 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.18&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.18&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.17&r2=1.18
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.17
retrieving revision 1.18
diff -u -r1.17 -r1.18
--- hb-using-install.xml 7 May 2012 20:08:14 -0000 1.17
+++ hb-using-install.xml 7 May 2012 20:20:42 -0000 1.18
@@ -4,7 +4,7 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.17 2012/05/07 20:08:14 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.18 2012/05/07 20:20:42 swift Exp $ -->
<sections>
<version>24</version>
@@ -287,6 +287,12 @@
<!--
TODO When portage fix is stabilized, convert docs to /sys/fs/selinux
-->
+ <li>
+ Edit <path>/etc/sandbox.conf</path> and add in
+ <c>SANDBOX_WRITE="/sys/fs/selinux/context"</c>. This is temporarily needed
+ until the necessary fix (included in Portage but not stable yet) is
+ available.
+ </li>
</ul>
</body>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-05-26 15:57 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-05-26 15:57 UTC (permalink / raw
To: gentoo-commits
swift 12/05/26 15:57:41
Modified: hb-using-install.xml
Log:
Fix bug #412421 - Using SELinux with recent udev and/or with /run location
Revision Changes Path
1.19 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.19&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.19&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.18&r2=1.19
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.18
retrieving revision 1.19
diff -u -r1.18 -r1.19
--- hb-using-install.xml 7 May 2012 20:20:42 -0000 1.18
+++ hb-using-install.xml 26 May 2012 15:57:41 -0000 1.19
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.18 2012/05/07 20:20:42 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.19 2012/05/26 15:57:41 swift Exp $ -->
<sections>
-<version>24</version>
-<date>2012-05-07</date>
+<version>25</version>
+<date>2012-05-26</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -140,6 +140,15 @@
tmpfs /tmp tmpfs defaults,noexec,nosuid<i>,rootcontext=system_u:object_r:tmp_t:s0</i> 0 0
</pre>
+<p>
+If (and only if) your system is using the <path>/run</path> location, then have
+the next line in your <path>/etc/fstab</path>:
+</p>
+
+<pre caption="Update /etc/fstab for /run">
+tmpfs /run tmpfs mode=0755,nosuid,nodev,rootcontext=system_u:object_r:var_run_t 0 0
+</pre>
+
</body>
</subsection>
<!--
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-05-26 15:59 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-05-26 15:59 UTC (permalink / raw
To: gentoo-commits
swift 12/05/26 15:59:36
Modified: hb-using-install.xml
Log:
Update internal comment on Python 3 support (no content change for readers)
Revision Changes Path
1.20 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.20&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.20&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.19&r2=1.20
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- hb-using-install.xml 26 May 2012 15:57:41 -0000 1.19
+++ hb-using-install.xml 26 May 2012 15:59:36 -0000 1.20
@@ -4,7 +4,7 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.19 2012/05/26 15:57:41 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.20 2012/05/26 15:59:36 swift Exp $ -->
<sections>
<version>25</version>
@@ -92,8 +92,8 @@
</subsection>
-->
<!--
-TODO Validate after 2.20120215-r8 is stable that this is no longer
-necessary? Not sure about it though : check userspace ebuilds as well.
+TODO Python 3 support seems to be in with policycoreutils-2.1.10-r3,
+libsemanage-2.1.6-r1 and sepolgen-1.1.5-r2
-->
<subsection>
<title>Switching to Python 2</title>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-05-26 19:24 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-05-26 19:24 UTC (permalink / raw
To: gentoo-commits
swift 12/05/26 19:24:22
Modified: hb-using-install.xml
Log:
/dev mount line no longer needed (util-linux stable), sandbox fix no longer needed (now handled by profile)
Revision Changes Path
1.21 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.21&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.21&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.20&r2=1.21
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- hb-using-install.xml 26 May 2012 15:59:36 -0000 1.20
+++ hb-using-install.xml 26 May 2012 19:24:22 -0000 1.21
@@ -4,10 +4,10 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.20 2012/05/26 15:59:36 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.21 2012/05/26 19:24:22 swift Exp $ -->
<sections>
-<version>25</version>
+<version>26</version>
<date>2012-05-26</date>
<section>
@@ -293,15 +293,6 @@
which mess up the file labelling. For instance, <c>cp /bin/hostname
/bin/hostname.old</c>.
</li>
- <!--
- TODO When portage fix is stabilized, convert docs to /sys/fs/selinux
- -->
- <li>
- Edit <path>/etc/sandbox.conf</path> and add in
- <c>SANDBOX_WRITE="/sys/fs/selinux/context"</c>. This is temporarily needed
- until the necessary fix (included in Portage but not stable yet) is
- available.
- </li>
</ul>
</body>
@@ -405,20 +396,13 @@
<body>
<p>
-Next, edit <path>/etc/fstab</path> and add the following two lines:
+Next, edit <path>/etc/fstab</path> and add the following line:
</p>
<pre caption="Enabling selinux-specific file system options">
-<comment># The udev mount is due to bug #373381</comment>
-udev /dev tmpfs rw,rootcontext=system_u:object_r:device_t,seclabel,nosuid,relatime,size=10m,mode=755 0 0
none /selinux selinuxfs defaults 0 0
</pre>
-<note>
-In case of an MLS/MCS policy, you need to have the context with sensitivity
-level, so <c>...:device_t:s0</c>.
-</note>
-
</body>
</subsection>
<subsection>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-06-14 18:20 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-06-14 18:20 UTC (permalink / raw
To: gentoo-commits
swift 12/06/14 18:20:06
Modified: hb-using-install.xml
Log:
Ask users to create the mount point as well
Revision Changes Path
1.22 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.22&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.22&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.21&r2=1.22
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -r1.21 -r1.22
--- hb-using-install.xml 26 May 2012 19:24:22 -0000 1.21
+++ hb-using-install.xml 14 Jun 2012 18:20:05 -0000 1.22
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.21 2012/05/26 19:24:22 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.22 2012/06/14 18:20:05 swift Exp $ -->
<sections>
-<version>26</version>
-<date>2012-05-26</date>
+<version>27</version>
+<date>2012-06-14</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -403,6 +403,14 @@
none /selinux selinuxfs defaults 0 0
</pre>
+<p>
+Also create this mount point
+</p>
+
+<pre caption="Creating the /selinux mountpoint">
+# <i>mkdir /selinux</i>
+</pre>
+
</body>
</subsection>
<subsection>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2012-12-03 14:54 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2012-12-03 14:54 UTC (permalink / raw
To: gentoo-commits
swift 12/12/03 14:54:37
Modified: hb-using-install.xml
Log:
The provided USE flags are local use flags, so might be better off in a package.use file
Revision Changes Path
1.25 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.25&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.25&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.24&r2=1.25
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.24
retrieving revision 1.25
diff -u -r1.24 -r1.25
--- hb-using-install.xml 16 Aug 2012 18:12:53 -0000 1.24
+++ hb-using-install.xml 3 Dec 2012 14:54:37 -0000 1.25
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.24 2012/08/16 18:12:53 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.25 2012/12/03 14:54:37 swift Exp $ -->
<sections>
-<version>29</version>
-<date>2012-08-16</date>
+<version>30</version>
+<date>2012-12-03</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -267,7 +267,9 @@
<p>
Make your choice and update the <c>USE</c> variable in
-<path>/etc/make.conf</path>.
+<path>/etc/make.conf</path> or in an appropriate
+<path>/etc/portage/package.use</path> location for the
+<path>sec-policy/selinux-base</path> package.
</p>
</body>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2013-04-16 9:38 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2013-04-16 9:38 UTC (permalink / raw
To: gentoo-commits
swift 13/04/16 09:38:44
Modified: hb-using-install.xml
Log:
Move policy definition on top so that users do not need to rebuild the system afterwards
Revision Changes Path
1.28 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.28&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.28&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.27&r2=1.28
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.27
retrieving revision 1.28
diff -u -r1.27 -r1.28
--- hb-using-install.xml 9 Mar 2013 13:59:13 -0000 1.27
+++ hb-using-install.xml 16 Apr 2013 09:38:44 -0000 1.28
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.27 2013/03/09 13:59:13 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.28 2013/04/16 09:38:44 swift Exp $ -->
<sections>
-<version>32</version>
-<date>2013-03-09</date>
+<version>33</version>
+<date>2013-04-16</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -100,7 +100,7 @@
<body>
<p>
-For now, the SELinux management utilities are not compatible with Python 3 so
+For now, the SELinux management utilities are not all compatible with Python 3 so
we recommend to switch to Python 2 until the packages are updated and fixed.
</p>
@@ -118,6 +118,70 @@
</body>
</subsection>
<subsection>
+<title>Choosing a SELinux policy type</title>
+<body>
+
+<p>
+Gentoo supports four policy types within SELinux: <c>strict</c>,
+<c>targeted</c>, <c>mcs</c> and <c>mls</c>.
+</p>
+
+<p>
+The differentiation between <c>strict</c> and <c>targeted</c> is based upon the
+<e>unconfined</e> domain. When loaded, the processes on your system that are not
+specifically confined within a particular policy module will be part of the
+unconfined domains whose purpose is to allow most activities by default (rather
+than deny by default). As a result, processes that run inside unconfined
+domains have no restrictions apart from those already enforced by standard Linux
+security. Although running without the unconfined domains is considered more
+secure, it will also be more challenging for the administrator to make sure the
+system still functions properly as there are no policy modules for each and
+every application "out there".
+</p>
+
+<p>
+Next to <c>targeted</c> and <c>strict</c>, you can opt for <c>mcs</c> to allow
+categorization of the process domains. This is useful on multi-tenant systems
+such as web servers, virtualization hosts, ... where multiple processes will be
+running, most of them in the same security domain, but in different categories.
+Note though that to take advantage of the additional category support, either
+the applications themselves (such as the web server or hypervisor tools) need to
+configure the SELinux categories (so they need to support SELinux) or you will
+need to script around to start the individual instances with separate
+categories. Otherwise, <c>mcs</c> is just the same as <c>targeted</c> or
+<c>strict</c>.
+</p>
+
+<p>
+Finally, you can also select <c>mls</c> to differentiate security domains on
+a sensitivity level. However, MLS is currently still considered experimental
+in Gentoo and as such not recommended.
+</p>
+
+<p>
+In case of <c>mcs</c> or <c>mls</c>, you will need to use the <c>unconfined</c>
+USE flag to enable or disable unconfined domains in these policy types. The
+<c>strict</c> (no unconfined domains) type does not honor the USE flag, and the
+<c>targeted</c> (unconfined domains) type requires the USE flag set.
+</p>
+
+<p>
+When you have made your choice between the SELinux policy types, save
+this in your <path>/etc/make.conf</path> file as well. That way, Portage will
+only install the policy modules for that SELinux type. By default, the SELinux
+profiles enable <c>strict</c> and <c>targeted</c> (with <c>strict</c> being the
+default active type).
+</p>
+
+<pre caption="Setting the policy type in make.conf">
+~# <i>nano /etc/make.conf</i>
+POLICY_TYPES="<i>strict</i>"
+</pre>
+
+
+</body>
+</subsection>
+<subsection>
<title>Setting the filesystem contexts</title>
<body>
@@ -575,50 +639,12 @@
</ul>
</li>
<li>
- <c>SELINUXTYPE</c> selects the SELinux policy type to load.
- Gentoo Hardened recommends the use of <c>strict</c> for servers, and
- <c>targeted</c> for desktops. The <c>mcs</c> type is supported, <c>mls</c>
- is currently still considered experimental.
+ <c>SELINUXTYPE</c> selects the SELinux policy type to load. Most development
+ is done using the <c>strict</c> (as it provides full confinement) type,
+ although the others are supported as well.
</li>
</ul>
-<p>
-The differentiation between <c>strict</c> and <c>targeted</c> is based upon the
-<e>unconfined</e> domain. When loaded, the processes on your system that are not
-specifically confined within a particular policy module will be part of the
-unconfined_t domain whose purpose is to allow most activities by default (rather
-than deny by default). As a result, processes that run inside the unconfined_t
-domain have no restrictions apart from those already enforced by standard Linux
-security. Although running without the unconfined_t domain is considered more
-secure, it will also be more challenging for the administrator to make sure the
-system still functions properly as there are no policy modules for each and
-every application "out there".
-</p>
-
-<p>
-Next to <c>targeted</c> and <c>strict</c>, you can opt for <c>mcs</c> to allow
-categorization of the process domains. This is useful on multi-tenant systems
-such as web servers, virtualization hosts, ... where multiple processes will be
-running, most of them in the same security domain, but in different categories.
-</p>
-
-<p>
-Finally, you can also select <c>mls</c> to differentiate security domains on
-a sensitivity level. However, MLS is currently still considered experimental
-in Gentoo and as such not recommended.
-</p>
-
-<p>
-When you have made your choice between the SELinux policy types, save
-this in your <path>/etc/make.conf</path> file as well. That way, Portage will
-only install the policy modules for that SELinux type.
-</p>
-
-<pre caption="Setting the policy type in make.conf">
-~# <i>nano /etc/make.conf</i>
-POLICY_TYPES="<i>strict</i>"
-</pre>
-
</body>
</subsection>
<subsection>
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2013-10-24 19:47 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2013-10-24 19:47 UTC (permalink / raw
To: gentoo-commits
swift 13/10/24 19:47:38
Modified: hb-using-install.xml
Log:
Add warning about not rebuilding system after changing profile
Revision Changes Path
1.32 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.32&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.32&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.31&r2=1.32
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.31
retrieving revision 1.32
diff -u -r1.31 -r1.32
--- hb-using-install.xml 16 Aug 2013 11:49:42 -0000 1.31
+++ hb-using-install.xml 24 Oct 2013 19:47:38 -0000 1.32
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.31 2013/08/16 11:49:42 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.32 2013/10/24 19:47:38 swift Exp $ -->
<sections>
-<version>36</version>
-<date>2013-08-16</date>
+<version>37</version>
+<date>2013-10-24</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -269,6 +269,12 @@
~# <i>eselect profile set 12</i>
</pre>
+<warn>
+Do not rebuild your system right now - wait until this is instructed by this
+document later. Rebuilding the system will pull in SELinux policies which could
+make your system unreachable if you reboot after it.
+</warn>
+
<note>
Starting from the profile change, Portage will warn you after every installation
that it was "Unable to set SELinux security labels". This is to be expected,
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2013-12-20 12:43 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2013-12-20 12:43 UTC (permalink / raw
To: gentoo-commits
swift 13/12/20 12:43:55
Modified: hb-using-install.xml
Log:
xfs inode size change for SELinux is no longer necessary
Revision Changes Path
1.33 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.33&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.33&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.32&r2=1.33
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.32
retrieving revision 1.33
diff -u -r1.32 -r1.33
--- hb-using-install.xml 24 Oct 2013 19:47:38 -0000 1.32
+++ hb-using-install.xml 20 Dec 2013 12:43:55 -0000 1.33
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.32 2013/10/24 19:47:38 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.33 2013/12/20 12:43:55 swift Exp $ -->
<sections>
-<version>37</version>
-<date>2013-10-24</date>
+<version>38</version>
+<date>2013-12-20</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -48,13 +48,6 @@
into a (primitive) Gentoo base installation.
</p>
-<note>
-If you are an XFS user, make sure that the inode sizes of the XFS file
-system is 512 byte. Since the default is 256, you will need to run the
-<c>mkfs.xfs</c> command with the <c>-i size=512</c> arguments, like so:
-<c>mkfs.xfs -i size=512 /dev/sda3</c>
-</note>
-
</body>
</subsection>
<!--
^ permalink raw reply [flat|nested] 15+ messages in thread
* [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml
@ 2014-03-06 15:07 Sven Vermeulen (swift)
0 siblings, 0 replies; 15+ messages in thread
From: Sven Vermeulen (swift) @ 2014-03-06 15:07 UTC (permalink / raw
To: gentoo-commits
swift 14/03/06 15:07:50
Modified: hb-using-install.xml
Log:
Configure SELINUXTYPE before building world as per gentoo-hardened@g.o discussion
Revision Changes Path
1.34 xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml
file : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.34&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?rev=1.34&content-type=text/plain
diff : http://sources.gentoo.org/viewvc.cgi/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml?r1=1.33&r2=1.34
Index: hb-using-install.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v
retrieving revision 1.33
retrieving revision 1.34
diff -u -r1.33 -r1.34
--- hb-using-install.xml 20 Dec 2013 12:43:55 -0000 1.33
+++ hb-using-install.xml 6 Mar 2014 15:07:50 -0000 1.34
@@ -4,11 +4,11 @@
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
-<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.33 2013/12/20 12:43:55 swift Exp $ -->
+<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/proj/en/hardened/selinux/hb-using-install.xml,v 1.34 2014/03/06 15:07:50 swift Exp $ -->
<sections>
-<version>38</version>
-<date>2013-12-20</date>
+<version>39</version>
+<date>2014-03-06</date>
<section>
<title>Installing Gentoo (Hardened)</title>
@@ -518,7 +518,7 @@
</body>
</subsection>
<subsection>
-<title>Install Policies and Utilities</title>
+<title>Install Policies and Utilities, Part One</title>
<body>
<p>
@@ -533,54 +533,13 @@
</pre>
<p>
-Next, install the SELinux policy package
-(<path>sec-policy/selinux-base-policy</path>). This package contains the base
-SELinux policy needed to get your system up and running using SELinux.
-As Portage will try to label and reload policies (since the installation of
-<path>sys-apps/policycoreutils</path>) we need to temporarily disable SELinux
-support (as Portage wouldn't be able to label anything as it doesn't understand
-it yet).
+Next, we install the <e>base</e> SELinux policy package. This package provides
+the SELinux configuration file which we need to adjust prior to building all
+other SELinux packages.
</p>
-<pre caption="Installing the SELinux policy packages">
-~# <i>FEATURES="-selinux" emerge selinux-base-policy</i>
-</pre>
-
-<p>
-Next, rebuild those packages affected by the profile change we did previously
-through a standard world update, taking into account USE-flag changes (as the
-new profile will change many default USE flags, including enabling the
-<c>selinux</c> USE flag). Don't forget to use <c>etc-update</c> or
-<c>dispatch-conf</c> afterwards as some changes to configuration files need to
-be made.
-</p>
-
-<pre caption="Update your Gentoo Linux system">
-~# <i>emerge -uDN world</i>
-</pre>
-
-<p>
-Next, install the additional SELinux tools that you might need in the future to
-debug or help with your SELinux installation. These packages are optional, but
-recommended.
-</p>
-
-<pre caption="Installing additional SELinux packages">
-~# <i>emerge setools sepolgen checkpolicy</i>
-</pre>
-
-<p>
-Finally, install the policy modules for those utilities you think you need
-policies for. In the near future, this will be done automatically for you (the
-packages will have an optional dependency on it, triggered by the selinux USE
-flag), but until that time, you will need to install them yourself.
-</p>
-
-<pre caption="Installing SELinux modules">
-~# <i>emerge --search selinux-</i>
-[...]
-<comment>(Select the modules you want to install)</comment>
-~# <i>emerge selinux-screen selinux-gnupg selinux-sudo selinux-ntp selinux-networkmanager ...</i>
+<pre caption="Installing the SELinux base policy package">
+~# <i>FEATURES="-selinux" emerge -1 selinux-base</i>
</pre>
</body>
@@ -590,7 +549,7 @@
<body>
<p>
-Inside <path>/etc/selinux/config</path> you can configure how SELinux is
+Inside <path>/etc/selinux/config</path> you can now configure how SELinux is
configured at boot time.
</p>
@@ -644,6 +603,71 @@
</li>
</ul>
+<p>
+Make sure that the <c>SELINUX</c> variable is set to <c>permissive</c> right now.
+We will switch to enforcing later.
+</p>
+
+</body>
+</subsection>
+<subsection>
+<title>Install Policies and Utilities, Part Two</title>
+<body>
+
+<p>
+We can now continue with the installation of the SELinux policies. Rebuild the
+<path>selinux-base</path> package if you changed <c>SELINUXTYPE</c> to something
+else than <c>strict</c>, and then install the core SELinux policies through the
+<path>sec-policy/selinux-base-policy</path> package. This package contains the core
+SELinux policies needed to get your system up and running using SELinux.
+As Portage will try to label and reload policies (since the installation of
+<path>sys-apps/policycoreutils</path>) we need to temporarily disable SELinux
+support again (as Portage wouldn't be able to label anything as it doesn't understand
+it yet).
+</p>
+
+<pre caption="Installing the SELinux policy packages">
+~# <i>FEATURES="-selinux" emerge -1 selinux-base</i>
+~# <i>FEATURES="-selinux" emerge selinux-base-policy</i>
+</pre>
+
+<p>
+Next, rebuild those packages affected by the profile change we did previously
+through a standard world update, taking into account USE-flag changes (as the
+new profile will change many default USE flags, including enabling the
+<c>selinux</c> USE flag). Don't forget to use <c>etc-update</c> or
+<c>dispatch-conf</c> afterwards as some changes to configuration files need to
+be made.
+</p>
+
+<pre caption="Update your Gentoo Linux system">
+~# <i>emerge -uDN world</i>
+</pre>
+
+<p>
+Next, install the additional SELinux tools that you might need in the future to
+debug or help with your SELinux installation. These packages are optional, but
+recommended.
+</p>
+
+<pre caption="Installing additional SELinux packages">
+~# <i>emerge setools sepolgen checkpolicy</i>
+</pre>
+
+<p>
+Finally, install the policy modules for those utilities you think you need
+policies for. In the near future, this will be done automatically for you (the
+packages will have an optional dependency on it, triggered by the selinux USE
+flag), but until that time, you will need to install them yourself.
+</p>
+
+<pre caption="Installing SELinux modules">
+~# <i>emerge --search selinux-</i>
+[...]
+<comment>(Select the modules you want to install)</comment>
+~# <i>emerge selinux-screen selinux-gnupg selinux-sudo selinux-ntp selinux-networkmanager ...</i>
+</pre>
+
</body>
</subsection>
<subsection>
^ permalink raw reply [flat|nested] 15+ messages in thread
end of thread, other threads:[~2014-03-06 15:07 UTC | newest]
Thread overview: 15+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-05-26 19:24 [gentoo-commits] gentoo commit in xml/htdocs/proj/en/hardened/selinux: hb-using-install.xml Sven Vermeulen (swift)
-- strict thread matches above, loose matches on Subject: below --
2014-03-06 15:07 Sven Vermeulen (swift)
2013-12-20 12:43 Sven Vermeulen (swift)
2013-10-24 19:47 Sven Vermeulen (swift)
2013-04-16 9:38 Sven Vermeulen (swift)
2012-12-03 14:54 Sven Vermeulen (swift)
2012-06-14 18:20 Sven Vermeulen (swift)
2012-05-26 15:59 Sven Vermeulen (swift)
2012-05-26 15:57 Sven Vermeulen (swift)
2012-05-07 20:20 Sven Vermeulen (swift)
2012-05-07 20:08 Sven Vermeulen (swift)
2012-05-05 19:01 Sven Vermeulen (swift)
2012-04-05 20:39 Sven Vermeulen (swift)
2011-08-16 17:00 JosA MarAa Alonso (nimiux)
2011-06-09 18:56 JosA MarAa Alonso (nimiux)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox