Gentoo Hardened SELinux Frequently Asked Questions

+Gentoo Hardened SELinux Frequently Asked Questions + + Chris PeBenito + + + Sven Vermeulen + + + +Frequently Asked Questions on SELinux integration with Gentoo Hardened. +The FAQ is a collection of solutions found on IRC, mailinglist, forums o= r=20 +elsewhere + + +1 +2011-03-19 + + +Questions +

+Introduction + + +

+Using SELinux requires administrators a more thorough knowledge of their +system and a good idea on how processes should behave. Next to the Gentoo Hardened = SELinux +handbook, a proper FAQ allows us to inform and help users in their= =20 +day-to-day SELinux experience. +

+ +

+The FAQ is an aggregation of solutions found on IRC, mailinglists, forum= s +and elsewhere. It focuses on SELinux integration on Gentoo Hardened, but= =20 +general SELinux questions that are popping up regularly will be incorpor= ated +as well. +

+ + +

+ + + +General SELinux Support Questions +

+Does SELinux enforce resource limits? + + +

+No, resource limits are outside the scope of an access control system. I= f you=20 +are looking for this type of support, take a look at technologies like +grsecurity, cgroups, pam and the like. +

+ + +

+Can I use SELinux with grsecurity (and PaX)? + + +

+Definitely, we even recommend it. However, it is suggested that grsecuri= ty's +ACL support is not used as it would be redundant to SELinux's access con= trol. +

+ + +

+Can I use SELinux and the hardened compiler (with PIE-SSP)?</titl= e> +<body> + +<p> +Definitely. We also suggest to use PaX to take full advantage of the PIE +features of the compiler. +</p> + +</body> +</section> +<section id=3D"rsbac"> +<title>Can I use SELinux and RSBAC? + + +

+We don't know. If you try this combination, we would be very interested +in its results. +

+ + +

+Can I use SELinux with any file system? + + +

+SELinux requires access to a file's security context to operate properly= . +To do so, SELinux uses extended file attributes which needs to be= =20 +properly supported by the underlying file system. If the file system sup= ports +extended file attributes and you have configured your kernel to enable t= his +support, then SELinux will work on those file systems. +

+ +

+General Linux file systems, such as ext2, ext3, ext4, jfs, xfs and btrfs +support extended attributes (but don't forget to enable it in the kernel +configuration) as well as tmpfs (for instance used by udev). If your fil= e +system collection is limited to this set, then you should have no issues= . +

+ +

+Ancillary file systems such as vfat and iso9660 are supported too, but w= ith +an important caveat: all files in each file system will have the same SE= Linux +security context information since these file systems do not support ext= ended +file attributes.=20 +

+ +

+Network file systems can be supported in the same manner as ancillary fi= le +systems (all files share the same security context). However, some devel= opment +has been made in supported extended file attributes on the more popular = file +systems such as NFS. Although this is far from production-ready, it does= look +like we will eventually support these file systems on SELinux fully as w= ell. +

+ + +

+Can I use SELinux with AMD64 no-multilib? + + +

+No. The SELinux profiles inherit from the base amd64 profiles, requiring +multilib support. Early tests trying to enable SELinux on a no-multilib +profile show that it will not be supported without additional developmen= t +effort being required. +

+ + +

+ + + +Using SELinux +

+How do I enable SELinux? + + +

+This is explained in the SELinux Handbook= +in the chapter on Using Gentoo/Hardened SELinux. +

+ + +

+How do I switch between permissive and enforcing? + + +

+The easiest way is to use the setenforce command. With setenfo= rce=20 +0 you tell SELinux to run in permissive mode. Similarly, with=20 +setenforce 1 you tell SELinux to run in enforcing mode. +

+ +

+You can also add a kernel option enforcing=3D0 or enforcing=3D= 1 +in the bootloader configuration (or during the startup routine of the sy= stem).=20 +This allows you to run SELinux in permissive or enforcing mode from the = start=20 +of the system. +

+ +

+The default state of the system is kept in /etc/selinux/config. +

+ + +

+How do I disable SELinux completely? + + +

+It might be possible that running SELinux in permissive mode is not suff= icient +to properly fix any issue you have. To disable SELinux completely, you n= eed to +edit /etc/selinux/config and set SELINUX=3Ddisabled.= Next, +reboot your system. +

+ + +When you have been running your system with SELinux disabled, you must b= oot=20 +in permissive mode first and relabel your entire file system. Activities= ran +while SELinux was disabled might have created new files or removed the l= abels +from existing files, causing these files to be available with no securit= y +context. + + + +

+ + + +SELinux Kernel Error Messages +

+I get a register_security error message when booting + + +

+During boot-up, the following message pops up: +

+ +

+There is already a security framework initialized, register_security fai=
led.
+Failure registering capabilities with the kernel
+selinux_register_security: Registering secondary module capability
+Capability LSM initialized
+

+ +

+This is nothing to worry about (and perfectly normal). +

+ +

+This means that the Capability LSM module couldn't register as the prima= ry=20 +module, since SELinux is the primary module. The third message means tha= t it +registers with SELinux as a secondary module. +

+ + +

+ + +SELinux and Gentoo +

+I get a missing SELinux module error when using emerge + + +

+When trying to use emerge, the following error message is display= ed: +

+ +

+!!! SELinux module not found. Please verify that it was installed.
+

+ +

+This indicates that the portage SELinux module is missing or damaged. Re= cent=20 +Portage versions provide this module out-of-the-box, but the security co= ntexts +of the necessary files might be wrong on your system. Try relabelling th= e files +of the portage package: +

+ +

+~# rlpkg portage
+

+ + +

+I get 'FEATURES variable contains unknown value(s): loadpolicy'</= title> +<body> + +<p> +When running emerge, the following error is shown: +</p> + +<pre caption=3D"Emerge error on loadpolicy"> +FEATURES variable contains unknown value(s): loadpolicy +</pre> + +<p> +This is a remnant of the older SELinux policy module set where policy pa= ckages +might require this FEATURE to be available. Although the more recent pac= kages +do not support this FEATURE value anymore, these are still in the ~arch = phase=20 +so the current SELinux profile still offers this value. Portage however = already +knows that this FEATURE is not supported anymore and complains. +</p> + +<p> +We recommend you to use the ~arch versions of all packages in the sec-po= licy +category, and set <c>FEATURES=3D"-loadpolicy"</c> to disable this (cosme= tic) +error. +</p> + +<p> +Once the newer policy modules are stabilized, the SELinux profile will b= e updated +to remove this setting. +</p> + +</body> +</section> +</chapter> +</guide>