FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Ubuntu > Ubuntu Development

 
 
LinkBack Thread Tools
 
Old 02-06-2008, 03:49 AM
"Caleb Case"
 
Default SELinux Support for Hardy

SELinux Support for Hardy

*** WARNING: EXPERIMENTAL! TESTING/DEVELOPMENT ONLY! ***

Hey everybody!

We've been really busy getting SELinux support ready for Hardy and it is now
possible to boot into an SELinux enabled Hardy using the packages that are
available in the Ubuntu-Hardened PPA on launchpad.

Installing SELinux in Hardy:

1. Update /etc/apt/sources.list by appending the following:

deb http://ppa.launchpad.net/ubuntu-hardened/ubuntu hardy main
deb-src http://ppa.launchpad.net/ubuntu-hardened/ubuntu hardy main

2. Using your favorite dpkg manager (e.g. aptitude):
* Update repo
* Install updated packages:
* libpam0g [1]
* openssh-server [2]
* grub [3]
* Remove apparmor [4]
* Remove apparmor-utils [4]
* Install selinux
* Install selinux-policy-refpolicy [5]
* Remove auto-recommended install of selinux-policy-dummy [5]
* (Commit changes)

3. Configure /etc/selinux/config:
* Change SELINUX=enforcing to SELINUX=permissive [6]

4. Reboot

[1] PAM was using a deprecated method of handling login contexts
<https://bugs.launchpad.net/ubuntu/+source/pam/+bug/187822>. The updated package
fixes this problem by backporting changes in upstream.

[2] OpenSSH Server autoconf scripts were failing to detect the libselinux
functions getseuserbyname and get_default_context_with_level
<https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/188136>. The updated
package fixes the configure bug by correctly setting LIBS before calling
AC_CHECK_FUNCS.

[3] Grub's update-grub lacks a trigger (and update-grub cannot be called
directly due to nested debconf issues). In order to seamlessly switch between
AppArmor and SELinux we need to reconfigure the menu.lst's defoptions. This
patch adds an explicit trigger for update-grub.

[4] apparmor and apparmor-utils need to be removed separately due to a recommend
in ubuntu-standard for apparmor-utils. If just apparmor is removed, then the
auto-resolution attempts to remove ubuntu-standard.

[5] selinux-policy-dummy is auto-picked when selinux is installed. It would be
better if selinux-policy-refpolicy was auto-picked instead and the dummy package
was a second choice. ;o} Suggestions on how to make that happen are very
welcome!

[6] At this time the system will fail to boot in enforcing mode. This will, of
course, be fixed.

--
ubuntu-devel mailing list
ubuntu-devel@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel
 

Thread Tools




All times are GMT. The time now is 07:01 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org