tom.petri at googlemail
Mar 21, 2012, 8:40 AM
Post #7 of 8
(437 views)
Permalink
|
|
Re: Setting filesystem labels for SELinux fails
[In reply to]
|
|
On Tue, Mar 20, 2012 at 8:32 PM, Tom Petri <tom.petri [at] googlemail> wrote:
> On Sun, Mar 18, 2012 at 12:27 PM, Tom Petri <tom.petri [at] googlemail> wrote:
>> On Sun, Mar 18, 2012 at 11:36 AM, Sven Vermeulen <swift [at] gentoo> wrote:
>>> On Sun, Mar 18, 2012 at 10:36:53AM +0100, Tom Petri wrote:
>>>> Yes, extended attributes along with security labels are activated.
>>>>
>>>> # attr -s test -V test /var && attr -r test /var
>>>> Attribute "test" set to a 4 byte value for /var: test
>>>>
>>>> I should probably tell how I proceeded during the installation:
>>>> 1. created the filesystems (as usual)
>>>> 2. got a hardened stage3 tarball and portage
>>>> 3. portage sync, re-emerge portage, created a hardened-sources kernel,
>>>> booted up.
>>>> 4. emerge policys (checkpolicy, policycoreutils, selinux-base-policy [-selinux])
>>>> 5. emerge -uDN world
>>>> 6. reboot and tried rlpkg -a -r
>>>
>>> Did the setfiles commands (mentioned in the installation instructions before
>>> the "rlpkg -a -r") succeed, or did they give the same error?
>>>
>>> Wkr,
>>> Sven Vermeulen
>>>
>>>
>>>
>> Yes, I got the same errors then:
>> # setfiles -r /mnt/gentoo
>> /etc/selinux/strict/contexts/files/file_contexts /mnt/gentoo/dev
>> setfiles set context /mnt/gentoo/dev->system_u:object_r:device_t
>> failed:'Operation not supported'
>> # setfiles -r /mnt/gentoo
>> /etc/selinux/strict/contexts/files/file_contexts /mnt/gentoo/lib
>> setfiles set context /mnt/gentoo/lib->system_u:object_r:lib_t
>> failed:'Operation not supported'
> I just did a fresh gentoo install (configuration) and proceeded with
> the instructions from the gentoo hardened documentation.
> After compiling re-emerging world the system doesn't get up. I'm able
> to ping it but udev seems to have problems as /dev/console and the
> tty's aren't found:
>
> /etc/init.d/sshd[1205]: ERROR: sshd failed to start
> /etc/init.d/urandom[1219]: ERROR: urandom failed to start
> init: open(/dev/console): No such file or directory
> agetty[1233]: /dev/tty2: not a character device
> agetty[1232]: /dev/tty1: not a character device
>
> My mdadm RAID is recognized properly, in case it matters.
>
> I did everything the instructions say, however I'm always getting new
> errors. Is there a viable solution to this? Thanks in advance!
The udev from the hardened documentation seems to be the problem (udev
/dev tmpfs rw,rootcontext=system_u:object_r:device_t,seclabel,nosuid,relatime,size=10m,mode=755
0 0).
The systems boots without this entry, however `sestatus` says "disabled".
|
