Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to Introduction to SELinux, section 14.4.2,

SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications.

I have installed the selinux-basics and selinux-policy-default packages on my Debian Wheezy (stable) system, and I saw it loading some policies during the installation, so I'm pretty sure the installation itself went well.

I edited /etc/default/grub to say:

GRUB_CMDLINE_LINUX="selinux=1 audit=1 enforcing=0"

(that variable used to be empty) and ran update-grub. /boot/grub/grub.cfg does include the SELinux-related kernel parameters.

I created a file /.autorelabel based on the /usr/sbin/selinux-activate script's "enable" branch.

I have rebooted the system after making the above changes. Nothing out of the ordinary happened during that reboot.

dmesg | head outputs, among else:

Command line: BOOT_IMAGE=/boot/vmlinuz-3.2.0-4-amd64 root=UUID=c050d662-f94a-447a-9342-0fc69f65a513 ro selinux=1 audit=1 enforcing=0 quiet pci=nomsi

As far as I can tell, everything is in place. Yet, it does not seem to be working. id -Z returns:

$ id -Z
id: --context (-Z) works only on an SELinux-enabled kernel
$

sestatus gives:

# sestatus
SELinux status:                 disabled
#

check-selinux-installation gives:

# check-selinux-installation
getfilecon:  getfilecon(/proc/1) failed
SELinux is not enabled.
Could not read the domain of PID 1.
/etc/pam.d/login is not SELinux enabled
Postfix init script is syncing the chroots.
Postfix has chrooted service in master.cf
FSCKFIX is not enabled - not serious, but could prevent system from booting...
#

What's missing for SELinux to be enabled on my system?

share|improve this question
    
did you run selinux-activate wiki.debian.org/SELinux/Setup – richard Jun 13 '14 at 16:41
    
To use selinux in Debian see wiki.debian.org/SELinux/Setup and confirm you did all these steps (install auditd and run selinux-activate). Also, what file system are you using? In my experience in running selinux, I HIGHLY suggest you run Fedora or RHEL (Centos/Scientific). selinux on Debian/Ubuntu/Arch can be problematic and is not supported as well on these distros. – bodhi.zazen Jun 13 '14 at 16:41
    
@richard You may be on to something, it looks like security=selinux is also wanted. Going to give that a try. – Michael Kjörling Jun 13 '14 at 17:07
    
@bodhi.zazen ext4 root, ZFS for pretty much everything else. – Michael Kjörling Jun 13 '14 at 17:07
    
Alright, you may need to do some manual configuration with zfs. – bodhi.zazen Jun 13 '14 at 17:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.