According to Introduction to SELinux, section 14.4.2,
SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications.
I have installed the
selinux-policy-default packages on my Debian Wheezy (stable) system, and I saw it loading some policies during the installation, so I'm pretty sure the installation itself went well.
I edited /etc/default/grub to say:
GRUB_CMDLINE_LINUX="selinux=1 audit=1 enforcing=0"
(that variable used to be empty) and ran update-grub. /boot/grub/grub.cfg does include the SELinux-related kernel parameters.
I created a file
/.autorelabel based on the /usr/sbin/selinux-activate script's "enable" branch.
I have rebooted the system after making the above changes. Nothing out of the ordinary happened during that reboot.
dmesg | head outputs, among else:
Command line: BOOT_IMAGE=/boot/vmlinuz-3.2.0-4-amd64 root=UUID=c050d662-f94a-447a-9342-0fc69f65a513 ro selinux=1 audit=1 enforcing=0 quiet pci=nomsi
As far as I can tell, everything is in place. Yet, it does not seem to be working.
id -Z returns:
$ id -Z id: --context (-Z) works only on an SELinux-enabled kernel $
# sestatus SELinux status: disabled #
# check-selinux-installation getfilecon: getfilecon(/proc/1) failed SELinux is not enabled. Could not read the domain of PID 1. /etc/pam.d/login is not SELinux enabled Postfix init script is syncing the chroots. Postfix has chrooted service in master.cf FSCKFIX is not enabled - not serious, but could prevent system from booting... #
What's missing for SELinux to be enabled on my system?