Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

According to Introduction to SELinux, section 14.4.2,

SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications.

I have installed the selinux-basics and selinux-policy-default packages on my Debian Wheezy (stable) system, and I saw it loading some policies during the installation, so I'm pretty sure the installation itself went well.

I edited /etc/default/grub to say:

GRUB_CMDLINE_LINUX="selinux=1 audit=1 enforcing=0"

(that variable used to be empty) and ran update-grub. /boot/grub/grub.cfg does include the SELinux-related kernel parameters.

I created a file /.autorelabel based on the /usr/sbin/selinux-activate script's "enable" branch.

I have rebooted the system after making the above changes. Nothing out of the ordinary happened during that reboot.

dmesg | head outputs, among else:

Command line: BOOT_IMAGE=/boot/vmlinuz-3.2.0-4-amd64 root=UUID=c050d662-f94a-447a-9342-0fc69f65a513 ro selinux=1 audit=1 enforcing=0 quiet pci=nomsi

As far as I can tell, everything is in place. Yet, it does not seem to be working. id -Z returns:

$ id -Z
id: --context (-Z) works only on an SELinux-enabled kernel
$

sestatus gives:

# sestatus
SELinux status:                 disabled
#

check-selinux-installation gives:

# check-selinux-installation
getfilecon:  getfilecon(/proc/1) failed
SELinux is not enabled.
Could not read the domain of PID 1.
/etc/pam.d/login is not SELinux enabled
Postfix init script is syncing the chroots.
Postfix has chrooted service in master.cf
FSCKFIX is not enabled - not serious, but could prevent system from booting...
#

What's missing for SELinux to be enabled on my system?

share|improve this question
    
did you run selinux-activate wiki.debian.org/SELinux/Setup –  richard Jun 13 at 16:41
    
To use selinux in Debian see wiki.debian.org/SELinux/Setup and confirm you did all these steps (install auditd and run selinux-activate). Also, what file system are you using? In my experience in running selinux, I HIGHLY suggest you run Fedora or RHEL (Centos/Scientific). selinux on Debian/Ubuntu/Arch can be problematic and is not supported as well on these distros. –  bodhi.zazen Jun 13 at 16:41
    
@richard You may be on to something, it looks like security=selinux is also wanted. Going to give that a try. –  Michael Kjörling Jun 13 at 17:07
    
@bodhi.zazen ext4 root, ZFS for pretty much everything else. –  Michael Kjörling Jun 13 at 17:07
    
Alright, you may need to do some manual configuration with zfs. –  bodhi.zazen Jun 13 at 17:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.