2

According to Introduction to SELinux, section 14.4.2,

SELinux support is built into the standard kernels provided by Debian. The core Unix tools support SELinux without any modifications.

I have installed the selinux-basics and selinux-policy-default packages on my Debian Wheezy (stable) system, and I saw it loading some policies during the installation, so I'm pretty sure the installation itself went well.

I edited /etc/default/grub to say:

GRUB_CMDLINE_LINUX="selinux=1 audit=1 enforcing=0"

(that variable used to be empty) and ran update-grub. /boot/grub/grub.cfg does include the SELinux-related kernel parameters.

I created a file /.autorelabel based on the /usr/sbin/selinux-activate script's "enable" branch.

I have rebooted the system after making the above changes. Nothing out of the ordinary happened during that reboot.

dmesg | head outputs, among else:

Command line: BOOT_IMAGE=/boot/vmlinuz-3.2.0-4-amd64 root=UUID=c050d662-f94a-447a-9342-0fc69f65a513 ro selinux=1 audit=1 enforcing=0 quiet pci=nomsi

As far as I can tell, everything is in place. Yet, it does not seem to be working. id -Z returns:

$ id -Z
id: --context (-Z) works only on an SELinux-enabled kernel
$

sestatus gives:

# sestatus
SELinux status:                 disabled
#

check-selinux-installation gives:

# check-selinux-installation
getfilecon:  getfilecon(/proc/1) failed
SELinux is not enabled.
Could not read the domain of PID 1.
/etc/pam.d/login is not SELinux enabled
Postfix init script is syncing the chroots.
Postfix has chrooted service in master.cf
FSCKFIX is not enabled - not serious, but could prevent system from booting...
#

What's missing for SELinux to be enabled on my system?

  • 2
    did you run selinux-activate wiki.debian.org/SELinux/Setup – ctrl-alt-delor Jun 13 '14 at 16:41
  • To use selinux in Debian see wiki.debian.org/SELinux/Setup and confirm you did all these steps (install auditd and run selinux-activate). Also, what file system are you using? In my experience in running selinux, I HIGHLY suggest you run Fedora or RHEL (Centos/Scientific). selinux on Debian/Ubuntu/Arch can be problematic and is not supported as well on these distros. – Panther Jun 13 '14 at 16:41
  • 1
    @richard You may be on to something, it looks like security=selinux is also wanted. Going to give that a try. – a CVn Jun 13 '14 at 17:07
  • @bodhi.zazen ext4 root, ZFS for pretty much everything else. – a CVn Jun 13 '14 at 17:07
  • 1
    @richard I think the security=selinux (judging by comparing what I had with what the selinux-activate script did) just might have been it. I also added auditd but am not sure if that was required or not; the missing kernel parameter would certainly explain why SELinux wasn't enabled on boot. If you'll write up a bit of a proper answer from your comment, I'll accept it. Thanks! – a CVn Jun 13 '14 at 17:34
0

As pointed out in comments, you need to pass security=selinux parameter to kernel as well. On Debian systems, this should be automatically added to grub configuration by selinux-activate.

Kernel documentation explains security parameter:

[SECURITY] Choose a security module to enable at boot. If this boot parameter is not specified, only the first security module asking for security registration will be loaded. An invalid security module name will be treated as if no module has been chosen.

On Debian this is relevant, as Debian also supports AppArmor security module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.