0

I'm student. I want to use the policy compiled from the source code.
After compiling the policy, the following error statement is displayed.
Please tell me how to compile and apply SELinux policy.

systemd[1]: Unable to fix SELinux security context of /run/systemd/journal/dev-log: Permission denied
systemd[1]: Unable to fix SELinux security context of /run/systemd/journal/socket: Permission denied
:
systemd-journald[529]: Faild to open /run/systemd/journal/kernelseqnum, ignoring: Permission denied
:

audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
:

The procedure I did is shown below.

Fedora 26 (linux4.11.8-300)
1)  yumdownloader --source selinux-policy
2)  rpm -ivh selinux-policy-3.13.1-260.8.fc26.src.rpm
3)  rpmbuild -bi ~/rpmbuild/SPEC/selinux-policy.spec --define "BUILD_STRICT 0" --define "BUILD_MLS 0"
4)  cd ~/rpmbuild/BUILD/selinux-3.13.1/
5)  vi build.conf
 ----
 TYPE = mcs
 NAME = test
 DISTRO = redhat
 UNK_PERMS = allow
 DIRECT_INITRC = y
 MONOLITHIC = n
 UBAC = n
 CUSTOM_BUILDOPT =
 MLS_SENS = 16
 MLS_CATS = 1024
 MCS_CATS = 1024
 QUIET = n
 ----
6)  make install-src
7)  cd /etc/selinux/test/src/policy
8)  make load
9)  touch /.autorelabel
10) edit /etc/selinux/config file
11) reboot
12) "audit:backlog limit exceeded" continues to be outputted

I increased the buffer size but it did not change.

/etc/audit/audit.rules
# Set buffer size
-b 8192
  • Run as root. use sudo. – enZyme Sep 25 '17 at 8:17
  • The above is done with root authority. – penpen Sep 26 '17 at 0:48
1

For what I can see here you are actually not compiling and installing the policy.

To compile the policy, I would do:

  1. yumdownloader --source selinux-policy
  2. rpm -ivh selinux-policy-3.13.1-260.8.fc26.src.rpm
  3. rpmbuild -bp ~/rpmbuild/SPEC/selinux-policy.spec --define "BUILD_STRICT 0" --define "BUILD_MLS 0" #this patch the code with fedora patches
  4. cd ~/rpmbuild/BUILD/selinux-3.13.1/
  5. vi build.conf TYPE = mcs NAME = test DISTRO = redhat UNK_PERMS = allow DIRECT_INITRC = y MONOLITHIC = n UBAC = n CUSTOM_BUILDOPT = MLS_SENS = 16 MLS_CATS = 1024 MCS_CATS = 1024 QUIET = n
  6. make config
  7. make
  8. make install install-headers
  9. make load
  10. touch /.autorelabel
  11. edit /etc/selinux/config file
  12. reboot

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.