SELinux not enabled

[Sjoerd Mullender]

I have a problem getting SELinux to work on my fully up-to-date FC3
system.  Here is some relevant output:

# ls -l /etc/sysconfig/selinux
lrwxrwxrwx  1 root root 19 Apr 12 08:33 /etc/sysconfig/selinux ->
/etc/selinux/config
# grep -v ^# /etc/selinux/config
SELINUX=permissive
SELINUXTYPE=targeted
# rpm -qa '*policy*'
policycoreutils-1.18.1-2.10
selinux-policy-targeted-1.17.30-2.96
# rpm -q kernel
kernel-2.6.11-1.14_FC3
# sestatus
SELinux status:         disabled
# dmesg | grep -i selinux
SELinux:  Initializing.
SELinux:  Starting in permissive mode
selinux_register_security:  Registering secondary module capability
SELinux:  Registering netfilter hooks
# setenforce Permissive
setenforce: SELinux is disabled

Note that there is a lot of stuff missing from the dmesg output (I
compared this with a system where it does work).

What I have understood from the FAQ and the config file, all I need to
do to get SELinux to work (initially in permissive mode) is set the two
values in /etc/selinux/config and then reboot.  This I have done.

Is there any other file that might interfere?

The system was upgraded all the way from at least RedHat 9 via FC1 and
FC2 (and various FC1 tests).  I have only recently installed the SELinux
stuff.

-- 
Sjoerd Mullender <sjoerd(a)acm.org&gt;

[Stephen Smalley]

On Tue, 2005-04-12 at 20:53 +0200, Sjoerd Mullender wrote:
>  # dmesg | grep -i selinux
>  SELinux:  Initializing.
>  SELinux:  Starting in permissive mode
>  selinux_register_security:  Registering secondary module capability
>  SELinux:  Registering netfilter hooks
>  # setenforce Permissive
>  setenforce: SELinux is disabled
>  
>  Note that there is a lot of stuff missing from the dmesg output (I
>  compared this with a system where it does work). 
This suggests that policy was never loaded by /sbin/init.  What is
in /etc/selinux/targeted/policy?  Can you load it by hand,
i.e. /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.<version>?

-- 
Stephen Smalley <sds(a)tycho.nsa.gov&gt;
National Security Agency

[Sjoerd Mullender]

Stephen Smalley wrote:
>  On Tue, 2005-04-12 at 20:53 +0200, Sjoerd Mullender wrote:
>  
> ># dmesg | grep -i selinux
> >SELinux:  Initializing.
> >SELinux:  Starting in permissive mode
> >selinux_register_security:  Registering secondary module capability
> >SELinux:  Registering netfilter hooks
> ># setenforce Permissive
> >setenforce: SELinux is disabled
> >
> >Note that there is a lot of stuff missing from the dmesg output (I
> >compared this with a system where it does work).
>  
>  
>  This suggests that policy was never loaded by /sbin/init.  What is
>  in /etc/selinux/targeted/policy?  Can you load it by hand,
>  i.e. /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.<version>?
>   
No:
# /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.18
load_policy: booleans.c:48: security_get_boolean_names: Assertion
`selinux_mnt' failed.
Aborted


-- 
Sjoerd Mullender <sjoerd(a)acm.org&gt;

[Stephen Smalley]

On Tue, 2005-04-12 at 21:13 +0200, Sjoerd Mullender wrote:
>  No:
>  # /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.18
>  load_policy: booleans.c:48: security_get_boolean_names: Assertion
>  `selinux_mnt' failed.
>  Aborted 
That suggests that /sbin/init didn't mount /selinux either.
Try:
	mount -t selinuxfs none /selinux
Then try running load_policy again.

/sbin/init is supposed to handle all of that for you.

-- 
Stephen Smalley <sds(a)tycho.nsa.gov&gt;
National Security Agency

[Stephen Smalley]

On Tue, 2005-04-12 at 15:08 -0400, Stephen Smalley wrote:
>  On Tue, 2005-04-12 at 21:13 +0200, Sjoerd Mullender wrote:
>  > No:
>  > # /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.18
>  > load_policy: booleans.c:48: security_get_boolean_names: Assertion
>  > `selinux_mnt' failed.
>  > Aborted
>  
>  That suggests that /sbin/init didn't mount /selinux either.
>  Try:
>  	mount -t selinuxfs none /selinux
>  Then try running load_policy again.
>  
>  /sbin/init is supposed to handle all of that for you. 
Also, rpm -q libsepol libselinux SysVinit

-- 
Stephen Smalley <sds(a)tycho.nsa.gov&gt;
National Security Agency

[Sjoerd Mullender]

Stephen Smalley wrote:
>  On Tue, 2005-04-12 at 15:08 -0400, Stephen Smalley wrote:
>  
> >On Tue, 2005-04-12 at 21:13 +0200, Sjoerd Mullender wrote:
> >
> >>No:
> >># /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.18
> >>load_policy: booleans.c:48: security_get_boolean_names: Assertion
> >>`selinux_mnt' failed.
> >>Aborted
> >
> >That suggests that /sbin/init didn't mount /selinux either.
> >Try:
> >	mount -t selinuxfs none /selinux
> >Then try running load_policy again.
> >
> >/sbin/init is supposed to handle all of that for you.
>  
>  
>  Also, rpm -q libsepol libselinux SysVinit
>   
# rpm -q libsepol libselinux SysVinit
libsepol-1.1.1-2
libselinux-1.19.1-8
SysVinit-2.85-34

-- 
Sjoerd Mullender <sjoerd(a)acm.org&gt;

[Sjoerd Mullender]

Stephen Smalley wrote:
>  On Tue, 2005-04-12 at 21:13 +0200, Sjoerd Mullender wrote:
>  
> >No:
> ># /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.18
> >load_policy: booleans.c:48: security_get_boolean_names: Assertion
> >`selinux_mnt' failed.
> >Aborted
>  
>  
>  That suggests that /sbin/init didn't mount /selinux either.
>  Try:
>  	mount -t selinuxfs none /selinux
>  Then try running load_policy again.
>  
>  /sbin/init is supposed to handle all of that for you.
>   
This works better.  I had to create /selinux first:
# mount -t selinuxfs none /selinux
mount: mount point /selinux does not exist
# mkdir /selinux
# mount -t selinuxfs none /selinux
# /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.18
/usr/sbin/load_policy:  Warning!  Error while getting boolean names:
Success

Could that have been the problem (/selinux not being there)?

-- 
Sjoerd Mullender <sjoerd(a)acm.org&gt;

[Stephen Smalley]

On Tue, 2005-04-12 at 21:22 +0200, Sjoerd Mullender wrote:
>  This works better.  I had to create /selinux first:
>  # mount -t selinuxfs none /selinux
>  mount: mount point /selinux does not exist
>  # mkdir /selinux
>  # mount -t selinuxfs none /selinux
>  # /usr/sbin/load_policy /etc/selinux/targeted/policy/policy.18
>  /usr/sbin/load_policy:  Warning!  Error while getting boolean names:
>  Success
>  
>  Could that have been the problem (/selinux not being there)? 
Yes.  Looking at the /sbin/init code, it should have logged a 'Failed to
mount /selinux: <error message>' message.  Although it may have been too
early to be captured.  Normally, /selinux is created by the installer,
but since you upgraded...

-- 
Stephen Smalley <sds(a)tycho.nsa.gov&gt;
National Security Agency

[Stephen Smalley]

On Tue, 2005-04-12 at 15:19 -0400, Stephen Smalley wrote:
>  Yes.  Looking at the /sbin/init code, it should have logged a
> 'Failed to
>  mount /selinux: <error message>' message.  Although it may have been too
>  early to be captured.  Normally, /selinux is created by the installer,
>  but since you upgraded... 
BTW, you now need to run /sbin/fixfiles relabel to assign security
labels to your filesystems.  That is normally done during installation,
again, but since you upgraded, you have to do it manually.

-- 
Stephen Smalley <sds(a)tycho.nsa.gov&gt;
National Security Agency

[Sjoerd Mullender]

Stephen Smalley wrote:
>  On Tue, 2005-04-12 at 15:19 -0400, Stephen Smalley wrote:
>  
> >Yes.  Looking at the /sbin/init code, it should have logged a 'Failed to
> >mount /selinux: <error message>' message.  Although it may have been too
> >early to be captured.  Normally, /selinux is created by the installer,
> >but since you upgraded...
>  
>  
>  BTW, you now need to run /sbin/fixfiles relabel to assign security
>  labels to your filesystems.  That is normally done during installation,
>  again, but since you upgraded, you have to do it manually.
>   
I rebooted, and all is well now.  SELinux is enabled, and since I had
created /.autorelabel when I started experimenting, the file system is
now also relabeled.

Thanks for the help.

-- 
Sjoerd Mullender <sjoerd(a)acm.org&gt;