Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 501100 - SELinux Handbook section 2.6 should be above section 2.3, or targeted install gets "Failed to set SELinux security labels."
Summary: SELinux Handbook section 2.6 should be above section 2.3, or targeted install...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: SE Linux Bugs
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-12 18:51 UTC by Andy Johnson
Modified: 2014-03-23 18:56 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andy Johnson 2014-02-12 18:51:52 UTC 
following directions in selinux handbook on http://www.gentoo.org/proj/en/hardened/selinux/selinux-handbook.xml?part=2&chap=1

at section 2.3 if you selected targeted policy instead of strict, the emerge -uDN world, will fail as it attempts to look for file contexts in /etc/selinux/strict/contexts/files/file_contexts which does not exist.
Comment 1 Sven Vermeulen (RETIRED) gentoo-dev 2014-02-17 20:39:39 UTC 
Can you provide more information about this? Error log or build log?

It seems I've hardcoded "strict" somewhere then, so I need to cover that.
Comment 2 Andy Johnson 2014-02-18 00:05:39 UTC 
Well I don't have the error message specifically up at the moment.  However when you proceed as directed at step 2.3, any emerge will fail as it looks for file_contexts in /etc/selinux/strict/contexts/files/file_contexts...

following step 2.6 and modifying /etc/selinux/config to specify POLICY="targeted" instead of the default "strict" will allow you to keep building a targeted system. 

It's just an order of operations in the instructions really.  Only thing that could be automated I guess would be /etc/portage/make.conf POLICY and /etc/selinux/config SELINUXTYPE to match.
Comment 3 Sven Vermeulen (RETIRED) gentoo-dev 2014-03-23 18:56:02 UTC 
This has been put in place online. Thanks for reporting!