kernel 'make' anomoly?

dansawyer · 09-17-2006, 11:14 PM

All,

I am trying to configure a kernel from kernel.org to turn on selinux. However 'make' does not find the option. Below is the logic in /security/Makefile. These options do not appear in any of the make's (make xconfig, etc.) Can anyone see a reason why the high level make not find these options?

Thanks Dan

#
# Makefile for the kernel security code
#

obj-$(CONFIG_KEYS) += keys/
subdir-$(CONFIG_SECURITY_SELINUX) += selinux

# if we don't select a security model, use the default capabilities
ifneq ($(CONFIG_SECURITY),y)
obj-y += commoncap.o
endif

# Object file lists
obj-$(CONFIG_SECURITY) += security.o dummy.o inode.o
# Must precede capability.o in order to stack properly.
obj-$(CONFIG_SECURITY_SELINUX) += selinux/built-in.o
obj-$(CONFIG_SECURITY_CAPABILITIES) += commoncap.o capability.o
obj-$(CONFIG_SECURITY_ROOTPLUG) += commoncap.o root_plug.o
obj-$(CONFIG_SECURITY_SECLVL) += seclvl.o

zhangmaike · 09-18-2006, 12:18 AM

Use make menuconfig.

At the top of the screen, you'll see that you can press "/" to search. Press /

Type SELINUX, press enter. Scroll down a bit, eventually you'll find the option you're looking for. You'll also notice that SECURITY_SELINUX depends on several other options. You'll need to enable those before SECURITY_SELINUX becomes visible as a choice.

dansawyer · 09-18-2006, 08:23 AM

Thank you. Below is the output from / and SELinux. However the NSA SELinux Support (SECURITY_SELINUX) option does not appear as an option for Security options.

Security options are in Kconfig /security and they seem to appear; however selinux options are in Kconfig /security/selinux and do not appear as a configuration option.

Are there requirements that do not appear in this list?

Symbol: SECURITY_SELINUX_BOOTPARAM [=n] │
│ Prompt: NSA SELinux boot parameter │
│ Defined at security/selinux/Kconfig:13 │
│ Depends on: SECURITY_SELINUX │
│ Location: │
│ -> Security options │
│ -> NSA SELinux Support (SECURITY_SELINUX [=n]) │
│ │
│ │
│ Symbol: SECURITY_SELINUX_AVC_STATS [=n] │
│ Prompt: NSA SELinux AVC Statistics │
│ Defined at security/selinux/Kconfig:70 │
│ Depends on: SECURITY_SELINUX │
│ Location: │
│ -> Security options │
│ -> NSA SELinux Support (SECURITY_SELINUX [=n]) │
│ │
│ │
│ Symbol: SECURITY_SELINUX_DISABLE [=n] │
│ Prompt: NSA SELinux runtime disable │
│ Defined at security/selinux/Kconfig:42 │
│ Depends on: SECURITY_SELINUX │
│ Location: │
│ -> Security options │
│ -> NSA SELinux Support (SECURITY_SELINUX [=n])

zhangmaike · 09-18-2006, 11:32 AM

What you have posted is an incomplete list. The SECURITY_SELINUX option is there, but you need to scroll down in the list to see all of the options that "/" found. Use the up, down, page-up, and page-down keys.

I have a 2.6.17.13 kernel. Here is the entire output of that /

Code:

  │ Symbol: SECURITY_SELINUX_BOOTPARAM [=n]                                 │
  │ Prompt: NSA SELinux boot parameter                                      │
  │   Defined at security/selinux/Kconfig:13                                │
  │   Depends on: SECURITY_SELINUX                                          │
  │   Location:                                                             │
  │     -> Security options                                                 │
  │       -> NSA SELinux Support (SECURITY_SELINUX [=n])                    │
  │                                                                         │
  │                                                                         │
  │ Symbol: SECURITY_SELINUX_AVC_STATS [=n]                                 │
  │ Prompt: NSA SELinux AVC Statistics                                      │
  │   Defined at security/selinux/Kconfig:70                                │
  │   Depends on: SECURITY_SELINUX                                          │
  │   Location:                                                             │
  │     -> Security options                                                 │
  │       -> NSA SELinux Support (SECURITY_SELINUX [=n])                    │
  │                                                                         │
  │                                                                         │
  │ Symbol: SECURITY_SELINUX_DISABLE [=n]                                   │
  │ Prompt: NSA SELinux runtime disable                                     │
  │   Defined at security/selinux/Kconfig:42                                │
  │   Depends on: SECURITY_SELINUX                                          │
  │   Location:                                                             │
  │     -> Security options                                                 │
  │       -> NSA SELinux Support (SECURITY_SELINUX [=n])                    │
  │                                                                         │
  │                                                                         │
  │ Symbol: SECURITY_SELINUX_DEVELOP [=n]                                   │
  │ Prompt: NSA SELinux Development Support                                 │
  │   Defined at security/selinux/Kconfig:57                                │
  │   Depends on: SECURITY_SELINUX                                          │
  │   Location:                                                             │
  │     -> Security options                                                 │
  │       -> NSA SELinux Support (SECURITY_SELINUX [=n])                    │
  │                                                                         │
  │                                                                         │
  │ Symbol: SECURITY_SELINUX_CHECKREQPROT_VALUE [=]                         │
  │ Prompt: NSA SELinux checkreqprot default value                          │
  │   Defined at security/selinux/Kconfig:79                                │
  │   Depends on: SECURITY_SELINUX                                          │
  │   Location:                                                             │
  │     -> Security options                                                 │
  │       -> NSA SELinux Support (SECURITY_SELINUX [=n])                    │
  │                                                                         │
  │                                                                         │
  │ Symbol: SECURITY_SELINUX_BOOTPARAM_VALUE [=]                            │
  │ Prompt: NSA SELinux boot parameter default value                        │
  │   Defined at security/selinux/Kconfig:27                                │
  │   Depends on: SECURITY_SELINUX_BOOTPARAM                                │
  │   Location:                                                             │
  │     -> Security options                                                 │
  │       -> NSA SELinux Support (SECURITY_SELINUX [=n])                    │
  │         -> NSA SELinux boot parameter (SECURITY_SELINUX_BOOTPARAM [=n]) │
  │                                                                         │
  │                                                                         │
  │ Symbol: SECURITY_SELINUX [=n]                                           │
  │ Prompt: NSA SELinux Support                                             │
  │   Defined at security/selinux/Kconfig:1                                 │
  │   Depends on: SECURITY_NETWORK && AUDIT && NET && INET                  │
  │   Location:                                                             │
  │     -> Security options                                                 │

dansawyer · 09-18-2006, 09:56 PM

That did it. Thanks. It was the bottom depend list.

Thanks - Dan