where to get selinux kernel patchs?

dansawyer · 09-16-2006, 10:47 PM

All,

Where are the selinux kernel patchs? They do not appear to be in the kernel.org sources. The kernel level is 2.6.16.9. There are no selinux configuration options in this kernel.

Thanks - Dan

dansawyer · 09-16-2006, 10:57 PM

The post may be in error. The ..source /security dir show selinux files. The raw source may be in the kernel.org source. However no option is offered in make xconfig to turn selinux on. Does anyone know what would cause this?

- Dan

win32sux · 09-17-2006, 01:12 PM

it should be in the security options or something...

http://www.linux-magazin.de/Artikel/...linux/abb3.jpg

BTW, if you really wanna use 2.6.16.y, i recommend that you upgrade to 2.6.16.29, which is the latest 2.6.16.y at the time of this post... then again, your 2.6.16.9 might have been a typo...

dansawyer · 09-17-2006, 02:05 PM

Thanks,

That is what I thought. This is what appears in security options:

#
# Security options
#
# CONFIG_KEYS is not set
CONFIG_SECURITY=y
# CONFIG_SECURITY_NETWORK is not set
CONFIG_SECURITY_CAPABILITIES=m
# CONFIG_SECURITY_ROOTPLUG is not set
# CONFIG_SECURITY_SECLVL is not set

SELinux does not appear.

- Dan

win32sux · 09-17-2006, 02:29 PM

what term did you grep for?? try grepping for SELINUX...

this is what my ubuntu box's config looks like:

Code:

win32sux@lisa:~$ cat /boot/config-2.6.15-26-386 | grep SELINUX
CONFIG_SECURITY_SELINUX=y
CONFIG_SECURITY_SELINUX_BOOTPARAM=y
CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=0
CONFIG_SECURITY_SELINUX_DISABLE=y
CONFIG_SECURITY_SELINUX_DEVELOP=y
CONFIG_SECURITY_SELINUX_AVC_STATS=y
CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1

dansawyer · 09-17-2006, 02:36 PM

I just downloaded the latest .6 kernel from kernel.org and untared it. I tried both make oldconfig and make config.

SELinux did not show up anywhere.

???

- Dan

win32sux · 09-17-2006, 04:09 PM

Quote:

Originally Posted by dansawyer

I just downloaded the latest .6 kernel from kernel.org and untared it. I tried both make oldconfig and make config.

SELinux did not show up anywhere.

???

- Dan

well, i guess i'll download the latest 2.6 (2.6.17.13) from kernel.org too then to show you exactly where the options are... or were you referring to the latest from the 2.6.16.y branch (2.6.16.29)??

ah, whatever - i'll download them both...

win32sux · 09-17-2006, 05:19 PM

i downloaded 2.6.16.29, but i'm having trouble getting "make xconfig" to work cuz of some qt dependancies... but i did a "make menuconfig" and the selinux options are right where you'd expect them to be (in Security Options):

Code:

[*] Enable access key retention support                                                                          │ │
  │ │ [ ]   Enable the /proc/keys file by which all keys may be viewed                                                 │ │
  │ │[*] Enable different security models                                                                             │ │
  │ │[*]   Socket and Networking Security Hooks                                                                       │ │
  │ │ [ ]     XFRM (IPSec) Networking Security Hooks (NEW)                                                             │ │
  │ │ <M>   Default Linux Capabilities                                                                                 │ │
  │ │ <M>   Root Plug Support                                                                                          │ │
  │ │ <M>   BSD Secure Levels                                                                                          │ │
  │ │[*] NSA SELinux Support                                                                                          │ │
  │ │[*]   NSA SELinux boot parameter                                                                                 │ │
  │ │ (0)     NSA SELinux boot parameter default value                                                                 │ │
  │ │[*]   NSA SELinux runtime disable                                                                                │ │
  │ │[*]   NSA SELinux Development Support                                                                            │ │
  │ │[*]   NSA SELinux AVC Statistics                                                                                 │ │
  │ │ (1)   NSA SELinux checkreqprot default value                                                                     │ │
  │ │

the same goes for 2.6.17.13:

Code:

[*] Enable access key retention support                                                     │ │
  │ │                      [ ]   Enable the /proc/keys file by which all keys may be viewed                            │ │
  │ │[*] Enable different security models                                                        │ │
  │ │[*]   Socket and Networking Security Hooks                                                  │ │
  │ │                      [ ]     XFRM (IPSec) Networking Security Hooks (NEW)                                        │ │
  │ │                      <M>   Default Linux Capabilities                                                            │ │
  │ │                      <M>   Root Plug Support                                                                     │ │
  │ │                      <M>   BSD Secure Levels                                                                     │ │
  │ │[*] NSA SELinux Support                                                                     │ │
  │ │[*]   NSA SELinux boot parameter                                                            │ │
  │ │                      (0)     NSA SELinux boot parameter default value                                            │ │
  │ │[*]   NSA SELinux runtime disable                                                           │ │
  │ │[*]   NSA SELinux Development Support                                                       │ │
  │ │[*]   NSA SELinux AVC Statistics                                                            │ │
  │ │                      (1)   NSA SELinux checkreqprot default value

so i'm not sure why you aren't getting/finding those options... they are DEFINITELY there - in fact, it's my understanding that selinux has been a part of 2.6 since the start...

dansawyer · 09-17-2006, 09:52 PM

I re-checked the 2.6.17.13 file. The various config tools show Enable Access Key R... option. However turning on does not bring up the SELinux options.

- Dan

dansawyer · 09-18-2006, 11:06 PM

All - I got help with the answer:

1. use make menuconfig
2. enter the / command
3. search for selinux
4. go to the bottom and make sure all the depends are satisfied.

(in my case it was the 'audit' dependency.

- Dan