Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Systemd SELinux
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
Super tux
n00b
n00b


Joined: 11 Oct 2018
Posts: 9

PostPosted: Thu Oct 11, 2018 8:20 pm    Post subject: Systemd SELinux Reply with quote

Hello, from what i understand it is not possible to install SELinux with systemd on Gentoo, is that correct?
And Gentoo Hardened project is stopped, correct?

Then if i want hardened system, i am forced to use openrc?
What are my options if i want selinux or hardened with systemd?
Back to top
View user's profile Send private message
1clue
Advocate
Advocate


Joined: 05 Feb 2006
Posts: 2549

PostPosted: Fri Oct 12, 2018 12:02 am    Post subject: Reply with quote

https://grsecurity.net/passing_the_baton.php

If you limit yourself to kernel 4.9 the patches still can be used.

There are still hardened profiles in Gentoo.
Code:
eselect profile list
will show you what they are. The key difference is that if you want a newer kernel than 4.9 then you must do without the kernel changes.

As I don't use systemd on gentoo I can't help you with that part.
Back to top
View user's profile Send private message
Super tux
n00b
n00b


Joined: 11 Oct 2018
Posts: 9

PostPosted: Mon Oct 15, 2018 7:47 pm    Post subject: Reply with quote

Ido not want lower kernel sources, i am on ~amd64 all the time ???? i am building box with seLinux.
Sad thing is, on strict policy i can not start kde plasma ????
The account is permission denied on alot of things like $ ls - /home
That is why plasma/xorg would not start, account can not read in home dir.
Account is in placed in different roles, and domains.

Root account can start plasma fine, do not run xorg as root.

On the targeted policy i can launch plasma as the regular non admin fine, however lightdm takes 30 seconde longer to load.

I want to know, the targeted policy can start x, strict policy not.
I allowed most of the AVC, and checked boolean with setsebool, idk,how the user account can start x on strict policy on gentoo seLinux by default in policy. So i can just have working X when rebuilding the packages.

Must be a boolean i have turned off?
I can post audit2allow -a later because right now the box is busy.
Back to top
View user's profile Send private message
1clue
Advocate
Advocate


Joined: 05 Feb 2006
Posts: 2549

PostPosted: Mon Oct 15, 2018 8:31 pm    Post subject: Reply with quote

My experience can't help you. I have never done selinux on an X-enabled system. I remember I had to do a huge amount of horsing around with it to get it to work even on a command line, but I can't remember what all that was and not sure it would still be the same hoops to jump through.

My SELinux went away when I finally decided that newer kernels were more important than SELinux features. So I'm way out of practice on that stuff now.
Back to top
View user's profile Send private message
Super tux
n00b
n00b


Joined: 11 Oct 2018
Posts: 9

PostPosted: Tue Oct 16, 2018 8:23 pm    Post subject: Reply with quote

Hey, did you know you can combine gentoo profiles so i combined plasma profile with selinux profile.
X works out of the box on targeted profile.

Actually pretty nice, fully blown plasma/xfce/seLinux system.

In the end i kinda had to pick openrc to use selinux, however since it is possible to combine profiles, it should be possible to combine systemd selinux.
Back to top
View user's profile Send private message
problemqd
n00b
n00b


Joined: 11 Nov 2018
Posts: 2

PostPosted: Sun Nov 11, 2018 3:08 pm    Post subject: xorg-server 1.20.3 need compile with USE "suid" Reply with quote

xorg-server 1.20.3 need compile with USE "suid"
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 13867

PostPosted: Sun Nov 11, 2018 5:34 pm    Post subject: Re: xorg-server 1.20.3 need compile with USE "suid" Reply with quote

problemqd wrote:
xorg-server 1.20.3 need compile with USE "suid"
This is not relevant to the problem in this thread. Additionally, it is not correct in all cases.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum