SELinux Trouble

[titan]

Okay, I've been struggling with this for several days, and I just can't find the information to solve my issue:

Code: Select all

atlas ~ # audit2allow -a -M local
Generating type enforcment file: local.te
Compiling policy
checkmodule  -m -o local.mod local.te
semodule_package -o local.pp -m local.mod

******************** IMPORTANT ***********************

In order to load this newly created policy package into the kernel,
you are required to execute

semodule -i local.pp


atlas ~ # semodule -i local.pp
libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_t policy_config_t:file { relabelto };
libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_t security_t:security { load_policy };
libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_t shadow_t:file { relabelto };
libsepol.check_assertion_helper: assertion on line 0 violated by allow staff_t shadow_t:file { write create };
libsepol.check_assertion_helper: assertion on line 0 violated by allow initrc_t shadow_t:file { read };
libsepol.check_assertions: 5 assertion violations occured
libsemanage.semanage_expand_sandbox: Expand module failed
semodule:  Failed!

All that's in there are things related to startup. And the errors aren't giving me any good clues.

[titan]

So, the problem still persists.

Is SELinux not used by anyone?

[bitvector]

Is SELinux not used by anyone?

SELinux is used by a lot of people -- in particular, most people who use RedHat-based distros (RHEL and Fedora). The vast majority of people do not, however, make their own policy files. That's much less common. Russell Coker, who does a lot of SELinux stuff on Debian, suggests asking in #selinux on Freenode IRC.

[titan]

Is SELinux not used by anyone?

SELinux is used by a lot of people -- in particular, most people who use RedHat-based distros (RHEL and Fedora). The vast majority of people do not, however, make their own policy files. That's much less common. Russell Coker, who does a lot of SELinux stuff on Debian, suggests asking in #selinux on Freenode IRC.

I'll give that a shot again. The last time I asked on that channel I had a deafening silence for a reply. And there we're other people talking on the channel.

I haven't started enforcing the policies yet, I'm just concerned that when I do I won't be able to run anything.