☰

如何编译和应用 SELinux 策略

tag-icon • tag-icon fedora selinux
如何编译和应用 SELinux 策略

我是学生。我想使用从源代码编译的策略。
编译策略后，出现如下错误提示。
请告诉我如何编译和应用 SELinux 策略。

systemd[1]: Unable to fix SELinux security context of /run/systemd/journal/dev-log: Permission denied
systemd[1]: Unable to fix SELinux security context of /run/systemd/journal/socket: Permission denied
:
systemd-journald[529]: Faild to open /run/systemd/journal/kernelseqnum, ignoring: Permission denied
:

audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
:

我执行的程序如下所示。

Fedora 26 (linux4.11.8-300)
1)  yumdownloader --source selinux-policy
2)  rpm -ivh selinux-policy-3.13.1-260.8.fc26.src.rpm
3)  rpmbuild -bi ~/rpmbuild/SPEC/selinux-policy.spec --define "BUILD_STRICT 0" --define "BUILD_MLS 0"
4)  cd ~/rpmbuild/BUILD/selinux-3.13.1/
5)  vi build.conf
 ----
 TYPE = mcs
 NAME = test
 DISTRO = redhat
 UNK_PERMS = allow
 DIRECT_INITRC = y
 MONOLITHIC = n
 UBAC = n
 CUSTOM_BUILDOPT =
 MLS_SENS = 16
 MLS_CATS = 1024
 MCS_CATS = 1024
 QUIET = n
 ----
6)  make install-src
7)  cd /etc/selinux/test/src/policy
8)  make load
9)  touch /.autorelabel
10) edit /etc/selinux/config file
11) reboot
12) "audit:backlog limit exceeded" continues to be outputted

我增加了缓冲区大小，但它没有改变。

/etc/audit/audit.rules
# Set buffer size
-b 8192

答案1

就我在这里所看到的，您实际上没有编译和安装该策略。

为了编制政策，我会这样做：

  1. yumdownloader --source selinux-policy
  2. rpm -ivh selinux-policy-3.13.1-260.8.fc26.src.rpm
  3. rpm构建-bp~/rpmbuild/SPEC/selinux-policy.spec --define "BUILD_STRICT 0" --define "BUILD_MLS 0" #用 Fedora 补丁来修补代码
  4. cd ~/rpmbuild/BUILD/selinux-3.13.1/
  5. vi 构建.conf TYPE = mcs NAME = test DISTRO = redhat UNK_PERMS = allow DIRECT_INITRC = y MONOLITHIC = n UBAC = n CUSTOM_BUILDOPT = MLS_SENS = 16 MLS_CATS = 1024 MCS_CATS = 1024 QUIET = n
  6. 进行配置
  7. 制作
  8. make install 安装头文件
  9. 使负载
  10. touch /.autorelabel
  11. 编辑 /etc/selinux/config 文件
  12. 重启

相关内容