Linux Kernel Module Cheat

17.14.2.1. SELinux

TODO get a hello world permission control working:

./build-linux \
  --config-fragment linux_config/selinux \
  --linux-build-id selinux \
;
./build-buildroot --config 'BR2_PACKAGE_REFPOLICY=y'
./run --enable-kvm --linux-build-id selinux

Source: linux_config/selinux

This builds:

BR2_PACKAGE_REFPOLICY, which includes a reference /etc/selinux/config policy: https://github.com/SELinuxProject/refpolicy

refpolicy in turn depends on:
BR2_PACKAGE_SETOOLS, which contains tools such as getenforced: https://github.com/SELinuxProject/setools

setools depends on:
BR2_PACKAGE_LIBSELINUX, which is the backing userland library

After boot finishes, we see:

Starting auditd: mkdir: invalid option -- 'Z'

which comes from /etc/init.d/S01auditd, because BusyBox' mkdir does not have the crazy -Z option like Ubuntu. That’s amazing!

The kernel logs contain:

SELinux:  Initializing.

Inside the guest we now have:

getenforce

which initially says:

Disabled

TODO: if we try to enforce:

setenforce 1

it does not work and outputs:

setenforce: SELinux is disabled

SELinux requires glibc as mentioned at: Section 26.10, “libc choice”.