On Ubuntu 20.10:
- disabled apparmor
- installed selinux*
- selinux-activate
- enforced in /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of these two values:
# default - equivalent to the old strict and targeted policies
# mls - Multi-Level Security (for military and educational use)
# src - Custom policy built from source
SELINUXTYPE=default
# SETLOCALDEFS= Check local definition changes
SETLOCALDEFS=0
reboot
brad@zika:/home/brad# sudo seinfo
Statistics for policy file: /etc/selinux/default/policy/policy.32
Policy Version: 32 (MLS enabled)
Target Policy: selinux
Handle unknown classes: allow
Classes: 131 Permissions: 423
Sensitivities: 1 Categories: 1024
Types: 3943 Attributes: 212
Users: 7 Roles: 15
Booleans: 300 Cond. Expr.: 331
Allow: 102134 Neverallow: 0
Auditallow: 22 Dontaudit: 16881
Type_trans: 8877 Type_change: 123
Type_member: 16 Range_trans: 33
Role allow: 32 Role_trans: 388
Constraints: 133 Validatetrans: 0
MLS Constrain: 57 MLS Val. Tran: 0
Permissives: 0 Polcap: 5
Defaults: 0 Typebounds: 0
Allowxperm: 0 Neverallowxperm: 0
Auditallowxperm: 0 Dontauditxperm: 0
Ibendportcon: 0 Ibpkeycon: 0
Initial SIDs: 27 Fs_use: 26
Genfscon: 92 Portcon: 475
Netifcon: 0 Nodecon: 0
but check-selinux-installation output reports 2 dirs missing:
check-selinux-installation
getfilecon: getfilecon(/proc/1) failed
SELinux is not enabled.
Could not read the domain of PID 1.
The directories /sys/fs/selinux and /selinux are missing.
Postfix init script is syncing the chroots.
Postfix has chrooted service in master.cf
/etc/default/grub
GRUB_CMDLINE_LINUX=" security=selinux"
and
update-grub
no relabelling noticed at boot and getenforce reports disabled .. What I did wrong?
Update: suddenly SELinux activated and works fine in permissive mode.
