Here are the patches I used last time I tried to get MLS going on Debian.
Index: refpolicy-2.20180701/policy/modules/kernel/kernel.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/kernel/kernel.te
+++ refpolicy-2.20180701/policy/modules/kernel/kernel.te
@@ -39,6 +39,7 @@ role unconfined_r;
ifdef(`enable_mls',`
role secadm_r;
role auditadm_r;
+ mls_process_set_level(kernel_t)
')
#
Index: refpolicy-2.20180701/policy/modules/system/systemd.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
+++ refpolicy-2.20180701/policy/modules/system/systemd.te
@@ -251,7 +251,13 @@ systemd_log_parse_environment(systemd_gp
allow systemd_cgroups_t self:capability net_admin;
-kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
+ifdef(`enable_mls',`
+ kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
+ mls_fd_use_all_levels(systemd_cgroups_t)
+',`
+ kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
+')
+
kernel_dgram_send(systemd_cgroups_t)
# for /proc/cmdline
kernel_read_system_state(systemd_cgroups_t)
Index: refpolicy-2.20180701/policy/modules/system/init.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/init.te
+++ refpolicy-2.20180701/policy/modules/system/init.te
@@ -191,6 +191,7 @@ mls_file_read_all_levels(init_t)
mls_file_write_all_levels(init_t)
mls_process_write_all_levels(init_t)
mls_fd_use_all_levels(init_t)
+mls_process_set_level(init_t)
# the following one is needed for libselinux:is_selinux_enabled()
# otherwise the call fails and sysvinit tries to load the policy
@@ -384,6 +385,8 @@ ifdef(`init_systemd',`
# systemd_socket_activated policy
mls_socket_write_all_levels(init_t)
+ # read from systemd-journal and similar
+ mls_socket_read_to_clearance(init_t)
selinux_unmount_fs(init_t)
selinux_validate_context(init_t)
Index: refpolicy-2.20180701/policy/modules/system/logging.if
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/logging.if
+++ refpolicy-2.20180701/policy/modules/system/logging.if
@@ -422,6 +422,9 @@ interface(`logging_domtrans_syslog',`
corecmd_search_bin($1)
domtrans_pattern($1, syslogd_exec_t, syslogd_t)
+ ifdef(`enable_mls',`
+ range_transition $1 syslogd_exec_t:process mls_systemhigh;
+ ')
')
########################################
On 1/8/19 3:52 AM, Russell Coker wrote:
> Here are the patches I used last time I tried to get MLS going on Debian.
>
> Index: refpolicy-2.20180701/policy/modules/kernel/kernel.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/kernel/kernel.te
> +++ refpolicy-2.20180701/policy/modules/kernel/kernel.te
> @@ -39,6 +39,7 @@ role unconfined_r;
> ifdef(`enable_mls',`
> role secadm_r;
> role auditadm_r;
> + mls_process_set_level(kernel_t)
> ')
>
> #
> Index: refpolicy-2.20180701/policy/modules/system/systemd.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/systemd.te
> +++ refpolicy-2.20180701/policy/modules/system/systemd.te
> @@ -251,7 +251,13 @@ systemd_log_parse_environment(systemd_gp
>
> allow systemd_cgroups_t self:capability net_admin;
>
> -kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
> +ifdef(`enable_mls',`
> + kernel_ranged_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t, s0 - mls_systemhigh)
> + mls_fd_use_all_levels(systemd_cgroups_t)
> +',`
> + kernel_domtrans_to(systemd_cgroups_t, systemd_cgroups_exec_t)
> +')
> +
> kernel_dgram_send(systemd_cgroups_t)
> # for /proc/cmdline
> kernel_read_system_state(systemd_cgroups_t)
> Index: refpolicy-2.20180701/policy/modules/system/init.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/init.te
> +++ refpolicy-2.20180701/policy/modules/system/init.te
> @@ -191,6 +191,7 @@ mls_file_read_all_levels(init_t)
> mls_file_write_all_levels(init_t)
> mls_process_write_all_levels(init_t)
> mls_fd_use_all_levels(init_t)
> +mls_process_set_level(init_t)
>
> # the following one is needed for libselinux:is_selinux_enabled()
> # otherwise the call fails and sysvinit tries to load the policy
> @@ -384,6 +385,8 @@ ifdef(`init_systemd',`
>
> # systemd_socket_activated policy
> mls_socket_write_all_levels(init_t)
> + # read from systemd-journal and similar
> + mls_socket_read_to_clearance(init_t)
>
> selinux_unmount_fs(init_t)
> selinux_validate_context(init_t)
> Index: refpolicy-2.20180701/policy/modules/system/logging.if
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/system/logging.if
> +++ refpolicy-2.20180701/policy/modules/system/logging.if
> @@ -422,6 +422,9 @@ interface(`logging_domtrans_syslog',`
>
> corecmd_search_bin($1)
> domtrans_pattern($1, syslogd_exec_t, syslogd_t)
> + ifdef(`enable_mls',`
> + range_transition $1 syslogd_exec_t:process mls_systemhigh;
> + ')
> ')
>
> ########################################
>
Merged, though I changed the style a bit.
--
Chris PeBenito