SELinux workgroup - Revision history

DoggoBit at 18:06, 8 June 2025

2025-06-08T18:06:47Z

← Older revision		Revision as of 18:06, 8 June 2025
Line 1:		Line 1:
			{{delete\|reason=Working group may no longer be active. Last substantial page edit before import.}}

	== Selinux ==		== Selinux ==

DoggoBit: DoggoBit moved page Workgroup:SELinux to SELinux workgroup: We shouldn't be using "namespace-looking" page titles.

2025-06-08T17:54:35Z

DoggoBit moved page Workgroup:SELinux to SELinux workgroup: We shouldn't be using "namespace-looking" page titles.

← Older revision		Revision as of 17:54, 8 June 2025
(No difference)

imported>Vieta: style

2023-12-12T08:27:08Z

style

← Older revision		Revision as of 08:27, 12 December 2023
Line 1:		Line 1:
	~~This group is about adding SE Linux support to NixOS both booting and when run on a system like Debian or Fedora with SE Linux support.~~		== Selinux ==

	~~== People ==~~		Security-Enhanced Linux (SELinux) is a security architecture for Linux® systems that allows administrators to have more control over who can access the system. It was originally developed by the United States National Security Agency (NSA) as a series of patches to the Linux kernel using Linux Security Modules (LSM).

	* [[User:etbe\|etbe]]		==== Config Sample ====

	=~~= Config ==~~		<syntaxHighlight lang="nix">

	~~# tell kernel to use SE Linux~~		boot.kernelParams = [ "security=selinux" ];
	boot.kernelParams = [ "security=selinux" ];		# compile kernel with SELinux support - but also support for other LSM modules
	# compile kernel with ~~SE Linux~~ support - but also support for other LSM modules		boot.kernelPatches = [ {
	boot.kernelPatches = [ {
	name = "selinux-config";		name = "selinux-config";
	patch = null;		patch = null;
Line 25:		Line 24:
	# policycoreutils is for load_policy, fixfiles, setfiles, setsebool, semodile, and sestatus.		# policycoreutils is for load_policy, fixfiles, setfiles, setsebool, semodile, and sestatus.
	environment.systemPackages = with pkgs; [ policycoreutils ];		environment.systemPackages = with pkgs; [ policycoreutils ];
	# build systemd with ~~SE Linux~~ support so it loads policy at boot and supports file labelling		# build systemd with SELinux support so it loads policy at boot and supports file labelling
	systemd.package = pkgs.systemd.override { withSelinux = true; };		systemd.package = pkgs.systemd.override { withSelinux = true; };
			</syntaxHighlight>

	== Links ==		==== Links ====

			* [https://www.redhat.com/de/topics/linux/what-is-selinux RHEL overview to SElinux]
			* [https://wiki.archlinux.org/title/SELinux Archwiki to SElinux]
	* [https://lore.kernel.org/selinux/7853167.K65cXu0y11@neuromancer/T/#u Proposed patch for subst file-contexts], this maps /nix/store/* directories to / for file labelling (both initial system labelling and dynamic labelling of new files).		* [https://lore.kernel.org/selinux/7853167.K65cXu0y11@neuromancer/T/#u Proposed patch for subst file-contexts], this maps /nix/store/* directories to / for file labelling (both initial system labelling and dynamic labelling of new files).
	* [https://github.com/NixOS/nix/pull/2670 GitHub page for e-user's changes adding ~~SE Linux~~ support to NixOS].		* [https://github.com/NixOS/nix/pull/2670 GitHub page for e-user's changes adding SELinux support to NixOS].

imported>Etbe at 03:40, 27 February 2019

2019-02-27T03:40:23Z

← Older revision		Revision as of 03:40, 27 February 2019
Line 7:		Line 7:
	== Config ==		== Config ==

	# tell kernel to use SE Linux		# tell kernel to use SE Linux
	boot.kernelParams = [ "security=selinux" ];		boot.kernelParams = [ "security=selinux" ];
	# compile kernel with SE Linux support - but also support for other LSM modules		# compile kernel with SE Linux support - but also support for other LSM modules
	boot.kernelPatches = [ {		boot.kernelPatches = [ {
	name = "selinux-config";		name = "selinux-config";
Line 23:		Line 23:
	'';		'';
	} ];		} ];
	# policycoreutils is for load_policy, fixfiles, setfiles, setsebool, semodile, and sestatus.		# policycoreutils is for load_policy, fixfiles, setfiles, setsebool, semodile, and sestatus.
	environment.systemPackages = with pkgs; [ policycoreutils ];		environment.systemPackages = with pkgs; [ policycoreutils ];
	# build systemd with SE Linux support so it loads policy at boot and supports file labelling		# build systemd with SE Linux support so it loads policy at boot and supports file labelling
	systemd.package = pkgs.systemd.override { withSelinux = true; };		systemd.package = pkgs.systemd.override { withSelinux = true; };

imported>Etbe at 03:36, 27 February 2019

2019-02-27T03:36:46Z

← Older revision		Revision as of 03:36, 27 February 2019
Line 7:		Line 7:
	== Config ==		== Config ==

	boot.kernelParams = [ "security=selinux ~~selinux=1~~" ];		# tell kernel to use SE Linux
	# ~~not yet tested the~~ kernel ~~config~~		boot.kernelParams = [ "security=selinux" ];
			# compile kernel with SE Linux support - but also support for other LSM modules
	boot.kernelPatches = [ {		boot.kernelPatches = [ {
	name = "selinux-config";		name = "selinux-config";
Line 19:		Line 20:
	SECURITY_SELINUX_AVC_STATS y		SECURITY_SELINUX_AVC_STATS y
	SECURITY_SELINUX_CHECKREQPROT_VALUE 0		SECURITY_SELINUX_CHECKREQPROT_VALUE 0
			DEFAULT_SECURITY_SELINUX n
	'';		'';
	} ];		} ];
			# policycoreutils is for load_policy, fixfiles, setfiles, setsebool, semodile, and sestatus.
	environment.systemPackages = with pkgs; [ policycoreutils ];		environment.systemPackages = with pkgs; [ policycoreutils ];
			# build systemd with SE Linux support so it loads policy at boot and supports file labelling
	systemd.package = pkgs.systemd.override { withSelinux = true; };		systemd.package = pkgs.systemd.override { withSelinux = true; };

imported>Etbe at 01:14, 26 February 2019

2019-02-26T01:14:07Z

← Older revision		Revision as of 01:14, 26 February 2019
Line 14:		Line 14:
	extraConfig = ''		extraConfig = ''
	SECURITY_SELINUX y		SECURITY_SELINUX y
			SECURITY_SELINUX_BOOTPARAM n
			SECURITY_SELINUX_DISABLE n
	SECURITY_SELINUX_DEVELOP y		SECURITY_SELINUX_DEVELOP y
	SECURITY_SELINUX_AVC_STATS y		SECURITY_SELINUX_AVC_STATS y
Line 21:		Line 23:

	environment.systemPackages = with pkgs; [ policycoreutils ];		environment.systemPackages = with pkgs; [ policycoreutils ];
			systemd.package = pkgs.systemd.override { withSelinux = true; };

	== Links ==		== Links ==

imported>Etbe at 10:48, 25 February 2019

2019-02-25T10:48:25Z

← Older revision		Revision as of 10:48, 25 February 2019
Line 7:		Line 7:
	== Config ==		== Config ==

	boot.kernelParams = [ "security=selinux" ];		boot.kernelParams = [ "security=selinux selinux=1" ];
	# not yet tested the kernel config		# not yet tested the kernel config
	boot.kernelPatches = [ {		boot.kernelPatches = [ {
Line 19:		Line 19:
	'';		'';
	} ];		} ];

			environment.systemPackages = with pkgs; [ policycoreutils ];

	== Links ==		== Links ==

imported>Etbe at 03:58, 25 February 2019

2019-02-25T03:58:53Z

← Older revision		Revision as of 03:58, 25 February 2019
Line 8:		Line 8:

	boot.kernelParams = [ "security=selinux" ];		boot.kernelParams = [ "security=selinux" ];
	# not yet tested the kernel config		# not yet tested the kernel config
	boot.kernelPatches = [ {		boot.kernelPatches = [ {
	name = "selinux-config";		name = "selinux-config";
Line 19:		Line 19:
	'';		'';
	} ];		} ];

			== Links ==

			* [https://lore.kernel.org/selinux/7853167.K65cXu0y11@neuromancer/T/#u Proposed patch for subst file-contexts], this maps /nix/store/* directories to / for file labelling (both initial system labelling and dynamic labelling of new files).
			* [https://github.com/NixOS/nix/pull/2670 GitHub page for e-user's changes adding SE Linux support to NixOS].

imported>Etbe at 03:52, 25 February 2019

2019-02-25T03:52:14Z

← Older revision		Revision as of 03:52, 25 February 2019
Line 7:		Line 7:
	== Config ==		== Config ==

			boot.kernelParams = [ "security=selinux" ];
			# not yet tested the kernel config
	boot.kernelPatches = [ {		boot.kernelPatches = [ {
	name = "~~crashdump~~-config";		name = "selinux-config";
	patch = null;		patch = null;
	extraConfig = ''		extraConfig = ''

imported>Etbe: Created page with "This group is about adding SE Linux support to NixOS both booting and when run on a system like Debian or Fedora with SE Linux support. == People == * etbe ==..."

2019-02-25T03:47:51Z

Created page with "This group is about adding SE Linux support to NixOS both booting and when run on a system like Debian or Fedora with SE Linux support. == People == * etbe ==..."

New page

This group is about adding SE Linux support to NixOS both booting and when run on a system like Debian or Fedora with SE Linux support.

== People ==

* [[User:etbe|etbe]]

== Config ==

boot.kernelPatches = [ {
name = "crashdump-config";
patch = null;
extraConfig = ''
SECURITY_SELINUX y
SECURITY_SELINUX_DEVELOP y
SECURITY_SELINUX_AVC_STATS y
SECURITY_SELINUX_CHECKREQPROT_VALUE 0
'';
} ];