SELinux workgroup: Difference between revisions
imported>Etbe No edit summary |
imported>Etbe No edit summary |
||
| Line 7: | Line 7: | ||
== Config == | == Config == | ||
# tell kernel to use SE Linux | # tell kernel to use SE Linux | ||
boot.kernelParams = [ "security=selinux" ]; | boot.kernelParams = [ "security=selinux" ]; | ||
# compile kernel with SE Linux support - but also support for other LSM modules | # compile kernel with SE Linux support - but also support for other LSM modules | ||
boot.kernelPatches = [ { | boot.kernelPatches = [ { | ||
name = "selinux-config"; | name = "selinux-config"; | ||
| Line 23: | Line 23: | ||
''; | ''; | ||
} ]; | } ]; | ||
# policycoreutils is for load_policy, fixfiles, setfiles, setsebool, semodile, and sestatus. | # policycoreutils is for load_policy, fixfiles, setfiles, setsebool, semodile, and sestatus. | ||
environment.systemPackages = with pkgs; [ policycoreutils ]; | environment.systemPackages = with pkgs; [ policycoreutils ]; | ||
# build systemd with SE Linux support so it loads policy at boot and supports file labelling | # build systemd with SE Linux support so it loads policy at boot and supports file labelling | ||
systemd.package = pkgs.systemd.override { withSelinux = true; }; | systemd.package = pkgs.systemd.override { withSelinux = true; }; | ||