10

I installed SELINUX on ubuntu using the command:

sudo apt-get install selinux

config file in /etc/selinux contain following information

SELINUX=permissive

SELINUXTYPE=default

SETLOCALDEFS=0

But i am not able to set selinux, when I check using sestatus -v command it gives output

SELINUX is disabled

How should I enable my SELINUX?

When I use command seinfo. it gives following output

ERROR: policydb version 26 does not match my version range 15-24
ERROR: Unable to open policy /etc/selinux/default/policy/policy.26.
ERROR: Input/output error

check-selinux-installation command gives following output ../proc/1 kernel..

SELinux is not enabled. The init process (PID 1) is running in an incorrect domain. /etc/pam.d/login is not SELinux enabled FSCKFIX is not enabled - not serious, but could prevent system from booting... udev will create nodes not labeled correctly

Please help

3
  • check-selinux-installation command gives following output ../proc/1 kernel.. SELinux is not enabled. The init process (PID 1) is running in an incorrect domain. /etc/pam.d/login is not SELinux enabled FSCKFIX is not enabled - not serious, but could prevent system from booting... udev will create nodes not labeled correctly
    – user282924
    May 18, 2014 at 19:44
  • Have you rebooted the machine after installing SELinux ?
    – cioby23
    May 18, 2014 at 19:56
  • May be this problem possible because in Debian Jessie there not exist a selinux-policy-default?
    – kinunt
    Jul 5, 2017 at 16:20

2 Answers 2

4

This error might be because you are running AppArmor along with SELinux. AppArmor is installed by default in Ubuntu. You can't use 2 LSM (Linux security modules) at the same time. You need to remove AppArmor if you wish yo use SELinux

See an aswer here: Is it a bad idea to run SELinux and AppArmor at the same time?

5
  • Thanks after I unstalled apparmor I was able to enable selinux and reboot my system. But now probelm, I downloaded the code from ref policy code from below site. oss.tresys.com/projects/refpolicy/wiki/UseRefpolicy And after I built policy code (as mentioned on site). I changed my config file to as below : SELINUX=enforcing SELINUXTYPE=refpolicy Again I was not able to reboot my system.Please help
    – user282924
    May 26, 2014 at 11:01
  • check-selinux-installation gives following error getfilecon: getfilecon(/proc/1) failed SELinux is not enabled. Could not read the domain of PID 1. /etc/pam.d/login is not SELinux enabled FSCKFIX is not enabled - not serious, but could prevent system from booting... udev will create nodes not labeled correctly
    – user282924
    May 26, 2014 at 18:49
  • Check sestatus if it returns enabled then it's working fine. Also enter the command grep FSC /etc/default/rcS If it returns #FSCKFIX=no then use gedit or any other editing tool to edit the rcS file uncomment the line and set it to yes (like this FSCKFIX=yes) then save and exit gedit. After editing the file re-enter the command grep FSC /etc/default/rcS should return FSCKFIX=yes if the command check-selinux-installation returns just /etc/pam.d/login is not SELinux enabled then it's fine and the above return is a false positive.
    – cioby23
    May 27, 2014 at 6:34
  • FSCKFIX probelm is fixed. now when I run check-selinux-installation command. It gives following error. .. /proc/1 kernel... The init process (PID 1) is running in an incorrect domain. I am not able to enable SELINUX(I installed 3.9 kernel also). Please help.
    – user282924
    Jun 8, 2014 at 10:34
  • There is one more probelm that /selinux folder is empty. How can I get it contents back as without it i can get my system booted once I enable SELINUX. Please help
    – user282924
    Jun 15, 2014 at 19:13
2

An absurdly old question, but it helped me track my problem down partially, so I'm adding another response.

Not only do you need to remove AppArmor like cioby23 says, but there are some extra steps received from the upstream Debian that aren't well documented at all. Here are the commands to convert a standard Ubuntu system (16.04.6 for me) to use SELinux in Permissive mode using the standard provided packages:

# make sure you have the most up-to-date info
apt-get update
apt-get dist-upgrade

#disable and remove apparmor
/etc/init.d/apparmor stop
apt-get remove apparmor

#install SELinux
apt-get install selinux

# install the missing dependency
apt-get install auditd

# install the activate tool required to make it work
apt-get install selinux-basics

#missing manual step to actually make SELinux work (part of selinux-basics)
selinux-activate

# need to restart for it to take effect
shutdown now

Personally I discovered that the selinux-activate has to be run manually from a discussion on the upstream Debian (https://unix.stackexchange.com/questions/136988/whats-missing-with-my-selinux-installation).
It solved the exact problem of the wrong context on PID 1, which also presents as a getfilecon error.

EDIT1: Update language to avoid confusion on policy naming.
EDIT2: Split up the commands with better descriptions for each

1
  • Does selinux work ok on debian-based distros? I tend to stick with the default MACs, but I'm not sure if this is only a prejudice or if there's actually some object reason behind it. For instance here they say it is (still) experimental for Ubuntu: linuxconfig.org/…
    – Lethargos
    Dec 15, 2021 at 22:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .