Hi, On Tue, Nov 03, 2009 at 04:18:18PM -0500, Mathias Gug wrote: > On Tue, Nov 3, 2009 at 3:26 PM, Stephen Gallagher <[email protected]> wrote: > >> The karmic control file doesn't list libselinux1-dev [2] as a build > >> dependency. Could this be the root cause of the failed build? > > > > Well, if SELinux isn't installed on Ubuntu by default (and would > > conflict with a package that is) we don't want to make this a build > > dependency. > > > > libselinux is installed by default since a lot of tools are already > linked against it. > > >> We could enable selinux during the build process (by adding > >> libselinux1-dev as a build dependency). Do the tools work correctly if > >> the system is not configured with selinux (the default in Ubuntu)? > >> > > > > The tools do not do any runtime detection of SELinux functionality. If > > they are compiled with SELinux support, they will require it at runtime. > > So if the default case on Ubuntu is not to have SELinux, then you need > > to build with --without-selinux. > > > > > > If you know of a way to perform runtime SELinux detection, I'm all ears. > > It seems that the selinux libary is able to do that. So there is no > harm linking against libselinux in Ubuntu. I've CC'ed Kees Cook, one > of our security expert - he will be able to provide more details about > SELinux support in Ubuntu if needed.
The SELinux user-space exists in Ubuntu. The only thing that isn't "by default" in Ubuntu is having SELinux enabled at boot by the kernel (this can be changed at boot-time). Everything that is needed should be there to support SELinux. If it isn't I would consider it a bug. I'm not an SELinux expert, but my understanding is that SELinux can be detected by the userspace libraries, and they generally gracefully fall back. Perhaps ask on the ubuntu-hardened mailing list, if you require specific features? -Kees [1] https://lists.ubuntu.com/mailman/listinfo/ubuntu-hardened -- Kees Cook Ubuntu Security Team _______________________________________________ sssd-devel mailing list [email protected] https://fedorahosted.org/mailman/listinfo/sssd-devel
