mjhjmtu

I'm student. I want to use the policy compiled from the source code.

After compiling the policy, the following error statement is displayed.

Please tell me how to compile and apply SELinux policy.

systemd[1]: Unable to fix SELinux security context of /run/systemd/journal/dev-log: Permission denied
systemd[1]: Unable to fix SELinux security context of /run/systemd/journal/socket: Permission denied
:
systemd-journald[529]: Faild to open /run/systemd/journal/kernelseqnum, ignoring: Permission denied
:

audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
audit: backlog limit exceeded
:

The procedure I did is shown below.

Fedora 26 (linux4.11.8-300)
1) yumdownloader --source selinux-policy
2) rpm -ivh selinux-policy-3.13.1-260.8.fc26.src.rpm
3) rpmbuild -bi ~/rpmbuild/SPEC/selinux-policy.spec --define "BUILD_STRICT 0" --define "BUILD_MLS 0"
4) cd ~/rpmbuild/BUILD/selinux-3.13.1/
5) vi build.conf
 ----
 TYPE = mcs
 NAME = test
 DISTRO = redhat
 UNK_PERMS = allow
 DIRECT_INITRC = y
 MONOLITHIC = n
 UBAC = n
 CUSTOM_BUILDOPT =
 MLS_SENS = 16
 MLS_CATS = 1024
 MCS_CATS = 1024
 QUIET = n
 ----
6) make install-src
7) cd /etc/selinux/test/src/policy
8) make load
9) touch /.autorelabel
10) edit /etc/selinux/config file
11) reboot
12) "audit:backlog limit exceeded" continues to be outputted

I increased the buffer size but it did not change.

/etc/audit/audit.rules
# Set buffer size
-b 8192

For what I can see here you are actually not compiling and installing the policy.

To compile the policy, I would do:

1. yumdownloader --source selinux-policy


2. rpm -ivh selinux-policy-3.13.1-260.8.fc26.src.rpm


3. rpmbuild -bp ~/rpmbuild/SPEC/selinux-policy.spec --define "BUILD_STRICT 0" --define "BUILD_MLS 0" #this patch the code with fedora patches


4. cd ~/rpmbuild/BUILD/selinux-3.13.1/


5. vi build.conf
   
TYPE = mcs
NAME = test
DISTRO = redhat
UNK_PERMS = allow
DIRECT_INITRC = y
MONOLITHIC = n
UBAC = n
CUSTOM_BUILDOPT =
MLS_SENS = 16
MLS_CATS = 1024
MCS_CATS = 1024
QUIET = n

   


6. make config


7. make


8. make install install-headers


9. make load


10. touch /.autorelabel


11. edit /etc/selinux/config file


12. reboot