0

I'm using Ubuntu 12.04.5. When i try to execute below commands i'm getting following erros. Any help is greately appreciated.

sudo apt-get install selinux selinux-policy

Package 'selinux' has no installation candidate
Unable to locate package selinux-policy

I don't find any file or folder for selinux under /etc/. I executed

sudo apt-get install policycoreutils but there also i get error as selinux-policy-default but it is not installable. Unable to correct problems, you have held broker packages

Yaron
  • 13,173
jks
  • 1
  • 1
  • 1
  • can you post the output of cat /etc/apt/sources.list – Olimjon Oct 30 '17 at 15:12
  • First, 12.04 is beyond end of life. Second, selinux has never been well maintained on Ubuntu, Ubuntu uses apparmor. I highly suggest you upgrade or do a fresh install of a supported release and learn to use apparmor. If you want to use selinux go to a .rpm system such as Centos, RHEL, or Fedora. – Panther Oct 30 '17 at 15:46
  • @Dan - Although that is good advice, it will not work in the case of selinux as selinux in the ubuntu repositories is broken and unsupported. One must use the Debian repos and pinning. – Panther Oct 30 '17 at 16:09
  • I am voting to close as the question is too broad. Selinux is not well supported , if at all, on Ubuntu and is complex as it likely involves pinning with the Debian repos . I did give a broad answer based on the Ubuntu and Debian wikis, but I have not personally tested selinux on Ubuntu and do not know anyone who has successfully maintained selinux on Ubuntu. I am told it works well on Debian Servers (no Desktop). – Panther Oct 30 '17 at 16:24

1 Answers1

1

From https://wiki.ubuntu.com/SELinux

Warning

The Ubuntu-specific "selinux" and "selinux-policy-ubuntu" packages documented here have not received much attention since Karmic, and appear to be effectively broken in Precise.

If you wish to use SELinux in Ubuntu, the "selinux-basics" and "selinux-policy-default" packages from Debian are still being actively maintained. Documentation relevant to those packages can be found at http://wiki.debian.org/SELinux

There are selinux packages in Ubuntu you certainly can try, however, as they are poorly supported, undocumented, and I would not expect them to work out of the box. More likely than not they are the same packages as are available in the Debian repos, but they may have been modified for Ubuntu, and certainly worth a try before you go to pinning. Use the advice on the Debian selinux wiki page without the debian repos first.

If the Ubuntu packages fail, you may then wish to then try the advice of the Ubuntu selinux wiki page and install / configure selinux using the Debian packages, see ... https://wiki.debian.org/SELinux

You go to the Debian setup page - https://wiki.debian.org/SELinux/Setup

Get the default policy and the basic set of SELinux utilities by running apt-get install selinux-basics selinux-policy-default auditd

Note, you would have to install them from the appropriate debian repositories or download the .deb. To do so you will have to add the debian repositories, and use pinning.

Here is a listing of versions of Ubuntu and Debian you can use for pinning.

What Debian version are the different Ubuntu versions based on?

https://help.ubuntu.com/community/PinningHowto

Also note, from the same Debian page:

If using Ubuntu, download this _load_selinux_policy script (this is a slightly modified version of the script included in the Ubuntu 'selinux' package), place it in /usr/share/initramfs-tools/scripts/init-bottom/ then run update-initramfs -u (Upstart in Debian loads the SELinux policy automatically, but Upstart in Ubuntu does not. See https://bugs.launchpad.net/upstart/+bug/595774)

The bug may or may not be fixed https://bugs.launchpad.net/upstart/+bug/595774 (marked as fix released).

Then continue with

Run selinux-activate to configure GRUB and PAM and to create /.autorelabel

Reboot, it will take a while to label the filesystems on boot and then it will automatically reboot a second time when that is complete.

Run check-selinux-installation to check that everything has been setup correctly and to catch common SELinux problems. (Note: in wheezy the warning about /etc/pam.d/login is a false positive)

Also from https://wiki.debian.org/SELinux/Issues

Graphical/Desktop installs of Debian are not heavily tested with selinux, so you might run into quite some issues.

Assuming you are NOT RUNNING a graphical desktop you may do alright. If you are running a graphical desktop, expect problems. Debugging selinux policy on Ubuntu will be poorly supported at best.

Also see outstanding bugs before you install selinux - https://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=refpolicy

Also I would anticipate problems due to differences between Ubuntu and Debian, depending on versions of each, systemd, upstart, and MIR may all conflict or not have a selinux policy from Debian.

Good luck with all that =) I personally know only one person who was able to use selinux successfully on Ubuntu, and it was a short run.

Parting advice

  • Ubuntu uses Apparmor and I highly advise you continue with apparmor and NOT go with selinux.

  • If you wish to go to selinux on Ubuntu, do so on a test machine first and expect problems.

  • If you are not familiar with selinux and debugging policy, you will likely need to do a lot of reading. Both RHEL selinux and Fedora selinux maintain documentation you can use as a reference.

  • If you must use selinux I HIGHLY ADVISE you use a .rpm system such as Centos, RHEL, or Fedora.

Panther
  • 102,067