[SSSD] [PATCH] need to link sssd with libselinux (on Ubuntu Karmic)

Kees Cook kees at ubuntu.com
Tue Nov 3 22:09:28 UTC 2009


Hi,

On Tue, Nov 03, 2009 at 04:18:18PM -0500, Mathias Gug wrote:
> On Tue, Nov 3, 2009 at 3:26 PM, Stephen Gallagher <sgallagh at redhat.com> wrote:
> >> The karmic control file doesn't list libselinux1-dev [2] as a build
> >> dependency. Could this be the root cause of the failed build?
> >
> > Well, if SELinux isn't installed on Ubuntu by default (and would
> > conflict with a package that is) we don't want to make this a build
> > dependency.
> >
> 
> libselinux is installed by default since a lot of tools are already
> linked against it.
> 
> >> We could enable selinux during the build process (by adding
> >> libselinux1-dev as a build dependency). Do the tools work correctly if
> >> the system is not configured with selinux (the default in Ubuntu)?
> >>
> >
> > The tools do not do any runtime detection of SELinux functionality. If
> > they are compiled with SELinux support, they will require it at runtime.
> > So if the default case on Ubuntu is not to have SELinux, then you need
> > to build with --without-selinux.
> >
> >
> > If you know of a way to perform runtime SELinux detection, I'm all ears.
> 
> It seems that the selinux libary is able to do that. So there is no
> harm linking against libselinux in Ubuntu. I've CC'ed Kees Cook, one
> of our security expert - he will be able to provide more details about
> SELinux support in Ubuntu if needed.

The SELinux user-space exists in Ubuntu.  The only thing that isn't "by
default" in Ubuntu is having SELinux enabled at boot by the kernel (this
can be changed at boot-time).  Everything that is needed should be there
to support SELinux.  If it isn't I would consider it a bug.

I'm not an SELinux expert, but my understanding is that SELinux can be
detected by the userspace libraries, and they generally gracefully fall
back.  Perhaps ask on the ubuntu-hardened mailing list, if you require
specific features?

-Kees

[1] https://lists.ubuntu.com/mailman/listinfo/ubuntu-hardened

-- 
Kees Cook
Ubuntu Security Team



More information about the sssd-devel mailing list