I'm trying to reduce the number of sensitivities from 16 to 5 (s0 - s4)
Looks like I can redefine the number of sensitivities in the build.conf file and Makefile file and then use "make load" to make the change take effect. Is that correct?
I assume that I'll need to use fixfiles to relabel any files that have contexts with sensitivity levels greater than s4. Is that correct?
Before reducing the number of sensitivities, I wanted to reconfigure the users and login using semanage. I've defined SystemHigh to be s4:c0.c255 in the setrans.conf file. This is what "semanage user -l" returns:
# semanage user -l
Labeling MLS/ MLS/ SELinux User Prefix MCS Level MCS Range SELinux Roles
m2_u user SystemLow SystemLow-s15:c0.c255 system_r user_r root user SystemLow SystemLow-s15:c0.c255 system_r sysadm_r user_r system_u user SystemLow SystemLow-s15:c0.c255 system_r user_u user SystemLow SystemLow-s15:c0.c255 system_r user_r
I can change both the m2_u and user_u users to have a range of SystemLow-SystemHigh, but only in permissive mode. If in enforcing mode, I get the following error:
# semanage user -m -r SystemLow-SystemHigh user_u libsepol.mls_from_string: invalid MLS context SystemLow-SystemHigh libsepol.mls_from_string: could not construct mls context structure libsepol.sepol_user_modify: could not load (null) into policy libsemanage.dbase_policydb_modify: could not modify record value libsemanage.semanage_base_merge_components: could not merge local modifications into policy /usr/sbin/semanage: Could not modify SELinux user user_u
Even in permissive mode I can not change the root or system_u users. In permissive mode I get the following error message:
# semanage user -m -r SystemLow-SystemHigh system_u libsepol.context_read_and_validate: invalid security context libsepol.policydb_from_image: policy image is invalid /usr/sbin/load_policy: Can't load policy: Invalid argument libsemanage.semanage_reload_policy: load_policy returned error code 2. /usr/sbin/semanage: Could not modify SELinux user system_u
"policy image is invalid" sounds particularly bad
I'm running as Linux user root and SELinux user root. Here is an output of id:
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),101(pkcs 11) context=root:system_r:unconfined_t:SystemLow-s15:c0.c255
Can anyone help with what I need to do?
Thanks