Change Profile

Change Profile SELinux is only supported on ext2/3, XFS, JFS, and Btrfs. Other filesystems lack the complete extended attribute support. Users should convert from a 2006.1 or newer profile otherwise there may be unpredictable results. As always, keep a LiveCD at hand in case things go wrong.

First switch your profile to the SELinux profile for your architecture:

# rm -f /etc/make.profile


x86 (server):
# ln -sf /usr/portage/profiles/selinux/v2refpolicy/x86/server /etc/make.profile
x86 (hardened):
# ln -sf /usr/portage/profiles/selinux/v2refpolicy/x86/hardened /etc/make.profile
AMD64:
# ln -sf /usr/portage/profiles/selinux/v2refpolicy/amd64/server /etc/make.profile
AMD64 (hardened):
# ln -sf /usr/portage/profiles/selinux/v2refpolicy/amd64/hardened /etc/make.profile

You can also switch profiles with eselect if you have the gentoolkit package installed. That method is not shown here because the specific options available and their numbering will vary according to your system configuration. Do not use any profiles other than the ones listed above, even if they seem to be out of date. SELinux profiles are not necessarily created as often as default Gentoo profiles. The SELinux profile has significanly fewer USE flags asserted than the default profile. Use emerge info to see if any use flags need to be reenabled in make.conf. It is not necessary to add selinux to your USE flags in make.conf. The SELinux profile already does this for you. You may encounter this message from portage: "!!! SELinux module not found. Please verify that it was installed." This is normal, and will be fixed later in the conversion process.

Update Kernel Headers

We will start by updating essential packages. First check which version of linux-headers is installed.

# emerge -s linux-headers
or if you have gentoolkit installed:
# equery list -i linux-headers

If the linux-headers version is older than 2.4.20, newer headers must be merged.

# emerge \>=sys-kernel/linux-headers-2.4.20

Update Glibc

If you have merged new headers, or you are unsure if your glibc was compiled with newer headers, you must recompile glibc.

# emerge glibc

This is a critical operation. Glibc must be compiled with newer linux-headers, otherwise some operations will malfunction.