Questions[selinux](ubuntu)

I am trying to configure selinux on ubuntu 20.04. I've used selinux on CentOS for some years. Im new to ubuntu. I installed with apt install policycoreutils selinux-utils selinux-basics, then apt install setools setools-gui

I set to permissive, and rebooted several times. But the /var/log/audit directory is not created, and no audit.log file is created anywhere. There are selinux messages in kern.log. I can use audit2why and audit2allow -i /var/log/kern.org to see what would be denied. But the audit files are used by many scripts and tools.

What can I to to get selinux to write the audit files on ubuntu?

I am facing a tricky problem with LD_LIBRARY_PATH in python3.8 on Ubuntu 20.04.1.

When I execute with my user the following lines:

user@host>export LD_LIBRARY_PATH=/usr/lib
user@host>echo $LD_LIBRARY_PATH
/usr/lib
user@host>python -c 'import os;print(os.getenv("LD_LIBRARY_PATH"))'
None

Python is not able to access LD_LIBRARY_PATH (please note that other variables are accessible as usual).

When I execute with root the same:

root@host>export LD_LIBRARY_PATH=/usr/lib
root@host>echo $LD_LIBRARY_PATH
/usr/lib
root@host>python -c 'import os;print(os.getenv("LD_LIBRARY_PATH"))'
/usr/lib

it works flawlessly. I therefore suspect it is a safety configuration, I already tried:

1. AppArmor (from this thread on opensuse forum) : on my system there is no profile for python defined (aa-status does not show python, even when ps aux | grep python yields various running instances). There is however an abstraction defined in /etc/apparmor.d/abstractions/python which is included in lsb_release and usr.bin.firefox profiles. But neither of them should compromise the Python execution. The usual guides of creating a symlink in /etc/apparmor.d/disable do not work since there is no profile for python which I could disable.
2. SELINUX (see the comment stackoverflow thread): on my system there does neither /etc/selinux/config nor sestatus exist. So I assume it is disabled, although the folder and some packages are installed. To be sure I executed setfacl -b /usr/bin/python3.8 (see this thread on superuser) without any change.

Any sort of hint e.g. to other security flags / settings / out-of-the-box solutions (which do not include reinstalling the system from scratch) would be highly appreciated, since I spent already 1 entire day on this.

Some optional Background

I need to compile a rosnode running a python script, which includes C++ code with pybind11, which on the C++ side dynamically loads libraries available in the folders specified in LD_LIBRARY_PATH. When manually executing the lines shared above with a conda interpreter ~/anaconda3/envs/myenv/bin/python it correctly sees the library path, so it seems to be bounded to the executable in /usr/bin. However I am unable to change the the python executable, since pybind11 uses old cmake find_package directives, always falling back to interpreters in /usr/bin. Workarounds such as using rpath variables or manually changing the path at runtime see this stackoverflow thread are not an option.

The same exact projects works on two other machines running a fresh installation of Ubuntu 20.04 and a Debian Testing system. My recently updated ubuntu (from 18.04) therefore needs to have some hidden configuration issue, which I really would like to figure out.

I am trying to install SELinux on Ubuntu 18.04, but after running the following commands Ubuntu can't boot.

sudo apt install selinux 
sudo reboot

To start I'm a complete noobie in the matter of SElinux and ubuntu, so my problem is that I tried installing it on ubuntu server 18.04 using this tutorial: https://www.linode.com/docs/quick-answers/linux/install-selinux-on-ubuntu/

But I cannot enable it either using setenforce or changing config file in selinux.

root@test:/# setenforce 1
setenforce: SELinux is disabled

If you need more info, I will gladly provide them.

Thank you in advance.

I installed SELINUX on ubuntu using the command:

sudo apt-get install selinux

config file in /etc/selinux contain following information

SELINUX=permissive

SELINUXTYPE=default

SETLOCALDEFS=0

But i am not able to set selinux, when I check using sestatus -v command it gives output

SELINUX is disabled

How should I enable my SELINUX?

When I use command seinfo. it gives following output

ERROR: policydb version 26 does not match my version range 15-24
ERROR: Unable to open policy /etc/selinux/default/policy/policy.26.
ERROR: Input/output error

check-selinux-installation command gives following output ../proc/1 kernel..

SELinux is not enabled. The init process (PID 1) is running in an incorrect domain. /etc/pam.d/login is not SELinux enabled FSCKFIX is not enabled - not serious, but could prevent system from booting... udev will create nodes not labeled correctly

Please help