From 01e30c9b2d03321a25376f52d93d1854a7e9f3c5 Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Wed, 27 Jul 2005 14:32:12 +0000
Subject: [PATCH] initial commit

---
 www/html/switch.html | 104 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)
 create mode 100644 www/html/switch.html

diff --git a/www/html/switch.html b/www/html/switch.html
new file mode 100644
index 000000000..b76caf6de
--- /dev/null
+++ b/www/html/switch.html
@@ -0,0 +1,104 @@
+<h1>Switching to Reference Policy</h1>
+<p>
+	This guide will walk you through switching to the targeted reference
+	policy on a Fedora system.
+<p>
+<h2>
+	Download and unpack the policy
+</h2>
+<p>
+	The policy is <a href="index.php?page=download">available</a> and
+	from Sourceforge.  Download the policy, and unpack it to a temporary
+	directory.  Then use the install-src make target to install the policy
+	sources.
+	
+<pre>
+# tar -jxvf refpolicy-20050711.tar.bz2 -C /tmp
+# cd /tmp/refpolicy
+# make install-src
+</pre>
+<h2>
+	Configure the policy
+</h2>
+<p>
+	Near the top of the policy Makefile, the policy has a few build options.
+	The TYPE needs to be set to targeted, and the DISTRO option needs to be
+	uncommented, and set to redhat.  The Makefile is found in the
+	/etc/selinux/refpolicy/src/policy/ directory.
+</p>
+<pre>
+########################################
+#
+# Configurable portions of the Makefile
+#
+
+# Policy version
+# By default, checkpolicy will create the highest
+# version policy it supports.  Setting this will
+# override the version.
+#OUTPUT_POLICY = 18
+
+# Policy Type
+# strict, targeted, strict-mls, targeted-mls
+TYPE = <font color=red><b>targeted</b></font>
+
+# Policy Name
+# If set, this will be used as the policy
+# name.  Otherwise the policy type will be
+# used for the name.
+NAME = refpolicy
+
+# Distribution
+# Some distributions have portions of policy
+# for programs or configurations specific to the
+# distribution.  Setting this will enable options
+# for the distribution.
+# redhat, gentoo, debian, and suse are current options.
+# Fedora users should enable redhat.
+<font color=red><b>DISTRO = redhat</b></font>
+
+# Build monolithic policy.  Putting n here
+# will build a loadable module policy.
+# Only monolithic policies are currently supported.
+MONOLITHIC=y
+
+# Uncomment this to disable command echoing
+#QUIET:=@
+</pre>
+<h2>
+	Install the binary policy and application configuration files
+</h2>
+<pre>
+# cd /etc/selinux/refpolicy/src/policy
+# make install
+</pre>
+<h2>
+	Change SELinux Configuration
+</h2>
+<p>
+	Modify the /etc/selinux/config file, and set SELINUXTYPE to refpolicy.
+	It should look similar to this:
+</p>
+<pre>
+# This file controls the state of SELinux on the system.
+# SELINUX= can take one of these three values:
+#       enforcing - SELinux security policy is enforced.
+#       permissive - SELinux prints warnings instead of enforcing.
+#       disabled - No SELinux policy is loaded.
+SELINUX=enforcing
+# SELINUXTYPE= can take one of these two values:
+#       targeted - Only targeted network daemons are protected.
+#       strict - Full SELinux protection.
+SELINUXTYPE=<font color=red><b>refpolicy</b></font>
+</pre>
+<h2>
+	Relabel
+</h2>
+<p>
+	The system needs to be restarted with the new policy, and relabeled
+	on booting.
+</p>
+<pre>
+# touch /.autorelabel
+# shutdown -r now
+</pre>