<div dir="ltr">Hello, Ivan.<div><br></div><div>I'm unsure how policies are being built in Yocto. Usually, you should have /etc/selinux populated in your image with precompiled policies. At least, some default ones.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 6 Nov 2020 at 11:06, Ivan Li11 <<a href="mailto:rli11@lenovo.com">rli11@lenovo.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="ZH-TW">
<div class="gmail-m_-966113140234437432WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Hi Anton and Jayanth,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Thanks your suggestion, it’s workable to get correct status after adding “selinux” to systemd bbappened file.
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">BTW, may I check with you what does “precompiled policies under /etc/selinux” mean ?<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Does it mean that I need to add “PREFERRED_PROVIDER_virtual/refpolicy = "refpolicy-minimum"” to build/conf/local.conf file to assign policy in advance ?
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Thanks,<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Ivan<u></u><u></u></span></p>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0cm 0cm 0cm 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif"> Jayanth Othayoth <<a href="mailto:ojayanth@gmail.com" target="_blank">ojayanth@gmail.com</a>>
<br>
<b>Sent:</b> Thursday, November 5, 2020 3:37 PM<br>
<b>To:</b> Anton Kachalov <<a href="mailto:rnouse@google.com" target="_blank">rnouse@google.com</a>><br>
<b>Cc:</b> Ivan Li11 <<a href="mailto:rli11@lenovo.com" target="_blank">rli11@lenovo.com</a>>; Andrew Jeffery <<a href="mailto:andrew@aj.id.au" target="_blank">andrew@aj.id.au</a>>; <a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a>; Artem Senichev <<a href="mailto:artemsen@gmail.com" target="_blank">artemsen@gmail.com</a>><br>
<b>Subject:</b> Re: [External] Re: SELinux support question<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">I tried on one of the IBM box which got 32MB flash in 2018 time frame and was able to got BMC read state . Reference patch (POC only) is available here
<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><a href="https://gerrit.openbmc-project.xyz/q/topic:%22selinux%22+(status:open%20OR%20status:merged)" target="_blank">https://gerrit.openbmc-project.xyz/q/topic:%22selinux%22+(status:open%20OR%20status:merged)</a><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Wed, Nov 4, 2020 at 8:06 PM Anton Kachalov <<a href="mailto:rnouse@google.com" target="_blank">rnouse@google.com</a>> wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span lang="EN-US">Hello, Ivan.<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Please check if the systemd has been compiled with selinux feature enabled. It should be in charge of enforcing selinux rules at boot.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">You should add "selinux" to PACKAGECONFIG over here:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><a href="https://github.com/openbmc/openbmc/blob/master/meta-phosphor/recipes-core/systemd/systemd_%25.bbappend#L4" target="_blank">https://github.com/openbmc/openbmc/blob/master/meta-phosphor/recipes-core/systemd/systemd_%25.bbappend#L4</a><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">As well as adding "selinux" to the DISTRO_FEATURES variable in your build/conf/local.conf file.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Do you have precompiled policies under /etc/selinux ?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">If it still doesn't work, please also attach a boot log.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Tue, 3 Nov 2020 at 18:52, Ivan Li11 <<a href="mailto:rli11@lenovo.com" target="_blank">rli11@lenovo.com</a>> wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Hi Anton,</span><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif"> </span><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Thanks your help and support.</span><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">I’ve followed your suggestion to enable selinux kernel configuration and have seen kernel message “[ 0.002268] SELinux:
Initializing.” during boot time, but still returns “Disabled” after executing getenforce command.</span><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">The selinux mode and type I set in /etc/selinux/config file is permissive and minimum. Could you help to advise me whether
there’s some settings need to set to avoid this problem.</span><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif"> </span><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Thanks,</span><span lang="EN-US"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-family:Calibri,sans-serif">Ivan</span><span lang="EN-US"><u></u><u></u></span></p>
<div style="border-top:none currentcolor;border-right:none currentcolor;border-bottom:none currentcolor;border-left:1.5pt solid blue;padding:0cm 0cm 0cm 4pt">
<div>
<div style="border-right:none currentcolor;border-bottom:none currentcolor;border-left:none currentcolor;border-top:1pt solid currentcolor;padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span lang="EN-US" style="font-size:11pt;font-family:Calibri,sans-serif"> Anton
Kachalov <<a href="mailto:rnouse@google.com" target="_blank">rnouse@google.com</a>>
<br>
<b>Sent:</b> Tuesday, November 3, 2020 3:50 AM<br>
<b>To:</b> Ivan Li11 <<a href="mailto:rli11@lenovo.com" target="_blank">rli11@lenovo.com</a>><br>
<b>Cc:</b> Andrew Jeffery <<a href="mailto:andrew@aj.id.au" target="_blank">andrew@aj.id.au</a>>; Artem Senichev <<a href="mailto:artemsen@gmail.com" target="_blank">artemsen@gmail.com</a>>;
<a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a><br>
<b>Subject:</b> Re: [External] Re: SELinux support question</span><span lang="EN-US"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Hello, Ivan.<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Perhaps, you should enable selinux kernel configuration as well. The openbmc kernels, if I'm not mistaken, have different recipes.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">The default configuration relies on linux-yocto package:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><a href="http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-kernel/linux" target="_blank">http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-kernel/linux</a><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">You should include this selinux.cfg in on of the openbmc kernel layers:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">SRC_URI += "<a>file://selinux.cfg</a>"<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">and copy selinux.cfg to one of the local files location.<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Mon, 2 Nov 2020 at 18:46, Ivan Li11 <<a href="mailto:rli11@lenovo.com" target="_blank">rli11@lenovo.com</a>> wrote:<u></u><u></u></span></p>
</div>
<blockquote style="border-top:none currentcolor;border-right:none currentcolor;border-bottom:none currentcolor;border-left:1pt solid rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<p class="MsoNormal"><span lang="EN-US"><br>
> -----Original Message-----<br>
> From: Andrew Jeffery <<a href="mailto:andrew@aj.id.au" target="_blank">andrew@aj.id.au</a>><br>
> Sent: Monday, November 2, 2020 8:54 AM<br>
> To: Artem Senichev <<a href="mailto:artemsen@gmail.com" target="_blank">artemsen@gmail.com</a>>; Ivan Li11 <<a href="mailto:rli11@lenovo.com" target="_blank">rli11@lenovo.com</a>><br>
> Cc: <a href="mailto:openbmc@lists.ozlabs.org" target="_blank">openbmc@lists.ozlabs.org</a><br>
> Subject: [External] Re: SELinux support question<br>
> <br>
> <br>
> <br>
> On Fri, 30 Oct 2020, at 16:25, Artem Senichev wrote:<br>
> > Hi Ivan,<br>
> ><br>
> > Yocto has a layer for SELinux<br>
> > (<a href="http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux" target="_blank">http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux</a>), you can try<br>
> > it.<br>
> > But the layer depends on Python for management tools, which does not<br>
> > exist in the OpenBMC image anymore.<br>
> > The problem is that Python significantly increases image size, it will<br>
> > be more than 32MiB, which causes some troubles with qemu emulation.<br>
> <br>
> The problem is broader than qemu though, it would also be broken on any<br>
> platform shipping a 32MiB flash part if the image exceeds 32MiB.<br>
> <br>
> That said, if there are systems that ship bigger parts and enabling SELinux for<br>
> those is feasible, we should add those platform models to qemu so emulating<br>
> them isn't constrained by the existing platform support.<br>
> <br>
> Andrew<br>
<br>
Hi Andrew and Artem,<br>
Per your suggestion, I try to enable SELinux with Yocto SELinux layer(<a href="http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux" target="_blank">http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux</a>) and 64MiB flash part.<br>
But encountered one problem which is when I use command "getenforce" to check SELinux mode, it always returns "Disabled" even if SELinux mode in config file '/etc/selinux/config' is permissive or enforcing by default.<br>
<br>
Please help to advise it. <u></u><u></u></span></p>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</blockquote></div>