[External] Re: SELinux support question

[Ivan Li11]

Hi Anton,

Thanks your help and support.
I’ve followed your suggestion to enable selinux kernel configuration and have seen kernel message “[ 0.002268] SELinux:  Initializing.” during boot time, but still returns “Disabled” after executing getenforce command.
The selinux mode and type I set in /etc/selinux/config file is permissive and minimum.  Could you help to advise me whether there’s some settings need to set to avoid this problem.

Thanks,
Ivan
From: Anton Kachalov <rnouse at google.com>
Sent: Tuesday, November 3, 2020 3:50 AM
To: Ivan Li11 <rli11 at lenovo.com>
Cc: Andrew Jeffery <andrew at aj.id.au>; Artem Senichev <artemsen at gmail.com>; openbmc at lists.ozlabs.org
Subject: Re: [External] Re: SELinux support question

Hello, Ivan.

Perhaps, you should enable selinux kernel configuration as well. The openbmc kernels, if I'm not mistaken, have different recipes.

The default configuration relies on linux-yocto package:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-kernel/linux

You should include this selinux.cfg in on of the openbmc kernel layers:

SRC_URI += "file://selinux.cfg"

and copy selinux.cfg to one of the local files location.

On Mon, 2 Nov 2020 at 18:46, Ivan Li11 <rli11 at lenovo.com<mailto:rli11 at lenovo.com>> wrote:

> -----Original Message-----
> From: Andrew Jeffery <andrew at aj.id.au<mailto:andrew at aj.id.au>>
> Sent: Monday, November 2, 2020 8:54 AM
> To: Artem Senichev <artemsen at gmail.com<mailto:artemsen at gmail.com>>; Ivan Li11 <rli11 at lenovo.com<mailto:rli11 at lenovo.com>>
> Cc: openbmc at lists.ozlabs.org<mailto:openbmc at lists.ozlabs.org>
> Subject: [External] Re: SELinux support question
>
>
>
> On Fri, 30 Oct 2020, at 16:25, Artem Senichev wrote:
> > Hi Ivan,
> >
> > Yocto has a layer for SELinux
> > (http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux), you can try
> > it.
> > But the layer depends on Python for management tools, which does not
> > exist in the OpenBMC image anymore.
> > The problem is that Python significantly increases image size, it will
> > be more than 32MiB, which causes some troubles with qemu emulation.
>
> The problem is broader than qemu though, it would also be broken on any
> platform shipping a 32MiB flash part if the image exceeds 32MiB.
>
> That said, if there are systems that ship bigger parts and enabling SELinux for
> those is feasible, we should add those platform models to qemu so emulating
> them isn't constrained by the existing platform support.
>
> Andrew

Hi Andrew and Artem,
Per your suggestion, I try to enable SELinux with Yocto SELinux layer(http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux) and 64MiB flash part.
But encountered one problem which is when I use command "getenforce" to check SELinux mode, it always returns "Disabled" even if SELinux mode in config file '/etc/selinux/config' is permissive or enforcing by default.

Please help to advise it.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ozlabs.org/pipermail/openbmc/attachments/20201103/63cd989c/attachment-0001.htm>