From: Anton Kachalov <rnouse@google.com>
To: Joseph Reynolds <jrey@linux.ibm.com>
Cc: Manojkiran Eda <manojeda@in.ibm.com>,
"openbmc@lists.ozlabs.org" <openbmc@lists.ozlabs.org>,
Artem Senichev <artemsen@gmail.com>, Ivan Li11 <rli11@lenovo.com>
Subject: Re: SELinux support question
Date: Sat, 31 Oct 2020 01:06:24 +0100 [thread overview]
Message-ID: <CADVsX8-FRMUKCWGqwn8cdJysK0a9Hf7uiCjth1ak_FUw4hNdkg@mail.gmail.com> (raw)
In-Reply-To: <4c13b632-c1ac-2908-4154-325f7c90a201@linux.ibm.com>
[-- Attachment #1: Type: text/plain, Size: 1491 bytes --]
Hello, Ivan.
Some OpenBMC hardening work is ongoing:
https://github.com/openbmc/openbmc/issues/3383
Do you have a specific use-cases for SELinux?
On Fri, 30 Oct 2020 at 22:07, Joseph Reynolds <jrey@linux.ibm.com> wrote:
> On 10/30/20 12:55 AM, Artem Senichev wrote:
> > Hi Ivan,
> >
> > Yocto has a layer for SELinux
> > (http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux), you can try
> > it.
> > But the layer depends on Python for management tools, which does not
> > exist in the OpenBMC image anymore.
> > The problem is that Python significantly increases image size, it will
> > be more than 32MiB, which causes some troubles with qemu emulation.
> >
> > --
> > Best regards,
> > Artem Senichev
> >
> > On Thu, Oct 29, 2020 at 7:48 PM Ivan Li11 <rli11@lenovo.com> wrote:
> >> Hi Team,
> >>
> >>
> >>
> >> I would like to ask about SELinux support. It’s seems that there’s no
> SELinux related package in current OpenBMC.
> >>
> >> Therefore, is it not supported for now ?
> >>
> >> Please help to advise.
>
> SELinux and alternatives such as AppArmor and KRSI (Kernel Runtime
> Security Instrumentation) were discussed in various OpenBMC security
> working group meetings including 2020-05-13, 2020-04-01, and earlier.
> See the meeting minutes:
>
> https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI
>
> I don't have any additional insight.
>
> - Joseph
>
> >>
> >>
> >>
> >> Thanks.
>
>
[-- Attachment #2: Type: text/html, Size: 2382 bytes --]
next prev parent reply other threads:[~2020-10-31 0:08 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-29 16:34 SELinux support question Ivan Li11
2020-10-30 5:55 ` Artem Senichev
2020-10-30 21:07 ` Joseph Reynolds
2020-10-31 0:06 ` Anton Kachalov [this message]
2020-11-02 0:54 ` Andrew Jeffery
2020-11-02 17:45 ` [External] " Ivan Li11
2020-11-02 19:49 ` Anton Kachalov
2020-11-03 17:51 ` Ivan Li11
2020-11-04 14:34 ` Anton Kachalov
2020-11-05 7:36 ` Jayanth Othayoth
2020-11-06 10:06 ` Ivan Li11
2020-11-06 13:40 ` Anton Kachalov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CADVsX8-FRMUKCWGqwn8cdJysK0a9Hf7uiCjth1ak_FUw4hNdkg@mail.gmail.com \
--to=rnouse@google.com \
--cc=artemsen@gmail.com \
--cc=jrey@linux.ibm.com \
--cc=manojeda@in.ibm.com \
--cc=openbmc@lists.ozlabs.org \
--cc=rli11@lenovo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).