From: Ivan Li11 <rli11@lenovo.com>
To: Anton Kachalov <rnouse@google.com>
Cc: Andrew Jeffery <andrew@aj.id.au>,
"openbmc@lists.ozlabs.org" <openbmc@lists.ozlabs.org>,
Artem Senichev <artemsen@gmail.com>
Subject: RE: [External] Re: SELinux support question
Date: Tue, 3 Nov 2020 17:51:59 +0000 [thread overview]
Message-ID: <HK2PR03MB4580DB8C2DD31082F2BEFB4DD3110@HK2PR03MB4580.apcprd03.prod.outlook.com> (raw)
In-Reply-To: <CADVsX8-9FMwUrjnNzKdEX2CRHRNr0nwFyy74U74OozQHWfXpVA@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2956 bytes --]
Hi Anton,
Thanks your help and support.
I’ve followed your suggestion to enable selinux kernel configuration and have seen kernel message “[ 0.002268] SELinux: Initializing.” during boot time, but still returns “Disabled” after executing getenforce command.
The selinux mode and type I set in /etc/selinux/config file is permissive and minimum. Could you help to advise me whether there’s some settings need to set to avoid this problem.
Thanks,
Ivan
From: Anton Kachalov <rnouse@google.com>
Sent: Tuesday, November 3, 2020 3:50 AM
To: Ivan Li11 <rli11@lenovo.com>
Cc: Andrew Jeffery <andrew@aj.id.au>; Artem Senichev <artemsen@gmail.com>; openbmc@lists.ozlabs.org
Subject: Re: [External] Re: SELinux support question
Hello, Ivan.
Perhaps, you should enable selinux kernel configuration as well. The openbmc kernels, if I'm not mistaken, have different recipes.
The default configuration relies on linux-yocto package:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-kernel/linux
You should include this selinux.cfg in on of the openbmc kernel layers:
SRC_URI += "file://selinux.cfg"
and copy selinux.cfg to one of the local files location.
On Mon, 2 Nov 2020 at 18:46, Ivan Li11 <rli11@lenovo.com<mailto:rli11@lenovo.com>> wrote:
> -----Original Message-----
> From: Andrew Jeffery <andrew@aj.id.au<mailto:andrew@aj.id.au>>
> Sent: Monday, November 2, 2020 8:54 AM
> To: Artem Senichev <artemsen@gmail.com<mailto:artemsen@gmail.com>>; Ivan Li11 <rli11@lenovo.com<mailto:rli11@lenovo.com>>
> Cc: openbmc@lists.ozlabs.org<mailto:openbmc@lists.ozlabs.org>
> Subject: [External] Re: SELinux support question
>
>
>
> On Fri, 30 Oct 2020, at 16:25, Artem Senichev wrote:
> > Hi Ivan,
> >
> > Yocto has a layer for SELinux
> > (http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux), you can try
> > it.
> > But the layer depends on Python for management tools, which does not
> > exist in the OpenBMC image anymore.
> > The problem is that Python significantly increases image size, it will
> > be more than 32MiB, which causes some troubles with qemu emulation.
>
> The problem is broader than qemu though, it would also be broken on any
> platform shipping a 32MiB flash part if the image exceeds 32MiB.
>
> That said, if there are systems that ship bigger parts and enabling SELinux for
> those is feasible, we should add those platform models to qemu so emulating
> them isn't constrained by the existing platform support.
>
> Andrew
Hi Andrew and Artem,
Per your suggestion, I try to enable SELinux with Yocto SELinux layer(http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux) and 64MiB flash part.
But encountered one problem which is when I use command "getenforce" to check SELinux mode, it always returns "Disabled" even if SELinux mode in config file '/etc/selinux/config' is permissive or enforcing by default.
Please help to advise it.
[-- Attachment #2: Type: text/html, Size: 8164 bytes --]
next prev parent reply other threads:[~2020-11-03 17:54 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-29 16:34 SELinux support question Ivan Li11
2020-10-30 5:55 ` Artem Senichev
2020-10-30 21:07 ` Joseph Reynolds
2020-10-31 0:06 ` Anton Kachalov
2020-11-02 0:54 ` Andrew Jeffery
2020-11-02 17:45 ` [External] " Ivan Li11
2020-11-02 19:49 ` Anton Kachalov
2020-11-03 17:51 ` Ivan Li11 [this message]
2020-11-04 14:34 ` Anton Kachalov
2020-11-05 7:36 ` Jayanth Othayoth
2020-11-06 10:06 ` Ivan Li11
2020-11-06 13:40 ` Anton Kachalov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=HK2PR03MB4580DB8C2DD31082F2BEFB4DD3110@HK2PR03MB4580.apcprd03.prod.outlook.com \
--to=rli11@lenovo.com \
--cc=andrew@aj.id.au \
--cc=artemsen@gmail.com \
--cc=openbmc@lists.ozlabs.org \
--cc=rnouse@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).