Hi Anton, Thanks your help and support. I’ve followed your suggestion to enable selinux kernel configuration and have seen kernel message “[ 0.002268] SELinux: Initializing.” during boot time, but still returns “Disabled” after executing getenforce command. The selinux mode and type I set in /etc/selinux/config file is permissive and minimum. Could you help to advise me whether there’s some settings need to set to avoid this problem. Thanks, Ivan From: Anton Kachalov Sent: Tuesday, November 3, 2020 3:50 AM To: Ivan Li11 Cc: Andrew Jeffery ; Artem Senichev ; openbmc@lists.ozlabs.org Subject: Re: [External] Re: SELinux support question Hello, Ivan. Perhaps, you should enable selinux kernel configuration as well. The openbmc kernels, if I'm not mistaken, have different recipes. The default configuration relies on linux-yocto package: http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-kernel/linux You should include this selinux.cfg in on of the openbmc kernel layers: SRC_URI += "file://selinux.cfg" and copy selinux.cfg to one of the local files location. On Mon, 2 Nov 2020 at 18:46, Ivan Li11 > wrote: > -----Original Message----- > From: Andrew Jeffery > > Sent: Monday, November 2, 2020 8:54 AM > To: Artem Senichev >; Ivan Li11 > > Cc: openbmc@lists.ozlabs.org > Subject: [External] Re: SELinux support question > > > > On Fri, 30 Oct 2020, at 16:25, Artem Senichev wrote: > > Hi Ivan, > > > > Yocto has a layer for SELinux > > (http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux), you can try > > it. > > But the layer depends on Python for management tools, which does not > > exist in the OpenBMC image anymore. > > The problem is that Python significantly increases image size, it will > > be more than 32MiB, which causes some troubles with qemu emulation. > > The problem is broader than qemu though, it would also be broken on any > platform shipping a 32MiB flash part if the image exceeds 32MiB. > > That said, if there are systems that ship bigger parts and enabling SELinux for > those is feasible, we should add those platform models to qemu so emulating > them isn't constrained by the existing platform support. > > Andrew Hi Andrew and Artem, Per your suggestion, I try to enable SELinux with Yocto SELinux layer(http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux) and 64MiB flash part. But encountered one problem which is when I use command "getenforce" to check SELinux mode, it always returns "Disabled" even if SELinux mode in config file '/etc/selinux/config' is permissive or enforcing by default. Please help to advise it.