Re: busybox + SELinux (warrior) - reboot issue

Re: busybox + SELinux (warrior) - reboot issue

[Yair Itzhaki]

[-- Attachment #1: Type: text/plain, Size: 31 bytes --]

Anybody?

Thanks,
Yair



[-- Attachment #2: Type: text/html, Size: 2124 bytes --]

Re: busybox + SELinux (warrior) - reboot issue

[Mark Hatle]

I've been trying to find time to look into it, but I've not had any so far.

I'd suggest trying it on more full Linux system first to see if that resolves
the issue.  If it does, then it's simply a configuration and you can use the
audit messages to help figure it out..  but the fact it's rebooting suggests to
me that something is incorrect in the initscripts when used with busybox.

--Mark

On 11/21/19 8:54 AM, Yair Itzhaki wrote:
> Anybody?
> 
>  
> 
> Thanks,
> 
> Yair
> 
>  
> 
>  
> 
> 

Re: busybox + SELinux (warrior) - reboot issue

[Ayoub Zaki]

[-- Attachment #1: Type: text/plain, Size: 232 bytes --]

Hi,

you should inherit in your image recipe the following bbclass:

inherit selinux-image

It will set the security label of your filesystem using your refpolicy offline so it does not need to relabel again.

Best regards

[-- Attachment #2: Type: text/html, Size: 279 bytes --]

busybox + SELinux (warrior) - reboot issue

[Yair Itzhaki]

[-- Attachment #1: Type: text/plain, Size: 1021 bytes --]

Hi ,
I'm using Poky (Warrior), with busybox (aiming at a lightweight system).
Recently, added SELinux to my project (by adding "packagegroup-core-selinux" to my local.conf, with mls policy).

Booted with "selinux=1 enforing=0".
The auto-relabeling reported an error, since the root is mounted RO.
So, patched slelinux-autorelabel script to mount "/" RW before relabeling.

Booted again.
This time, selinux-init had the same issue ( / mounted RO).
Patched this one as well, but the system keeps rebooting:
It seems that the init process keeps it's kernel_t context, which forces re-labeling, reboot and so on…. (per the selinux-init script)

Q1: Is SELinux+busybox a valid combination, or should I switch to systemd?
Q2: Which context should the init process end up as?

BTW – the build of "core-image-selinux" fails, with the following error
   Copying files into the device: set_inode_xattr: No data available while reading attribute "security.selinux" of "network"
Any idea?

Thanks,
Yair



[-- Attachment #2: Type: text/html, Size: 4831 bytes --]