why not install selinux with systemd being used
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined _unitdir}
# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endifI'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
Signature · 2 lines
Thanks Dave
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 14 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined
_unitdir}# with systemd IMA and selinux modules do not make sense rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux %endif
Quoted 5 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
CC Vivek and Baoquan
Signature · 2 lines
Thanks Dave
A message that is not in the archive (sent off-list or not yet received): [email protected]
'Twas brillig, and Dave Young at 22/05/13 11:14 did gyre and gimble:
Quoted 15 lines · Dave Young
Quoted 14 lines
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined
_unitdir}# with systemd IMA and selinux modules do not make sense rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux %endif
Quoted 6 lines
Quoted 5 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
CC Vivek and Baoquan
Harald is on vacation just now I believe.
However, assuming the systemd module is being used in dracut than I suspect that the selinux support in systemd itself is what will be used in the initrd to ensure selinux stuff is supported.
(I would reply-all but replying via gmane which mangles email addresses so I can't easily do so).
Col
Signature · 10 lines
Colin Guthrie gmane(at)colin.guthr.ie http://colin.guthr.ie/ Day Job: Tribalogic Limited http://www.tribalogic.net/ Open Source: Mageia Contributor http://www.mageia.org/ PulseAudio Hacker http://www.pulseaudio.org/ Trac Hacker http://trac.edgewall.org/
Quoted 21 lines · Colin Guthrie
'Twas brillig, and Dave Young at 22/05/13 11:14 did gyre and gimble:
Quoted 20 lines · Dave Young
Quoted 19 lines
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined
_unitdir}# with systemd IMA and selinux modules do not make sense rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux %endifI'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
Quoted 7 lines
Quoted 1 line
CC Vivek and Baoquan
Harald is on vacation just now I believe.
However, assuming the systemd module is being used in dracut than I suspect that the selinux support in systemd itself is what will be used in the initrd to ensure selinux stuff is supported.
I did not see initramfs related selinux policy loading in systemd code.
Under rd.break=pre-pivot:
pre-pivot:/# /sysroot/usr/sbin/sestatus SELinux status: disabled
Quoted 7 lines
(I would reply-all but replying via gmane which mangles email addresses so I can't easily do so).
Col
Signature · 2 lines
Thanks Dave
Quoted 15 lines · Dave Young
Quoted 14 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined
_unitdir}# with systemd IMA and selinux modules do not make sense rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux %endif
Quoted 3 lines
Quoted 3 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
Do you have to load the selinux policy in the initramfs? systemd does it after switching to the real root.
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 16 lines · Harald Hoyer
Quoted 15 lines · Dave Young
Quoted 14 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined
_unitdir}# with systemd IMA and selinux modules do not make sense rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux %endif
Quoted 7 lines
Quoted 3 lines
Quoted 3 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
Do you have to load the selinux policy in the initramfs? systemd does it after switching to the real root.
After crashing happens, under kdump kernel we need copy vmcore to filesystem with right selinux attributes. But we are also discussing if it's better to relabel them after machine restart..
Signature · 2 lines
Thanks Dave
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 21 lines · Dave Young
Quoted 20 lines · Harald Hoyer
Quoted 18 lines · Dave Young
Quoted 17 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined
_unitdir}# with systemd IMA and selinux modules do not make sense rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux %endifI'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
Quoted 7 lines
Quoted 3 lines
Do you have to load the selinux policy in the initramfs? systemd does it after switching to the real root.
After crashing happens, under kdump kernel we need copy vmcore to filesystem with right selinux attributes. But we are also discussing if it's better to relabel them after machine restart..
What do you do, if the rootfs is broken?
Relabeling seems to be a better solution, IMHO.
In theory the relabeling service can also be triggered, when the partition containing the crash is mounted.
I agree, that there is a problem, if the crash partition is mounted only readonly.
I will put selinux back in the fedora packages, if you really need it.
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 26 lines · Harald Hoyer
Quoted 25 lines · Dave Young
Quoted 23 lines · Harald Hoyer
Quoted 15 lines · Dave Young
Quoted 14 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined
_unitdir}# with systemd IMA and selinux modules do not make sense rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux %endifQuoted 3 lines
Quoted 3 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
Do you have to load the selinux policy in the initramfs? systemd does it after switching to the real root.
Quoted 5 lines
Quoted 3 lines
After crashing happens, under kdump kernel we need copy vmcore to filesystem with right selinux attributes. But we are also discussing if it's better to relabel them after machine restart..
What do you do, if the rootfs is broken?
Hi Harald,
I guess run fsck and try to repair it. If that does not work, I think all bets are off. One will not be able to boot that system back into same rootfs.
Quoted 4 lines
Relabeling seems to be a better solution, IMHO.
In theory the relabeling service can also be triggered, when the partition containing the crash is mounted.
I was hoping that people will put an entry into fstab file for crash partition so that it automatically gets mounted every reboot. And kdump service can possibly be launched after that.
Quoted 2 lines
I agree, that there is a problem, if the crash partition is mounted only readonly.
It indeed is a problem. Partners want crash partition mounted read only to avoid any possibility of somebody writing to it and filling up the space.
Quoted 2 lines
I will put selinux back in the fedora packages, if you really need it.
I think it is a good idea to put selinux back in atleast for the time being. This will help with the default case atleast (dump to /var/crash).
For rest of the cases we will work on relabeling and hopefully that works reasonably well.
Thanks
Vivek