why not install selinux with systemd being used

DISCUSSION Dave Young 4 participants 8 messages May 22, 2013 – May 28, 2013 5 messages not in the archive

lore

Share & tools

lore

Dave Young

author

2013-05-22 10:13 UTC #0 lore raw

Hi, Harald

I have a question about selinux module.

In dracut.spec there's below code:

%if %{defined _unitdir}

# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif

I'm confused why they are excluded for systemd?

And how can we load selinux policy in initramfs without 98selinux now?

Signature · 2 lines

Thanks
Dave

Dave Young

author

2013-05-22 10:14 UTC #2 lore raw

In reply to a message not in the archive

Quoted 14 lines · Dave Young

Hi, Harald

I have a question about selinux module.

In dracut.spec there's below code:

%if %{defined _unitdir}

# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif

Quoted 5 lines

I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?

CC Vivek and Baoquan

Signature · 2 lines

Thanks
Dave

Colin Guthrie

2013-05-23 15:45 UTC #4 lore raw

In reply to a message not in the archive

'Twas brillig, and Dave Young at 22/05/13 11:14 did gyre and gimble:

Quoted 15 lines · Dave Young

Quoted 14 lines

Hi, Harald

I have a question about selinux module.

In dracut.spec there's below code:

%if %{defined _unitdir}

# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif

Quoted 6 lines

Quoted 5 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
CC Vivek and Baoquan

Harald is on vacation just now I believe.

However, assuming the systemd module is being used in dracut than I suspect that the selinux support in systemd itself is what will be used in the initrd to ensure selinux stuff is supported.

(I would reply-all but replying via gmane which mangles email addresses so I can't easily do so).

Col

Signature · 10 lines

Colin Guthrie
gmane(at)colin.guthr.ie
http://colin.guthr.ie/

Day Job:
  Tribalogic Limited http://www.tribalogic.net/
Open Source:
  Mageia Contributor http://www.mageia.org/
  PulseAudio Hacker http://www.pulseaudio.org/
  Trac Hacker http://trac.edgewall.org/

Dave Young

author

2013-05-24 04:21 UTC #5 lore raw

Quoted 21 lines · Colin Guthrie

'Twas brillig, and Dave Young at 22/05/13 11:14 did gyre and gimble:
Quoted 20 lines · Dave Young
Quoted 19 lines
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined _unitdir}
# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?

Quoted 7 lines

Quoted 1 line
CC Vivek and Baoquan
Harald is on vacation just now I believe.
However, assuming the systemd module is being used in dracut than I suspect that the selinux support in systemd itself is what will be used in the initrd to ensure selinux stuff is supported.

I did not see initramfs related selinux policy loading in systemd code.

Under rd.break=pre-pivot:

pre-pivot:/# /sysroot/usr/sbin/sestatus
SELinux status: disabled

Quoted 7 lines

(I would reply-all but replying via gmane which mangles email addresses so I can't easily do so).
Col

Signature · 2 lines

Thanks
Dave

Harald Hoyer

2013-05-27 11:40 UTC #6 lore raw

In reply to a message not in the archive

Quoted 15 lines · Dave Young

Quoted 14 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined _unitdir}
# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif

Quoted 3 lines

Quoted 3 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?

Do you have to load the selinux policy in the initramfs? systemd does it after switching to the real root.

Dave Young

author

2013-05-28 02:18 UTC #8 lore raw

In reply to a message not in the archive

Quoted 16 lines · Harald Hoyer

Quoted 15 lines · Dave Young
Quoted 14 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined _unitdir}
# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif

Quoted 7 lines

Quoted 3 lines
Quoted 3 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
Do you have to load the selinux policy in the initramfs? systemd does it after switching to the real root.

After crashing happens, under kdump kernel we need copy vmcore to filesystem with right selinux attributes. But we are also discussing if it's better to relabel them after machine restart..

Signature · 2 lines

Thanks
Dave

Harald Hoyer

2013-05-28 12:25 UTC #10 lore raw

In reply to a message not in the archive

Quoted 21 lines · Dave Young

Quoted 20 lines · Harald Hoyer
Quoted 18 lines · Dave Young
Quoted 17 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined _unitdir}
# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?

Quoted 7 lines

Quoted 3 lines
Do you have to load the selinux policy in the initramfs? systemd does it after switching to the real root.
After crashing happens, under kdump kernel we need copy vmcore to filesystem with right selinux attributes. But we are also discussing if it's better to relabel them after machine restart..

What do you do, if the rootfs is broken?

Relabeling seems to be a better solution, IMHO.
In theory the relabeling service can also be triggered, when the partition containing the crash is mounted.

I agree, that there is a problem, if the crash partition is mounted only readonly.

I will put selinux back in the fedora packages, if you really need it.

Vivek Goyal

2013-05-28 13:21 UTC #12 lore raw

In reply to a message not in the archive

Quoted 26 lines · Harald Hoyer

Quoted 25 lines · Dave Young
Quoted 23 lines · Harald Hoyer
Quoted 15 lines · Dave Young
Quoted 14 lines · Dave Young
Hi, Harald
I have a question about selinux module.
In dracut.spec there's below code:
%if %{defined _unitdir}
# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif
Quoted 3 lines
Quoted 3 lines
I'm confused why they are excluded for systemd?
And how can we load selinux policy in initramfs without 98selinux now?
Do you have to load the selinux policy in the initramfs? systemd does it after switching to the real root.

Quoted 5 lines

Quoted 3 lines
After crashing happens, under kdump kernel we need copy vmcore to filesystem with right selinux attributes. But we are also discussing if it's better to relabel them after machine restart..
What do you do, if the rootfs is broken?

Hi Harald,

I guess run fsck and try to repair it. If that does not work, I think all bets are off. One will not be able to boot that system back into same rootfs.

Quoted 4 lines

Relabeling seems to be a better solution, IMHO.
In theory the relabeling service can also be triggered, when the partition containing the crash is mounted.

I was hoping that people will put an entry into fstab file for crash partition so that it automatically gets mounted every reboot. And kdump service can possibly be launched after that.

Quoted 2 lines

I agree, that there is a problem, if the crash partition is mounted only readonly.

It indeed is a problem. Partners want crash partition mounted read only to avoid any possibility of somebody writing to it and filling up the space.

Quoted 2 lines

I will put selinux back in the fedora packages, if you really need it.

I think it is a good idea to put selinux back in atleast for the time being. This will help with the default case atleast (dump to /var/crash).

For rest of the cases we will work on relabeling and hopefully that works reasonably well.

Thanks
Vivek