Enable user_xattr - Selinux failing

Enable user_xattr - Selinux failing

[Divya Vyas]

[-- Attachment #1: Type: text/plain, Size: 612 bytes --]

Hi,

I am getting this error while building the selinux enabled image.


* SELinux requires the root '/' filesystem support extended
  filesystem attributes (XATTRs).  It does not appear that this
  filesystem has extended attribute support or it is not enabled.

  - To continue using SELinux you will need to enable extended
    attribute support on the root device.

  - To disable SELinux, please add "selinux=0" in the kernel
    command line.

* Halting the system now.

My fstab is below :

rootfs                  /               ext3
defaults,acl,user_xattr 0 1

Any idea where is the problem?

Thanks,

[-- Attachment #2: Type: text/html, Size: 860 bytes --]

Re: Enable user_xattr - Selinux failing

[Dominick Grift]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Fri, Sep 04, 2015 at 04:34:42PM +0530, Divya Vyas wrote:
> Hi,
> 
> I am getting this error while building the selinux enabled image.
> 
> 
> * SELinux requires the root '/' filesystem support extended
>   filesystem attributes (XATTRs).  It does not appear that this
>   filesystem has extended attribute support or it is not enabled.

It is refering to "security" extended attributes and not "user" extended attributes

> 
>   - To continue using SELinux you will need to enable extended
>     attribute support on the root device.
> 
>   - To disable SELinux, please add "selinux=0" in the kernel
>     command line.
> 
> * Halting the system now.
> 
> My fstab is below :
> 
> rootfs                  /               ext3
> defaults,acl,user_xattr 0 1
> 
> Any idea where is the problem?
>

See whether your file system supports "security extended attributes",
and whether that support is enabled in your Linux configuration. When
those requirements are met nd it still does not work, see if your
selinux policy supports the file system.

> Thanks,

> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.


- -- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQGcBAEBCgAGBQJV6YG1AAoJENAR6kfG5xmcj94L/iRCtn8pFqDOSqv1mrgmBBim
sAkAdtRq60w3YfLXblYeYxKwthZYYBamF/wsrMKxQ0X7vcpFO82ymzcOOb/AWGV/
LoI0I3w3OfdnFZyJrbc+C1KlXpmmVkvzmdWHW00oEMipGI9RBx0Wd2hY5/XVGG4B
+rAp4Kkvnnf4gGgKmZX3pa7OsS5j8fGvTSELqgg6/4UpO+yrkftTRu8y/E930JAF
eKbbE97vbZkIz57PjGiqLVTdsD0gCA46V2kVqNecFxxHAbrFJaHbjDxdw/u8uoaN
9Nftq7whzeDaWXOO97io6T8uVVmZd37+8ewBFR4Lc2+wXdX1G8dHhi15PIGQMfYw
nFuc4efQKeNd+mtAeN8gOBQySEkrVtfXBsr7WI4DgZ+Lh9ERmwz9ZuZwiUdegOMk
WRk/jamPyIska8JJPCvLLCMfkapN1ZNFLGalf7dVGNJjbnyDkIUPfA9GVaa+Z3rN
EWpOJwC+GC1BY36l6gW2y4WKaZU03XGYtan/ioCG9w==
=USvg
-----END PGP SIGNATURE-----

Re: Enable user_xattr - Selinux failing

[Divya Vyas]

[-- Attachment #1: Type: text/plain, Size: 3348 bytes --]

Hi,

Here is the kernel  configuration :

KERNEL_CONFIG_AUDIT="y"
KERNEL_CONFIG_NETWORK_SECMARK="y"
KERNEL_CONFIG_EXT2_FS_SECURITY="y"
KERNEL_CONFIG_EXT3_FS_SECURITY="y"
KERNEL_CONFIG_EXT4_FS_SECURITY="y"
KERNEL_CONFIG_EXT2_FS_ATTR="y"
KERNEL_CONFIG_EXT3_FS_ATTR="y"
KERNEL_CONFIG_JFS_SECURITY="y"
KERNEL_CONFIG_REISERFS_FS_SECURITY="y"
KERNEL_CONFIG_JFFS2_FS_SECURITY="y"
KERNEL_CONFIG_SECURITY_NETWORK="y"
KERNEL_CONFIG_SECURITY_SELINUX="y"
KERNEL_CONFIG_SECURITY_SELINUX_BOOTPARAM="y"
KERNEL_CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE="1"
KERNEL_CONFIG_SECURITY_SELINUX_DISABLE="y"
KERNEL_CONFIG_SECURITY_SELINUX_DEVELOP="y"
KERNEL_CONFIG_SECURITY_SELINUX_AVC_STATS="y"
KERNEL_CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE="1"
KERNEL_CONFIG_SECURITY="y"
KERNEL_CONFIG_SECURITYFS="y"
KERNEL_CONFIG_AUDIT_GENERIC="y"
KERNEL_CONFIG_DEFAULT_SECURITY_SELINUX="y"
KERNEL_CONFIG_SECURITY_PATH="y"

My filesystem is ext3 . I think all configs are enabled.

How to check whether policy supports filesystem?

Thanks,


On Fri, Sep 4, 2015 at 5:04 PM, Dominick Grift <dac.override@gmail.com>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On Fri, Sep 04, 2015 at 04:34:42PM +0530, Divya Vyas wrote:
> > Hi,
> >
> > I am getting this error while building the selinux enabled image.
> >
> >
> > * SELinux requires the root '/' filesystem support extended
> >   filesystem attributes (XATTRs).  It does not appear that this
> >   filesystem has extended attribute support or it is not enabled.
>
> It is refering to "security" extended attributes and not "user" extended
> attributes
>
> >
> >   - To continue using SELinux you will need to enable extended
> >     attribute support on the root device.
> >
> >   - To disable SELinux, please add "selinux=0" in the kernel
> >     command line.
> >
> > * Halting the system now.
> >
> > My fstab is below :
> >
> > rootfs                  /               ext3
> > defaults,acl,user_xattr 0 1
> >
> > Any idea where is the problem?
> >
>
> See whether your file system supports "security extended attributes",
> and whether that support is enabled in your Linux configuration. When
> those requirements are met nd it still does not work, see if your
> selinux policy supports the file system.
>
> > Thanks,
>
> > _______________________________________________
> > Selinux mailing list
> > Selinux@tycho.nsa.gov
> > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> > To get help, send an email containing "help" to
> Selinux-request@tycho.nsa.gov.
>
>
> - --
> 02DFF788
> 4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
> http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
> Dominick Grift
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQGcBAEBCgAGBQJV6YG1AAoJENAR6kfG5xmcj94L/iRCtn8pFqDOSqv1mrgmBBim
> sAkAdtRq60w3YfLXblYeYxKwthZYYBamF/wsrMKxQ0X7vcpFO82ymzcOOb/AWGV/
> LoI0I3w3OfdnFZyJrbc+C1KlXpmmVkvzmdWHW00oEMipGI9RBx0Wd2hY5/XVGG4B
> +rAp4Kkvnnf4gGgKmZX3pa7OsS5j8fGvTSELqgg6/4UpO+yrkftTRu8y/E930JAF
> eKbbE97vbZkIz57PjGiqLVTdsD0gCA46V2kVqNecFxxHAbrFJaHbjDxdw/u8uoaN
> 9Nftq7whzeDaWXOO97io6T8uVVmZd37+8ewBFR4Lc2+wXdX1G8dHhi15PIGQMfYw
> nFuc4efQKeNd+mtAeN8gOBQySEkrVtfXBsr7WI4DgZ+Lh9ERmwz9ZuZwiUdegOMk
> WRk/jamPyIska8JJPCvLLCMfkapN1ZNFLGalf7dVGNJjbnyDkIUPfA9GVaa+Z3rN
> EWpOJwC+GC1BY36l6gW2y4WKaZU03XGYtan/ioCG9w==
> =USvg
> -----END PGP SIGNATURE-----
>

[-- Attachment #2: Type: text/html, Size: 4736 bytes --]

Re: Enable user_xattr - Selinux failing

[Dominick Grift]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Fri, Sep 04, 2015 at 05:29:53PM +0530, Divya Vyas wrote:
<snip>
> 
> My filesystem is ext3 . I think all configs are enabled.
> 
> How to check whether policy supports filesystem?
>

Looks like it

seinfo --fs_use | grep ext

- -- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQGcBAEBCgAGBQJV6YnEAAoJENAR6kfG5xmcgoUMAJM921GYecpUb3AFKFtLo6bW
2r3wckkKcv0S2QDSa1kSfyCmXp2blGFYtI3ywn1U0xo+jCsNirsE+MZrEzJU8HcI
rXh+SF4BxxwZKBNqH+CqcR4S+XQ3Z2hkUjjLDljpLz3tgsmQVNTCRnjMa+8zqcq/
uK+fyNeR2aO8GAq1Xmd+MKE0lTmnq7EkU/lcvLOEQzhiBisdrV7DzI0yV3nw7dI0
3S/PXga2yAWEurHroPPGlFM0PLmb8B4VQHM3e711r/jRKuxmFe4eAtzPzS71qDxM
0FopQYfXRJWu/NqPdkp5xaGEtP865A5wJsOBeAkA3mNiBdhF6gDW5we5/+Vw4DPQ
A6gUMjprcpNXDRxqeJPxq2Fz5wQYaNsGvGANLydIFzttSYZbAqmfNR5k4UR1iE7a
0hMS8LOiqN0jwzGlCacldJbGlO7am5emAJ62EmVeFUAQAkYPJrMJzdMul9KaFjm8
nTLeOv/1XgxGkCRkLde2R+t6GFLBg6PeVw7d+IAzNw==
=G1xo
-----END PGP SIGNATURE-----

Re: Enable user_xattr - Selinux failing

[Divya Vyas]

[-- Attachment #1: Type: text/plain, Size: 1682 bytes --]

Hi,

I am getting the SELinux attributes error while booting the selinux image
and the system is halting. So I booted the image with selinux=0 in boot
parms

I am getting this output while /etc/selinux/mls/policy/policy.27 is present.

seinfo --fs_use | grep ext
ERROR: Could not determine running system's policy version.
ERROR: Unable to open policy /etc/selinux/mls/policy/policy.27.
ERROR: No such file or directory

I am booting selinux image first time.




On Fri, Sep 4, 2015 at 5:38 PM, Dominick Grift <dac.override@gmail.com>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On Fri, Sep 04, 2015 at 05:29:53PM +0530, Divya Vyas wrote:
> <snip>
> >
> > My filesystem is ext3 . I think all configs are enabled.
> >
> > How to check whether policy supports filesystem?
> >
>
> Looks like it
>
> seinfo --fs_use | grep ext
>
> - --
> 02DFF788
> 4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
> http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
> Dominick Grift
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQGcBAEBCgAGBQJV6YnEAAoJENAR6kfG5xmcgoUMAJM921GYecpUb3AFKFtLo6bW
> 2r3wckkKcv0S2QDSa1kSfyCmXp2blGFYtI3ywn1U0xo+jCsNirsE+MZrEzJU8HcI
> rXh+SF4BxxwZKBNqH+CqcR4S+XQ3Z2hkUjjLDljpLz3tgsmQVNTCRnjMa+8zqcq/
> uK+fyNeR2aO8GAq1Xmd+MKE0lTmnq7EkU/lcvLOEQzhiBisdrV7DzI0yV3nw7dI0
> 3S/PXga2yAWEurHroPPGlFM0PLmb8B4VQHM3e711r/jRKuxmFe4eAtzPzS71qDxM
> 0FopQYfXRJWu/NqPdkp5xaGEtP865A5wJsOBeAkA3mNiBdhF6gDW5we5/+Vw4DPQ
> A6gUMjprcpNXDRxqeJPxq2Fz5wQYaNsGvGANLydIFzttSYZbAqmfNR5k4UR1iE7a
> 0hMS8LOiqN0jwzGlCacldJbGlO7am5emAJ62EmVeFUAQAkYPJrMJzdMul9KaFjm8
> nTLeOv/1XgxGkCRkLde2R+t6GFLBg6PeVw7d+IAzNw==
> =G1xo
> -----END PGP SIGNATURE-----
>

[-- Attachment #2: Type: text/html, Size: 2404 bytes --]

Re: Enable user_xattr - Selinux failing

[Dominick Grift]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Fri, Sep 04, 2015 at 04:34:42PM +0530, Divya Vyas wrote:
> Hi,
> 
> I am getting this error while building the selinux enabled image.

What "selinux enabled image" are you refering to? What is your distribution?

> 
> 
> * SELinux requires the root '/' filesystem support extended
>   filesystem attributes (XATTRs).  It does not appear that this
>   filesystem has extended attribute support or it is not enabled.
> 
>   - To continue using SELinux you will need to enable extended
>     attribute support on the root device.
> 
>   - To disable SELinux, please add "selinux=0" in the kernel
>     command line.
> 
> * Halting the system now.

I do not think that the above is a "selinux message". Could this be some
third party script/application? Maybe the script/application is flawed.

- -- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQGcBAEBCgAGBQJV6ZDSAAoJENAR6kfG5xmcMtkMAJtUpqfbHsd8bASrn+hsZxor
8SPoWpBR481kV6gv4pcuDRvzeyOqvdSBk5Y2OZATblwAuC7Uh49BeL7DsN8WzU4b
144IqZmqjUPhSZqBQBI8v6ZkST8hcxnNKrPIuWNDTPLhJd5VZ/F6XRa9bRUj8s2x
7rScvBVqD/w/nIK/6mL//sXwgQc4b90PHFppMwhu7/SJ6tJWtsPz8JdfsDd8Fw+L
gqdBE3dpMYS7y1o1AZNSnoVN1H+WXU1CRleCJ2h+/xf7fkx3HMpoqtzH50ZN0WBg
I0ofpTGbcXR1VjZ/DcIBAAmaCI4/UAvkQimC5JjYn2eO3h/p6DBG8lCf+rLntrf0
AUYQ8To7kcUFQffvSbxhE5Au1LUssCE/d22WBCsE671/6kCdabkLR+Rn+oRlY3Gw
h7snDftce3C5EMqFjPiRPHZdtXSp+slPVA85h3M8zkRHaIEyyidUu0UZlio4Wn8a
tXXGAG2+l7VWtSVHyW8IMCpUd42zrYGeVOwI7C7Tqg==
=xGwb
-----END PGP SIGNATURE-----

Re: Enable user_xattr - Selinux failing

[Divya Vyas]

[-- Attachment #1: Type: text/plain, Size: 2249 bytes --]

Hi,

I built a yocto x86 image with selinux packages and required kernel config
in root filesystem. As kernel config DEFAULT_SECURITY_SELINUX is enabled so
when I boot the image default selinux will be enforcing mode.

If you see the below link, the error message is below:


https://github.com/flihp/meta-selinux/blob/master/recipes-security/selinux/selinux-config/selinux-init.sh

The script just does the check-rootfs and some check steps.


On Fri, Sep 4, 2015 at 6:08 PM, Dominick Grift <dac.override@gmail.com>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> On Fri, Sep 04, 2015 at 04:34:42PM +0530, Divya Vyas wrote:
> > Hi,
> >
> > I am getting this error while building the selinux enabled image.
>
> What "selinux enabled image" are you refering to? What is your
> distribution?
>
> >
> >
> > * SELinux requires the root '/' filesystem support extended
> >   filesystem attributes (XATTRs).  It does not appear that this
> >   filesystem has extended attribute support or it is not enabled.
> >
> >   - To continue using SELinux you will need to enable extended
> >     attribute support on the root device.
> >
> >   - To disable SELinux, please add "selinux=0" in the kernel
> >     command line.
> >
> > * Halting the system now.
>
> I do not think that the above is a "selinux message". Could this be some
> third party script/application? Maybe the script/application is flawed.
>
> - --
> 02DFF788
> 4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
> http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
> Dominick Grift
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQGcBAEBCgAGBQJV6ZDSAAoJENAR6kfG5xmcMtkMAJtUpqfbHsd8bASrn+hsZxor
> 8SPoWpBR481kV6gv4pcuDRvzeyOqvdSBk5Y2OZATblwAuC7Uh49BeL7DsN8WzU4b
> 144IqZmqjUPhSZqBQBI8v6ZkST8hcxnNKrPIuWNDTPLhJd5VZ/F6XRa9bRUj8s2x
> 7rScvBVqD/w/nIK/6mL//sXwgQc4b90PHFppMwhu7/SJ6tJWtsPz8JdfsDd8Fw+L
> gqdBE3dpMYS7y1o1AZNSnoVN1H+WXU1CRleCJ2h+/xf7fkx3HMpoqtzH50ZN0WBg
> I0ofpTGbcXR1VjZ/DcIBAAmaCI4/UAvkQimC5JjYn2eO3h/p6DBG8lCf+rLntrf0
> AUYQ8To7kcUFQffvSbxhE5Au1LUssCE/d22WBCsE671/6kCdabkLR+Rn+oRlY3Gw
> h7snDftce3C5EMqFjPiRPHZdtXSp+slPVA85h3M8zkRHaIEyyidUu0UZlio4Wn8a
> tXXGAG2+l7VWtSVHyW8IMCpUd42zrYGeVOwI7C7Tqg==
> =xGwb
> -----END PGP SIGNATURE-----
>

[-- Attachment #2: Type: text/html, Size: 3207 bytes --]

Re: Enable user_xattr - Selinux failing

[Dominick Grift]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Fri, Sep 04, 2015 at 06:15:48PM +0530, Divya Vyas wrote:
> 
> If you see the below link, the error message is below:
> 
> 
> https://github.com/flihp/meta-selinux/blob/master/recipes-security/selinux/selinux-config/selinux-init.sh
> 
> The script just does the check-rootfs and some check steps.
> 

That check-rootfs function looks fragile. I suspect the script is the
problem but I am unsure. 

> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.


- -- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQGcBAEBCgAGBQJV6ZSqAAoJENAR6kfG5xmc3MEL/AztWNla1RvaGZdDk5iUw5lD
DM3gwIeUNgvx/VaQYPFQg5gCFigjeliNZITAIZH5AdEAJK1yO3CYrZpGeQ6kfRcj
Cb40qcUhPGglA4JtBeDqA2VmsRvfuoKhD3cUD0GIHZ1Lcw6xATYZ6sXH+3EgmUdR
9m6jkxpZmJezDzXq9X2a4WHAlix47vD05l63om7gcCbEdREzv2NXUFSUSUVn1Uk6
xKDC5wlgQrdTdocrg52LALlroqVOiJ+HItiYE3NWy3AoEkqXlbNFcBfr4JJtkxgW
IpYs3W8lYbmqM8RoYFbx3H1SQFIIrn7iFETTXGm0Jh8NBbfJQJGLGhBiPG3CE2Ue
W2b51ZQEnjfnkAHwgAq1ay38luyLp72pQvOrPnyw3cStpPIR5+5Nbm03Gg/dooYA
oo6jzpKNJPz7MW/i9Czl4/Gk23Yq58Q9YoLIXxHECMKYN/UwerlkUHyzKrjdao+z
N58DJ7ESSPdx9R1RmZDEe9SmJwxuFceXQd17A5gEDw==
=ua/M
-----END PGP SIGNATURE-----