From: Thomas Downing <tdowning@bomgar.com>
To: <selinux@tycho.nsa.gov>
Subject: Re: Newbie question on fixfiles
Date: Fri, 29 Jan 2016 13:10:42 -0600 [thread overview]
Message-ID: <2562820.7NyBD1uIEE@juss> (raw)
In-Reply-To: <56ABB3CB.9020306@tycho.nsa.gov>
On Friday, January 29, 2016 13:47:39 Stephen Smalley wrote:
> On 01/29/2016 01:02 PM, Stephen Smalley wrote:
> > On 01/29/2016 12:25 PM, Thomas Downing wrote:
> >> Hi,
> >>
> >> I need to get SELinux running on an appliance we are building, not
> >> based on a
> >> distro that already supports SELinux.
> >>
> >> I've got all the userspace stuff built, (including setools3) without any
> >> warnings or errors. I followed instructions for installing and loading
> >> refpolicy, no warnings or errors. (Except the python tools, which all
> >> import
> >> selinux.py, which does not seem to be included in the source tree.)
> >>
> >> I'm booting with kernel options "security=selinux selinux=1", and
> >> dmesg shows
> >> SELinux initializing, and no errors or warnings.
> >>
> >> sestatus output:
> >>
> >> SELinux status: enabled
> >> SELinuxfs mount: /sys/fs/selinux
> >> SELinux root directory: /etc/selinux
> >> Loaded policy name: refpolicy
> >> Current mode: permissive
> >> Mode from config file: permissive
> >> Policy MLS status: disabled
> >> Policy deny_unknown status: denied
> >> Max kernel policy version: 30
> >>
> >> Problem is: fixfiles does not actually label anything, and the
> >> underlying reason
> >> is that none of the mounted disk filesystems (all ext4) have option
> >> 'seclabel'.
> >>
> >> Any pointers?
> >>
> >> Also, given the absence of the seclabel option, I question if the
> >> kernel part
> >> of SELinux is in fact really happy...and if it isn't, I'm dead in the
> >> water
> >> anyway.
> >
> > This implies that you haven't loaded a policy into the kernel. Normally
> > this is done by init; both sysvinit and systemd should already include
> > the necessary bits but you may have to enable them in your configure.
>
> Sorry, I didn't read that carefully enough - your sestatus output would
> suggest that you have loaded a policy.
>
> What's the actual output you got from SELinux during boot?
>
> What's your kernel version?
The only output I see in dmesg is:
[ 0.000557] SELinux: Initializing.
[ 0.000563] SELinux: Starting in permissive mode
[ 0.361186] SELinux: Registering netfilter hooks
The kernel stuff is 4.4.0 SMP x86_64 Intel Core i7-4800MQ CPU. If it matters
gcc is 5.3.0.
Thanks
td
next prev parent reply other threads:[~2016-01-29 19:09 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-29 17:25 Newbie question on fixfiles Thomas Downing
2016-01-29 17:37 ` Joe Wulf
2016-01-29 18:26 ` Thomas Downing
2016-01-29 18:02 ` Stephen Smalley
2016-01-29 18:47 ` Stephen Smalley
2016-01-29 19:10 ` Thomas Downing [this message]
2016-01-29 19:03 ` Thomas Downing
2016-01-29 19:25 ` Stephen Smalley
2016-01-29 19:41 ` Thomas Downing
2016-01-29 20:05 ` Stephen Smalley
2016-01-29 20:13 ` Thomas Downing
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2562820.7NyBD1uIEE@juss \
--to=tdowning@bomgar.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.