why not install selinux with systemd being used

why not install selinux with systemd being used

[Dave Young]

Hi, Harald

I have a question about selinux module.

In dracut.spec there's below code:

%if %{defined _unitdir}
# with systemd IMA and selinux modules do not make sense
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
%endif

I'm confused why they are excluded for systemd?

And how can we load selinux policy in initramfs without 98selinux now?


-- 
Thanks
Dave

Re: why not install selinux with systemd being used

[Dave Young]

On 05/22/2013 06:13 PM, Dave Young wrote:
> Hi, Harald
> 
> I have a question about selinux module.
> 
> In dracut.spec there's below code:
> 
> %if %{defined _unitdir}
> # with systemd IMA and selinux modules do not make sense
> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
> %endif
> 
> I'm confused why they are excluded for systemd?
> 
> And how can we load selinux policy in initramfs without 98selinux now?
> 
> 
CC Vivek and Baoquan


-- 
Thanks
Dave

Re: why not install selinux with systemd being used

[Colin Guthrie]

'Twas brillig, and Dave Young at 22/05/13 11:14 did gyre and gimble:
> On 05/22/2013 06:13 PM, Dave Young wrote:
>> Hi, Harald
>>
>> I have a question about selinux module.
>>
>> In dracut.spec there's below code:
>>
>> %if %{defined _unitdir}
>> # with systemd IMA and selinux modules do not make sense
>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
>> %endif
>>
>> I'm confused why they are excluded for systemd?
>>
>> And how can we load selinux policy in initramfs without 98selinux now?
>>
>>
> CC Vivek and Baoquan

Harald is on vacation just now I believe.

However, assuming the systemd module is being used in dracut than I
suspect that the selinux support in systemd itself is what will be used
in the initrd to ensure selinux stuff is supported.

(I would reply-all but replying via gmane which mangles email addresses
so I can't easily do so).

Col


-- 

Colin Guthrie
gmane(at)colin.guthr.ie
http://colin.guthr.ie/

Day Job:
  Tribalogic Limited http://www.tribalogic.net/
Open Source:
  Mageia Contributor http://www.mageia.org/
  PulseAudio Hacker http://www.pulseaudio.org/
  Trac Hacker http://trac.edgewall.org/

Re: why not install selinux with systemd being used

[Dave Young]

On 05/23/2013 11:45 PM, Colin Guthrie wrote:
> 'Twas brillig, and Dave Young at 22/05/13 11:14 did gyre and gimble:
>> On 05/22/2013 06:13 PM, Dave Young wrote:
>>> Hi, Harald
>>>
>>> I have a question about selinux module.
>>>
>>> In dracut.spec there's below code:
>>>
>>> %if %{defined _unitdir}
>>> # with systemd IMA and selinux modules do not make sense
>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
>>> %endif
>>>
>>> I'm confused why they are excluded for systemd?
>>>
>>> And how can we load selinux policy in initramfs without 98selinux now?
>>>
>>>
>> CC Vivek and Baoquan
> 
> Harald is on vacation just now I believe.
> 
> However, assuming the systemd module is being used in dracut than I
> suspect that the selinux support in systemd itself is what will be used
> in the initrd to ensure selinux stuff is supported.

I did not see initramfs related selinux policy loading in systemd code.

Under rd.break=pre-pivot:
pre-pivot:/# /sysroot/usr/sbin/sestatus
SELinux status: disabled

> 
> (I would reply-all but replying via gmane which mangles email addresses
> so I can't easily do so).
> 
> Col
> 
> 


-- 
Thanks
Dave

Re: why not install selinux with systemd being used

[Harald Hoyer]

On 05/22/2013 12:14 PM, Dave Young wrote:
> On 05/22/2013 06:13 PM, Dave Young wrote:
>> Hi, Harald
>>
>> I have a question about selinux module.
>>
>> In dracut.spec there's below code:
>>
>> %if %{defined _unitdir}
>> # with systemd IMA and selinux modules do not make sense
>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
>> %endif
>>
>> I'm confused why they are excluded for systemd?
>>
>> And how can we load selinux policy in initramfs without 98selinux now?

Do you have to load the selinux policy in the initramfs?
systemd does it after switching to the real root.

Re: why not install selinux with systemd being used

[Dave Young]

On 05/27/2013 07:40 PM, Harald Hoyer wrote:
> On 05/22/2013 12:14 PM, Dave Young wrote:
>> On 05/22/2013 06:13 PM, Dave Young wrote:
>>> Hi, Harald
>>>
>>> I have a question about selinux module.
>>>
>>> In dracut.spec there's below code:
>>>
>>> %if %{defined _unitdir}
>>> # with systemd IMA and selinux modules do not make sense
>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
>>> %endif
>>>
>>> I'm confused why they are excluded for systemd?
>>>
>>> And how can we load selinux policy in initramfs without 98selinux now?
> 
> Do you have to load the selinux policy in the initramfs?
> systemd does it after switching to the real root.
> 

After crashing happens, under kdump kernel we need copy vmcore to
filesystem with right selinux attributes. But we are also discussing if
it's better to relabel them after machine restart..


-- 
Thanks
Dave

Re: why not install selinux with systemd being used

[Harald Hoyer]

On 05/28/2013 04:18 AM, Dave Young wrote:
> On 05/27/2013 07:40 PM, Harald Hoyer wrote:
>> On 05/22/2013 12:14 PM, Dave Young wrote:
>>> On 05/22/2013 06:13 PM, Dave Young wrote:
>>>> Hi, Harald
>>>>
>>>> I have a question about selinux module.
>>>>
>>>> In dracut.spec there's below code:
>>>>
>>>> %if %{defined _unitdir}
>>>> # with systemd IMA and selinux modules do not make sense
>>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
>>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
>>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
>>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
>>>> %endif
>>>>
>>>> I'm confused why they are excluded for systemd?
>>>>
>>>> And how can we load selinux policy in initramfs without 98selinux now?
>>
>> Do you have to load the selinux policy in the initramfs?
>> systemd does it after switching to the real root.
>>
> 
> After crashing happens, under kdump kernel we need copy vmcore to
> filesystem with right selinux attributes. But we are also discussing if
> it's better to relabel them after machine restart..

What do you do, if the rootfs is broken?

Relabeling seems to be a better solution, IMHO.
In theory the relabeling service can also be triggered, when the partition
containing the crash is mounted.

I agree, that there is a problem, if the crash partition is mounted only readonly.

I will put selinux back in the fedora packages, if you really need it.

Re: why not install selinux with systemd being used

[Vivek Goyal]

On Tue, May 28, 2013 at 02:25:12PM +0200, Harald Hoyer wrote:
> On 05/28/2013 04:18 AM, Dave Young wrote:
> > On 05/27/2013 07:40 PM, Harald Hoyer wrote:
> >> On 05/22/2013 12:14 PM, Dave Young wrote:
> >>> On 05/22/2013 06:13 PM, Dave Young wrote:
> >>>> Hi, Harald
> >>>>
> >>>> I have a question about selinux module.
> >>>>
> >>>> In dracut.spec there's below code:
> >>>>
> >>>> %if %{defined _unitdir}
> >>>> # with systemd IMA and selinux modules do not make sense
> >>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/96securityfs
> >>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/97masterkey
> >>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98integrity
> >>>> rm -fr $RPM_BUILD_ROOT/%{dracutlibdir}/modules.d/98selinux
> >>>> %endif
> >>>>
> >>>> I'm confused why they are excluded for systemd?
> >>>>
> >>>> And how can we load selinux policy in initramfs without 98selinux now?
> >>
> >> Do you have to load the selinux policy in the initramfs?
> >> systemd does it after switching to the real root.
> >>
> > 
> > After crashing happens, under kdump kernel we need copy vmcore to
> > filesystem with right selinux attributes. But we are also discussing if
> > it's better to relabel them after machine restart..
> 
> What do you do, if the rootfs is broken?

Hi Harald,

I guess run fsck and try to repair it. If that does not work, I think 
all bets are off. One will not be able to boot that system back into
same rootfs.

> 
> Relabeling seems to be a better solution, IMHO.
> In theory the relabeling service can also be triggered, when the partition
> containing the crash is mounted.

I was hoping that people will put an entry into fstab file for crash
partition so that it automatically gets mounted every reboot. And kdump
service can possibly be launched after that.

> 
> I agree, that there is a problem, if the crash partition is mounted only readonly.

It indeed is a problem. Partners want crash partition mounted read only
to avoid any possibility of somebody writing to it and filling up the
space.

> 
> I will put selinux back in the fedora packages, if you really need it.

I think it is a good idea to put selinux back in atleast for the time
being. This will help with the default case atleast (dump to /var/crash).

For rest of the cases we will work on relabeling and hopefully that works
reasonably well. 

Thanks
Vivek