https://bugzilla.suse.com/show_bug.cgi?id=1187313 https://bugzilla.suse.com/show_bug.cgi?id=1187313#c1 Johannes Segitz changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team@suse.de |jsegitz@suse.com --- Comment #1 from Johannes Segitz --- yes, that's something we can add. How can this be reproduced? I would expect that this triggers on the first boot after install with SELinux enabled, but it doesn't for me -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1187313 https://bugzilla.suse.com/show_bug.cgi?id=1187313#c3 --- Comment #3 from Fabian Vogt --- Any news here? This is the only blocker to having SELinux in MicroOS images by default. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1187313 https://bugzilla.suse.com/show_bug.cgi?id=1187313#c4 --- Comment #4 from Ludwig Nussel --- While the report is certainly valid for services that have tty as output the blocker can be resolved by dropping the firstboot "wizard" from MicroOS. It serves no purpose anymore. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1187313 https://bugzilla.suse.com/show_bug.cgi?id=1187313#c6 Ludwig Nussel changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(lnussel@suse.com) | --- Comment #6 from Ludwig Nussel --- systemd just does the right thing automatically -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1187313 https://bugzilla.suse.com/show_bug.cgi?id=1187313#c8 --- Comment #8 from Johannes Segitz --- sorry I didn't see that, for some reason I don't get emails for this bug (last one in my mails is when I asked for the reproduction steps, then nothing). The change is already in security:SELinux. I'll submit it for Micro as a patch -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1187313 https://bugzilla.suse.com/show_bug.cgi?id=1187313#c11 --- Comment #11 from Fabian Vogt --- (In reply to Ludwig Nussel from comment #4)

While the report is certainly valid for services that have tty as output the blocker can be resolved by dropping the firstboot "wizard" from MicroOS. It serves no purpose anymore.

FTR, also breaks systemd-firstboot: Oct 07 09:12:59.683128 localhost systemd[1151]: systemd-firstboot.service: Failed to set up standard input: Permission denied -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1187313 https://bugzilla.suse.com/show_bug.cgi?id=1187313#c13 Fabian Vogt changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #13 from Fabian Vogt --- It looks like selinux-policy-20211111 (from security:SELinux) fixed this, the error message appears neither for systemd-firstboot nor MicroOS-firstboot (after installing it again).

The change is already in security:SELinux. I'll submit it for Micro as a patch

It appears like that wasn't actually true at that point. The change done by the patch was not in security:SELinux until 20211111, so also not part of my test. -- You are receiving this mail because: You are on the CC list for the bug.