https://bugzilla.suse.com/show_bug.cgi?id=1176923 https://bugzilla.suse.com/show_bug.cgi?id=1176923#c2 Jiri Slaby changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rgoldwyn@suse.com --- Comment #2 from Jiri Slaby --- So can anyone sum up what's needed on the openSUSE side before we disable the kernel option? Do we support selinux at all? Do we need to pass selinux=0 by default? -- You are receiving this mail because: You are the assignee for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1176923 https://bugzilla.suse.com/show_bug.cgi?id=1176923#c4 --- Comment #4 from Thorsten Kukuk --- (In reply to Jiri Slaby from comment #2)

So can anyone sum up what's needed on the openSUSE side before we disable the kernel option?

Nothing. One option in /etc/selinux/config will stop working, but since selinux is disabled by default and we do not yet ship a policy, that's not a problem. I doubt that anybody did build it's own policy, installed them, enabled selinux on the commandline only to disable it in userland in a config file shipped with his policy. He will get a warning if he is doing it since some time.

Do we support selinux at all?

We support SELinux since SLE11, even if never really invested into it. SELinux will be mandatory for Carwos and MicroOS, and we hired now somebody who should maintain the policies for this products.

Do we need to pass selinux=0 by default?

For this change, no. The code to disable SELinux at runtime is currently even not part of openSUSE (the config file is missing). -- You are receiving this mail because: You are the assignee for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1176923 https://bugzilla.suse.com/show_bug.cgi?id=1176923#c6 --- Comment #6 from Jiri Slaby --- (In reply to Michal Kubeček from comment #3)

IIUC this is about deprecating *runtime* disable of SELinux so it should not affect the kernel command line parameter.

I was not sure about the SUSE's userspace setup, so I was afraid SECURITY_SELINUX_DISABLE=n would enable selinux, but:

IIRC we have inverted the default in our kernels so that even if SELinux is compiled in, it is disabled by default and needs "selinux=1" command line parameter to have it enabled.

So everything should be fine. So I suppose you will switch it in master and I will inherit it into stable on the 5.9 merge (likely next week), right? -- You are receiving this mail because: You are the assignee for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1176923 https://bugzilla.suse.com/show_bug.cgi?id=1176923#c8 --- Comment #8 from Michal Kubeček --- CONFIG_SECURITY_SELINUX_DISABLE is now disabled in master (all configs). -- You are receiving this mail because: You are the assignee for the bug.