November 2020 - selinux - openSUSE Mailing Lists

[selinux] Fwd: selinux-policy-contrib repository merged with selinux-policy
by Neal Gompa 26 Nov '20

26 Nov '20

FYI: ---------- Forwarded message --------- From: Zdenek Pytela <zpytela(a)redhat.com> Date: Thu, Nov 26, 2020 at 6:04 AM Subject: selinux-policy-contrib repository merged with selinux-policy To: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>, <selinux(a)lists.fedoraproject.org> Hello, On November 25th, 2020, the selinux-policy-contrib repository was merged with selinux-policy. SELinux policy packages in Fedora used 2 repositories previously: base [1] and contrib [2]. From now on, these repos are merged into one, containing sources from both [1]. The change affected both repos, rawhide branches and future branches f34 and newer. Refer to [3] for more information. A few minor issues remain requiring some polishing. Other changes will follow soon. We plan to include new classes, permissions, and capabilities into the policy, they will be announced in advance. [1] https://github.com/fedora-selinux/selinux-policy/ [2] https://github.com/fedora-selinux/selinux-policy-contrib/ [3] https://github.com/fedora-selinux/selinux-policy/README.md -- Zdenek Pytela SELinux policy maintainer _______________________________________________ selinux mailing list -- selinux(a)lists.fedoraproject.org To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.o… -- 真実はいつも一つ！/ Always, there's only one truth!

1 0

[selinux] MicroOS and SELinux - Working!
by Thorsten Kukuk 23 Nov '20

23 Nov '20

Hi, a short status overview about MicroOS and SELinux: it's working :) SELinux is not yet enabled by default due to missing support in YaST (which is WiP), but you can already install and enable SELinux today: transactional-update setup-selinux reboot Documentation with the most important things to know can be found at: https://en.opensuse.org/Portal:MicroOS/SELinux The most important things we need are more and better documentation and test cases, which verify that an update is still compatible with the policy. Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)

1 0

[selinux] Re: State of SELinux today in openSUSE?
by Thorsten Kukuk 18 Nov '20

18 Nov '20

Hi, On Tue, Nov 17, Neal Gompa wrote: > I'm personally looking to switch my openSUSE servers and desktops to > having SELinux enabled in enforcing mode with the targeted policy, and > I'm happy to help wherever I can to make that work. My personal > pie-in-the-sky hope is that we can be in a place soon where we could > be comfortable with having it as a default across the board (even if > we might not necessarily do so). Tumbleweed: Install the selinux pattern, add "security=selinux selinux=1" to the kernel commandline, touch /.autorelabel and reboot. Yes, YaST support and documentation is still missing. > I know right now the focus has been to get the targeted policy working > in openSUSE MicroOS, do we know what's left here to make this happen? Don't install apparmor pattern but selinux pattern, make sure you are really "current": - transactional-update >= 2.28.3 - microos-tools >= 2.9 Run "transactional-update setup-selinux" and reboot. And yes, YaST support and documentation is still missing... Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)

2 1

[selinux] Re: State of SELinux today in openSUSE?
by Thorsten Kukuk 17 Nov '20

17 Nov '20

Hi, On Tue, Nov 17, Neal Gompa wrote: > I'm personally looking to switch my openSUSE servers and desktops to > having SELinux enabled in enforcing mode with the targeted policy, and > I'm happy to help wherever I can to make that work. My personal > pie-in-the-sky hope is that we can be in a place soon where we could > be comfortable with having it as a default across the board (even if > we might not necessarily do so). Tumbleweed: Install the selinux pattern, add "security=selinux selinux=1" to the kernel commandline, touch /.autorelabel and reboot. Yes, YaST support and documentation is still missing. > I know right now the focus has been to get the targeted policy working > in openSUSE MicroOS, do we know what's left here to make this happen? Don't install apparmor pattern but selinux pattern, make sure you are really "current": - transactional-update >= 2.28.3 - microos-tools >= 2.9 Run "transactional-update setup-selinux" and reboot. And yes, YaST support and documentation is still missing... Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)

1 0

[selinux] State of SELinux today in openSUSE?
by Neal Gompa 17 Nov '20

17 Nov '20

Hey all, I'm personally *very* excited to see SELinux support grow in openSUSE and I'm glad we now have a place to discuss and collaborate on this. I'm personally looking to switch my openSUSE servers and desktops to having SELinux enabled in enforcing mode with the targeted policy, and I'm happy to help wherever I can to make that work. My personal pie-in-the-sky hope is that we can be in a place soon where we could be comfortable with having it as a default across the board (even if we might not necessarily do so). I know right now the focus has been to get the targeted policy working in openSUSE MicroOS, do we know what's left here to make this happen? Best regards, Neal -- 真実はいつも一つ！/ Always, there's only one truth!

1 0