- selinux

service file specific watches?
by Ludwig Nussel 18 May '21

18 May '21

Hi, ca-certificates, btrfsmaintenance and probably others have conditions that lead systemd to wanting to watch certain files, eg PathChanged=/etc/sysconfig/btrfsmaintenance That leads to type=AVC msg=audit(1621253570.928:27): avc: denied { watch } for pid=1 comm="systemd" path="/etc/sysconfig/btrfsmaintenance" dev="overlay" ino=15638 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0 That case is rather easy as "allow init_t etc_t:file watch;" would be ok to add to the systemd rules. How is this expected to work in general though? We patch the policy for systemd or ship individual policy snippets in packages? cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer HRB 36809 (AG Nürnberg)

2 2

relabel in initrd always?
by Ludwig Nussel 18 May '21

18 May '21

Hi, MicroOS uses a dracut module to relabel in initrd before jumping into the real system¹. A normal TW on the other hand uses generator to boot into an autorelabel target, relabel and reboot². Any reason why the MicroOS approach couldn't just be used also in the plain old TW case? cu Ludwig [1] https://github.com/kubic-project/microos-tools/blob/master/selinux/98selinu… [2] https://build.opensuse.org/package/show/openSUSE:Factory/selinux-autorelabel -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.com/ SUSE Software Solutions Germany GmbH, GF: Felix Imendörffer HRB 36809 (AG Nürnberg)

3 3

Fwd: selinux-policy package versioning change
by Neal Gompa 30 Mar '21

30 Mar '21

Anyone have a problem with this on the SUSE/openSUSE side? ---------- Forwarded message --------- From: Zdenek Pytela <zpytela(a)redhat.com> Date: Mon, Mar 29, 2021 at 3:56 PM Subject: selinux-policy package versioning change To: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>, <selinux(a)lists.fedoraproject.org> Hi, We plan to change the versioning scheme of the selinux-policy packages. Based on a request to using tags in selinux-policy github repo, we discussed further actions and possible automation and decided to couple the tags with the package version, together with making a change for better comprehensibility. So far, the package version changed with branching a new Fedora release off rawhide (e. g. 3.14.6 to 3.14.7), and the release part of the NVR scheme was used for updates (3.14.7-1). After the change, the version would contain the Fedora branch number and the sequential number of the package in the branch (34.1), and the release part would be used only for changes in packaging (34.1-1). It would apply to Fedora 34 and newer. In github repo, tags matching the Fedora package version would be used (v34.1), pairing the latest commit in github with the latest commit in the package (34.1-1). We do not expect any impact to end users neither to developers unless the exact version was used somewhere. If there are no objections, we will make the change in a week time. Cheers, -- Zdenek Pytela SELinux team _______________________________________________ devel mailing list -- devel(a)lists.fedoraproject.org To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure -- 真実はいつも一つ！/ Always, there's only one truth!

2 1

[selinux] Fwd: selinux-policy-contrib repository merged with selinux-policy
by Neal Gompa 26 Nov '20

26 Nov '20

FYI: ---------- Forwarded message --------- From: Zdenek Pytela <zpytela(a)redhat.com> Date: Thu, Nov 26, 2020 at 6:04 AM Subject: selinux-policy-contrib repository merged with selinux-policy To: Development discussions related to Fedora <devel(a)lists.fedoraproject.org>, <selinux(a)lists.fedoraproject.org> Hello, On November 25th, 2020, the selinux-policy-contrib repository was merged with selinux-policy. SELinux policy packages in Fedora used 2 repositories previously: base [1] and contrib [2]. From now on, these repos are merged into one, containing sources from both [1]. The change affected both repos, rawhide branches and future branches f34 and newer. Refer to [3] for more information. A few minor issues remain requiring some polishing. Other changes will follow soon. We plan to include new classes, permissions, and capabilities into the policy, they will be announced in advance. [1] https://github.com/fedora-selinux/selinux-policy/ [2] https://github.com/fedora-selinux/selinux-policy-contrib/ [3] https://github.com/fedora-selinux/selinux-policy/README.md -- Zdenek Pytela SELinux policy maintainer _______________________________________________ selinux mailing list -- selinux(a)lists.fedoraproject.org To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.o… -- 真実はいつも一つ！/ Always, there's only one truth!

1 0

[selinux] MicroOS and SELinux - Working!
by Thorsten Kukuk 23 Nov '20

23 Nov '20

Hi, a short status overview about MicroOS and SELinux: it's working :) SELinux is not yet enabled by default due to missing support in YaST (which is WiP), but you can already install and enable SELinux today: transactional-update setup-selinux reboot Documentation with the most important things to know can be found at: https://en.opensuse.org/Portal:MicroOS/SELinux The most important things we need are more and better documentation and test cases, which verify that an update is still compatible with the policy. Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)

1 0

[selinux] Re: State of SELinux today in openSUSE?
by Thorsten Kukuk 18 Nov '20

18 Nov '20

Hi, On Tue, Nov 17, Neal Gompa wrote: > I'm personally looking to switch my openSUSE servers and desktops to > having SELinux enabled in enforcing mode with the targeted policy, and > I'm happy to help wherever I can to make that work. My personal > pie-in-the-sky hope is that we can be in a place soon where we could > be comfortable with having it as a default across the board (even if > we might not necessarily do so). Tumbleweed: Install the selinux pattern, add "security=selinux selinux=1" to the kernel commandline, touch /.autorelabel and reboot. Yes, YaST support and documentation is still missing. > I know right now the focus has been to get the targeted policy working > in openSUSE MicroOS, do we know what's left here to make this happen? Don't install apparmor pattern but selinux pattern, make sure you are really "current": - transactional-update >= 2.28.3 - microos-tools >= 2.9 Run "transactional-update setup-selinux" and reboot. And yes, YaST support and documentation is still missing... Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)

2 1

[selinux] Re: State of SELinux today in openSUSE?
by Thorsten Kukuk 17 Nov '20

17 Nov '20

Hi, On Tue, Nov 17, Neal Gompa wrote: > I'm personally looking to switch my openSUSE servers and desktops to > having SELinux enabled in enforcing mode with the targeted policy, and > I'm happy to help wherever I can to make that work. My personal > pie-in-the-sky hope is that we can be in a place soon where we could > be comfortable with having it as a default across the board (even if > we might not necessarily do so). Tumbleweed: Install the selinux pattern, add "security=selinux selinux=1" to the kernel commandline, touch /.autorelabel and reboot. Yes, YaST support and documentation is still missing. > I know right now the focus has been to get the targeted policy working > in openSUSE MicroOS, do we know what's left here to make this happen? Don't install apparmor pattern but selinux pattern, make sure you are really "current": - transactional-update >= 2.28.3 - microos-tools >= 2.9 Run "transactional-update setup-selinux" and reboot. And yes, YaST support and documentation is still missing... Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)

1 0

[selinux] State of SELinux today in openSUSE?
by Neal Gompa 17 Nov '20

17 Nov '20

Hey all, I'm personally *very* excited to see SELinux support grow in openSUSE and I'm glad we now have a place to discuss and collaborate on this. I'm personally looking to switch my openSUSE servers and desktops to having SELinux enabled in enforcing mode with the targeted policy, and I'm happy to help wherever I can to make that work. My personal pie-in-the-sky hope is that we can be in a place soon where we could be comfortable with having it as a default across the board (even if we might not necessarily do so). I know right now the focus has been to get the targeted policy working in openSUSE MicroOS, do we know what's left here to make this happen? Best regards, Neal -- 真実はいつも一つ！/ Always, there's only one truth!

1 0