Re: selinux_init() is not executed in booting in kernel 5.15
Henry Zhang <[email protected]> Tue, 8 Aug 2023 11:02:47 -0700
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <CANTW0yozU6xjaW8_YSV4npNLvHGiUYnhPZCsHYZvAKM+-JxRog@mail.gmail.com> |
--===============2751922167176655420== Content-Type: multipart/alternative; boundary="0000000000005358f706026d2c76" --0000000000005358f706026d2c76 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ondrej, Yes. my SELINUX is enabled finally after CONFIG_LSM=3D"integrity, selinux". Do you guys manage meta-selinux? ----henry On Tue, Aug 8, 2023 at 8:01=E2=80=AFAM Ondrej Mosnacek <[email protected]= > wrote: > Oh, right, I completely overlooked the file attachment. Sorry! > > It seems your CONFIG_LSM is not set correctly. It is missing "selinux" > and the order seems wrong, but since you have most of the listed > modules disabled, you can set it to just: > > CONFIG_LSM=3D"integrity,selinux" > > Then the kernel should boot with SELinux enabled. > > On Tue, Aug 8, 2023 at 4:26=E2=80=AFPM Henry Zhang <[email protected]= m> wrote: > > > > Ondrej, > > > > Thanks for your help! > > I am using Yocto embedded to compile. The kernel config file is copied > from /proc/config.gz in my linux device. > > The kernel function selinux_init() is not triggered when booting up. > > > > ---henry > > > > > > On Tue, Aug 8, 2023 at 1:17=E2=80=AFAM Ondrej Mosnacek <omosnace@redhat= .com> > wrote: > >> > >> That is not a kernel config file. How are you building/installing the > >> kernel? What Linux distribution (Fedora/CentOS/Ubuntu/...) is this on? > >> > >> On Mon, Aug 7, 2023 at 6:29=E2=80=AFPM Henry Zhang <henryzhang62@gmail= .com> > wrote: > >> > > >> > Ondrej, > >> > > >> > Attached is my kernel configuration file. > >> > ~# cat /etc/selinux/config > >> > # This file controls the state of SELinux on the system. > >> > # SELINUX=3D can take one of these three values: > >> > # enforcing - SELinux security policy is enforced. > >> > # permissive - SELinux prints warnings instead of enforcing. > >> > # disabled - No SELinux policy is loaded. > >> > SELINUX=3Denforcing > >> > # SELINUXTYPE=3D can take one of these values: > >> > # minimum - Minimum Security protection. > >> > # standard - Standard Security protection. > >> > # mls - Multi Level Security protection. > >> > # targeted - Targeted processes are protected. > >> > # mcs - Multi Category Security protection. > >> > SELINUXTYPE=3Dmcs > >> > > >> > # sestatus > >> > SELinux status: disabled > >> > > >> > # getenforce > >> > Disabled > >> > > >> > # setenforce 1 > >> > setenforce: SELinux is disabled > >> > > >> > # dmesg|grep SELi > >> > [ 5.604171] systemd[1]: Starting SELinux init for /dev service > loading... > >> > > >> > # dmesg|grep SELI > >> > [ 4.180494] systemd[1]: systemd 250.5+ running in system mode > (+PAM +AUDIT +SELINUX -APPARMOR +IMA -SMACK +SECCOMP -GCRYPT -GNUTLS > -OPENSSL +ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC +KMOD > -LIBCRYPTSETUP) > >> > > >> > "SELInux: Initializing" is not seen in dmesg. > >> > > >> > Please comment on what is missing? > >> > On Sat, Aug 5, 2023 at 1:12=E2=80=AFAM Ondrej Mosnacek <omosnace@red= hat.com> > wrote: > >> >> > >> >> On Sat, Aug 5, 2023 at 2:53=E2=80=AFAM Henry Zhang <henryzhang62@gm= ail.com> > wrote: > >> >> > > >> >> > Hi guys, > >> >> > > >> >> > I am porting selinux from kernel 4.14 to 5.15. Everything works > fine in kernel 4.14. > >> >> > keep same /etc/selinux/conf and kernel parameters to enable > SELinux. > >> >> > > >> >> > But the selinux_init() is not executed when kernel 5.15 boots > because no "SELinux: Initializing" is seen in dmesg. > >> >> > > >> >> > This selinux_init() is defined in > http://tomoyo.osdn.jp/cgi-bin/lxr/source/security/selinux/hooks.c > >> >> > > >> >> > DEFINE_LSM(selinux) =3D { > >> >> > 7288 .name =3D "selinux", > >> >> > 7289 .flags =3D LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIV= E, > >> >> > 7290 .enabled =3D &selinux_enabled_boot, > >> >> > 7291 .blobs =3D &selinux_blob_sizes, > >> >> > 7292 .init =3D selinux_init, > >> >> > 7293 }; > >> >> > > >> >> > My question is why the selinux_init() is not called when kernel > 5.15 boots up? > >> >> > >> >> Hi Henry, > >> >> > >> >> Can you share your kernel build config? If you don't know what it i= s > >> >> or how to get it, then the next question would be: How did you > >> >> obtain/build the kernel in question? > >> >> > >> >> -- > >> >> Ondrej Mosnacek > >> >> Senior Software Engineer, Linux Security - SELinux kernel > >> >> Red Hat, Inc. > >> >> > >> > >> > >> -- > >> Ondrej Mosnacek > >> Senior Software Engineer, Linux Security - SELinux kernel > >> Red Hat, Inc. > >> > > > -- > Ondrej Mosnacek > Senior Software Engineer, Linux Security - SELinux kernel > Red Hat, Inc. > > --0000000000005358f706026d2c76 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Ondrej,</div><div><br></div><div>Yes. my SELINUX is e= nabled finally after CONFIG_LSM=3D"integrity, selinux".</div><div= ><br></div><div>Do you guys manage meta-selinux?</div><div><br></div><div>-= ---henry<br></div><div><br></div></div><br><div class=3D"gmail_quote"><div = dir=3D"ltr" class=3D"gmail_attr">On Tue, Aug 8, 2023 at 8:01=E2=80=AFAM Ond= rej Mosnacek <<a href=3D"mailto:[email protected]">[email protected]= </a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:= 0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">= Oh, right, I completely overlooked the file attachment. Sorry!<br> <br> It seems your CONFIG_LSM is not set correctly. It is missing "selinux&= quot;<br> and the order seems wrong, but since you have most of the listed<br> modules disabled, you can set it to just:<br> <br> CONFIG_LSM=3D"integrity,selinux"<br> <br> Then the kernel should boot with SELinux enabled.<br> <br> On Tue, Aug 8, 2023 at 4:26=E2=80=AFPM Henry Zhang <<a href=3D"mailto:he= [email protected]" target=3D"_blank">[email protected]</a>> wrot= e:<br> ><br> > Ondrej,<br> ><br> > Thanks for your help!<br> > I am using Yocto embedded to compile. The kernel config file is copied= from /proc/config.gz in my linux device.<br> > The kernel function selinux_init() is not triggered when booting up.<b= r> ><br> > ---henry<br> ><br> ><br> > On Tue, Aug 8, 2023 at 1:17=E2=80=AFAM Ondrej Mosnacek <<a href=3D"= mailto:[email protected]" target=3D"_blank">[email protected]</a>> w= rote:<br> >><br> >> That is not a kernel config file. How are you building/installing = the<br> >> kernel? What Linux distribution (Fedora/CentOS/Ubuntu/...) is this= on?<br> >><br> >> On Mon, Aug 7, 2023 at 6:29=E2=80=AFPM Henry Zhang <<a href=3D"= mailto:[email protected]" target=3D"_blank">[email protected]</a>= > wrote:<br> >> ><br> >> > Ondrej,<br> >> ><br> >> > Attached is my kernel configuration file.<br> >> > ~# cat /etc/selinux/config<br> >> > # This file controls the state of SELinux on the system.<br> >> > # SELINUX=3D can take one of these three values:<br> >> > #=C2=A0 =C2=A0 =C2=A0enforcing - SELinux security policy is e= nforced.<br> >> > #=C2=A0 =C2=A0 =C2=A0permissive - SELinux prints warnings ins= tead of enforcing.<br> >> > #=C2=A0 =C2=A0 =C2=A0disabled - No SELinux policy is loaded.<= br> >> > SELINUX=3Denforcing<br> >> > # SELINUXTYPE=3D can take one of these values:<br> >> > #=C2=A0 =C2=A0 =C2=A0minimum - Minimum Security protection.<b= r> >> > #=C2=A0 =C2=A0 =C2=A0standard - Standard Security protection.= <br> >> > #=C2=A0 =C2=A0 =C2=A0mls - Multi Level Security protection.<b= r> >> > #=C2=A0 =C2=A0 =C2=A0targeted - Targeted processes are protec= ted.<br> >> > #=C2=A0 =C2=A0 =C2=A0mcs - Multi Category Security protection= .<br> >> > SELINUXTYPE=3Dmcs<br> >> ><br> >> > # sestatus<br> >> > SELinux status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0disabled<br> >> ><br> >> > # getenforce<br> >> > Disabled<br> >> ><br> >> > # setenforce 1<br> >> > setenforce: SELinux is disabled<br> >> ><br> >> > # dmesg|grep SELi<br> >> > [=C2=A0 =C2=A0 5.604171] systemd[1]: Starting SELinux init fo= r /dev service loading...<br> >> ><br> >> > # dmesg|grep SELI<br> >> > [=C2=A0 =C2=A0 4.180494] systemd[1]: systemd 250.5+ running i= n system mode (+PAM +AUDIT +SELINUX -APPARMOR +IMA -SMACK +SECCOMP -GCRYPT = -GNUTLS -OPENSSL +ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC +KMOD = -LIBCRYPTSETUP)<br> >> ><br> >> > "SELInux: Initializing" is not seen in dmesg.<br> >> ><br> >> > Please comment on what is missing?<br> >> > On Sat, Aug 5, 2023 at 1:12=E2=80=AFAM Ondrej Mosnacek <<a= href=3D"mailto:[email protected]" target=3D"_blank">[email protected]<= /a>> wrote:<br> >> >><br> >> >> On Sat, Aug 5, 2023 at 2:53=E2=80=AFAM Henry Zhang <<a= href=3D"mailto:[email protected]" target=3D"_blank">henryzhang62@gmai= l.com</a>> wrote:<br> >> >> ><br> >> >> > Hi guys,<br> >> >> ><br> >> >> > I am porting selinux from kernel 4.14 to 5.15. Every= thing works fine in kernel 4.14.<br> >> >> > keep same /etc/selinux/conf and kernel parameters to= enable SELinux.<br> >> >> ><br> >> >> > But the selinux_init() is not executed when kernel 5= .15 boots because no "SELinux: Initializing" is seen in dmesg.<br= > >> >> ><br> >> >> > This selinux_init() is defined in <a href=3D"http://= tomoyo.osdn.jp/cgi-bin/lxr/source/security/selinux/hooks.c" rel=3D"noreferr= er" target=3D"_blank">http://tomoyo.osdn.jp/cgi-bin/lxr/source/security/sel= inux/hooks.c</a><br> >> >> ><br> >> >> >=C2=A0 DEFINE_LSM(selinux) =3D {<br> >> >> > 7288=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.name =3D &quo= t;selinux",<br> >> >> > 7289=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.flags =3D LSM= _FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,<br> >> >> > 7290=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.enabled =3D &= amp;selinux_enabled_boot,<br> >> >> > 7291=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.blobs =3D &am= p;selinux_blob_sizes,<br> >> >> > 7292=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.init =3D seli= nux_init,<br> >> >> > 7293 };<br> >> >> ><br> >> >> > My question is why the selinux_init() is not called = when kernel 5.15 boots up?<br> >> >><br> >> >> Hi Henry,<br> >> >><br> >> >> Can you share your kernel build config? If you don't = know what it is<br> >> >> or how to get it, then the next question would be: How di= d you<br> >> >> obtain/build the kernel in question?<br> >> >><br> >> >> --<br> >> >> Ondrej Mosnacek<br> >> >> Senior Software Engineer, Linux Security - SELinux kernel= <br> >> >> Red Hat, Inc.<br> >> >><br> >><br> >><br> >> --<br> >> Ondrej Mosnacek<br> >> Senior Software Engineer, Linux Security - SELinux kernel<br> >> Red Hat, Inc.<br> >><br> <br> <br> -- <br> Ondrej Mosnacek<br> Senior Software Engineer, Linux Security - SELinux kernel<br> Red Hat, Inc.<br> <br> </blockquote></div> --0000000000005358f706026d2c76-- --===============2751922167176655420== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2VsaW51eCBt YWlsaW5nIGxpc3QgLS0gc2VsaW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1YnNj cmliZSBzZW5kIGFuIGVtYWlsIHRvIHNlbGludXgtbGVhdmVAbGlzdHMuZmVkb3JhcHJvamVjdC5v cmcKRmVkb3JhIENvZGUgb2YgQ29uZHVjdDogaHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qub3Jn L2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LwpMaXN0IEd1aWRlbGluZXM6IGh0dHBzOi8v ZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWlsaW5nX2xpc3RfZ3VpZGVsaW5lcwpMaXN0IEFyY2hp dmVzOiBodHRwczovL2xpc3RzLmZlZG9yYXByb2plY3Qub3JnL2FyY2hpdmVzL2xpc3Qvc2VsaW51 eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpEbyBub3QgcmVwbHkgdG8gc3BhbSwgcmVwb3J0IGl0 OiBodHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFzdHJ1Y3R1cmUvbmV3X2lzc3VlCg== --===============2751922167176655420==--