Re: selinux_init() is not executed in booting in kernel 5.15
Henry Zhang <[email protected]> Thu, 10 Aug 2023 00:40:40 -0700
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <CANTW0yqT57N6qUoQmYA33fEhiA8qe-rexquxXZNYk5L=NySS8Q@mail.gmail.com> |
--===============8208484111268138585== Content-Type: multipart/alternative; boundary="0000000000003574e706028cb7ed" --0000000000003574e706028cb7ed Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Ondrej, Yes. https://github.com/ni/meta-selinux is used to manage SElinux in the Yocto environment. SELinux is quite complex. After the SELinux is enabled, I have to deal with the policy. Another challenge is to find out which application causes a denied AVC message in /var/log/audit/audit.log. Do you have any good suggestions for that challenge? ----henry On Wed, Aug 9, 2023 at 12:46=E2=80=AFAM Ondrej Mosnacek <[email protected]= m> wrote: > You mean https://github.com/ni/meta-selinux ? If so, none of us [Red > Hat SELinux engineers] works on it, AFAIK. > > > On Tue, Aug 8, 2023 at 8:03=E2=80=AFPM Henry Zhang <[email protected]= m> wrote: > > > > Ondrej, > > > > Yes. my SELINUX is enabled finally after CONFIG_LSM=3D"integrity, selin= ux". > > > > Do you guys manage meta-selinux? > > > > ----henry > > > > > > On Tue, Aug 8, 2023 at 8:01=E2=80=AFAM Ondrej Mosnacek <omosnace@redhat= .com> > wrote: > >> > >> Oh, right, I completely overlooked the file attachment. Sorry! > >> > >> It seems your CONFIG_LSM is not set correctly. It is missing "selinux" > >> and the order seems wrong, but since you have most of the listed > >> modules disabled, you can set it to just: > >> > >> CONFIG_LSM=3D"integrity,selinux" > >> > >> Then the kernel should boot with SELinux enabled. > >> > >> On Tue, Aug 8, 2023 at 4:26=E2=80=AFPM Henry Zhang <henryzhang62@gmail= .com> > wrote: > >> > > >> > Ondrej, > >> > > >> > Thanks for your help! > >> > I am using Yocto embedded to compile. The kernel config file is > copied from /proc/config.gz in my linux device. > >> > The kernel function selinux_init() is not triggered when booting up. > >> > > >> > ---henry > >> > > >> > > >> > On Tue, Aug 8, 2023 at 1:17=E2=80=AFAM Ondrej Mosnacek <omosnace@red= hat.com> > wrote: > >> >> > >> >> That is not a kernel config file. How are you building/installing t= he > >> >> kernel? What Linux distribution (Fedora/CentOS/Ubuntu/...) is this > on? > >> >> > >> >> On Mon, Aug 7, 2023 at 6:29=E2=80=AFPM Henry Zhang <henryzhang62@gm= ail.com> > wrote: > >> >> > > >> >> > Ondrej, > >> >> > > >> >> > Attached is my kernel configuration file. > >> >> > ~# cat /etc/selinux/config > >> >> > # This file controls the state of SELinux on the system. > >> >> > # SELINUX=3D can take one of these three values: > >> >> > # enforcing - SELinux security policy is enforced. > >> >> > # permissive - SELinux prints warnings instead of enforcing. > >> >> > # disabled - No SELinux policy is loaded. > >> >> > SELINUX=3Denforcing > >> >> > # SELINUXTYPE=3D can take one of these values: > >> >> > # minimum - Minimum Security protection. > >> >> > # standard - Standard Security protection. > >> >> > # mls - Multi Level Security protection. > >> >> > # targeted - Targeted processes are protected. > >> >> > # mcs - Multi Category Security protection. > >> >> > SELINUXTYPE=3Dmcs > >> >> > > >> >> > # sestatus > >> >> > SELinux status: disabled > >> >> > > >> >> > # getenforce > >> >> > Disabled > >> >> > > >> >> > # setenforce 1 > >> >> > setenforce: SELinux is disabled > >> >> > > >> >> > # dmesg|grep SELi > >> >> > [ 5.604171] systemd[1]: Starting SELinux init for /dev service > loading... > >> >> > > >> >> > # dmesg|grep SELI > >> >> > [ 4.180494] systemd[1]: systemd 250.5+ running in system mode > (+PAM +AUDIT +SELINUX -APPARMOR +IMA -SMACK +SECCOMP -GCRYPT -GNUTLS > -OPENSSL +ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC +KMOD > -LIBCRYPTSETUP) > >> >> > > >> >> > "SELInux: Initializing" is not seen in dmesg. > >> >> > > >> >> > Please comment on what is missing? > >> >> > On Sat, Aug 5, 2023 at 1:12=E2=80=AFAM Ondrej Mosnacek < > [email protected]> wrote: > >> >> >> > >> >> >> On Sat, Aug 5, 2023 at 2:53=E2=80=AFAM Henry Zhang < > [email protected]> wrote: > >> >> >> > > >> >> >> > Hi guys, > >> >> >> > > >> >> >> > I am porting selinux from kernel 4.14 to 5.15. Everything work= s > fine in kernel 4.14. > >> >> >> > keep same /etc/selinux/conf and kernel parameters to enable > SELinux. > >> >> >> > > >> >> >> > But the selinux_init() is not executed when kernel 5.15 boots > because no "SELinux: Initializing" is seen in dmesg. > >> >> >> > > >> >> >> > This selinux_init() is defined in > http://tomoyo.osdn.jp/cgi-bin/lxr/source/security/selinux/hooks.c > >> >> >> > > >> >> >> > DEFINE_LSM(selinux) =3D { > >> >> >> > 7288 .name =3D "selinux", > >> >> >> > 7289 .flags =3D LSM_FLAG_LEGACY_MAJOR | > LSM_FLAG_EXCLUSIVE, > >> >> >> > 7290 .enabled =3D &selinux_enabled_boot, > >> >> >> > 7291 .blobs =3D &selinux_blob_sizes, > >> >> >> > 7292 .init =3D selinux_init, > >> >> >> > 7293 }; > >> >> >> > > >> >> >> > My question is why the selinux_init() is not called when kerne= l > 5.15 boots up? > >> >> >> > >> >> >> Hi Henry, > >> >> >> > >> >> >> Can you share your kernel build config? If you don't know what i= t > is > >> >> >> or how to get it, then the next question would be: How did you > >> >> >> obtain/build the kernel in question? > >> >> >> > >> >> >> -- > >> >> >> Ondrej Mosnacek > >> >> >> Senior Software Engineer, Linux Security - SELinux kernel > >> >> >> Red Hat, Inc. > >> >> >> > >> >> > >> >> > >> >> -- > >> >> Ondrej Mosnacek > >> >> Senior Software Engineer, Linux Security - SELinux kernel > >> >> Red Hat, Inc. > >> >> > >> > >> > >> -- > >> Ondrej Mosnacek > >> Senior Software Engineer, Linux Security - SELinux kernel > >> Red Hat, Inc. > >> > > > -- > Ondrej Mosnacek > Senior Software Engineer, Linux Security - SELinux kernel > Red Hat, Inc. > > --0000000000003574e706028cb7ed Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Ondrej,</div><div><br></div><div>Yes.=C2=A0 <a href= =3D"https://github.com/ni/meta-selinux" target=3D"_blank">https://github.co= m/ni/meta-selinux</a> is used to manage SElinux in the Yocto environment.<b= r></div><div>SELinux is quite complex. After the SELinux is enabled, I have= to deal with the policy.</div><div><br></div><div>Another challenge is to = find out which application causes a denied AVC message in /var/log/audit/au= dit.log.</div><div>Do you have any good suggestions for that challenge?</di= v><div><br></div><div>----henry=C2=A0 <br></div><div><br></div><div><br></d= iv><div><br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" cla= ss=3D"gmail_attr">On Wed, Aug 9, 2023 at 12:46=E2=80=AFAM Ondrej Mosnacek &= lt;<a href=3D"mailto:[email protected]" target=3D"_blank">omosnace@redhat= .com</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"mar= gin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1= ex">You mean <a href=3D"https://github.com/ni/meta-selinux" rel=3D"noreferr= er" target=3D"_blank">https://github.com/ni/meta-selinux</a> ? If so, none = of us [Red<br> Hat SELinux engineers] works on it, AFAIK.<br> <br> <br> On Tue, Aug 8, 2023 at 8:03=E2=80=AFPM Henry Zhang <<a href=3D"mailto:he= [email protected]" target=3D"_blank">[email protected]</a>> wrot= e:<br> ><br> > Ondrej,<br> ><br> > Yes. my SELINUX is enabled finally after CONFIG_LSM=3D"integrity,= selinux".<br> ><br> > Do you guys manage meta-selinux?<br> ><br> > ----henry<br> ><br> ><br> > On Tue, Aug 8, 2023 at 8:01=E2=80=AFAM Ondrej Mosnacek <<a href=3D"= mailto:[email protected]" target=3D"_blank">[email protected]</a>> w= rote:<br> >><br> >> Oh, right, I completely overlooked the file attachment. Sorry!<br> >><br> >> It seems your CONFIG_LSM is not set correctly. It is missing "= ;selinux"<br> >> and the order seems wrong, but since you have most of the listed<b= r> >> modules disabled, you can set it to just:<br> >><br> >> CONFIG_LSM=3D"integrity,selinux"<br> >><br> >> Then the kernel should boot with SELinux enabled.<br> >><br> >> On Tue, Aug 8, 2023 at 4:26=E2=80=AFPM Henry Zhang <<a href=3D"= mailto:[email protected]" target=3D"_blank">[email protected]</a>= > wrote:<br> >> ><br> >> > Ondrej,<br> >> ><br> >> > Thanks for your help!<br> >> > I am using Yocto embedded to compile. The kernel config file = is copied from /proc/config.gz in my linux device.<br> >> > The kernel function selinux_init() is not triggered when boot= ing up.<br> >> ><br> >> > ---henry<br> >> ><br> >> ><br> >> > On Tue, Aug 8, 2023 at 1:17=E2=80=AFAM Ondrej Mosnacek <<a= href=3D"mailto:[email protected]" target=3D"_blank">[email protected]<= /a>> wrote:<br> >> >><br> >> >> That is not a kernel config file. How are you building/in= stalling the<br> >> >> kernel? What Linux distribution (Fedora/CentOS/Ubuntu/...= ) is this on?<br> >> >><br> >> >> On Mon, Aug 7, 2023 at 6:29=E2=80=AFPM Henry Zhang <<a= href=3D"mailto:[email protected]" target=3D"_blank">henryzhang62@gmai= l.com</a>> wrote:<br> >> >> ><br> >> >> > Ondrej,<br> >> >> ><br> >> >> > Attached is my kernel configuration file.<br> >> >> > ~# cat /etc/selinux/config<br> >> >> > # This file controls the state of SELinux on the sys= tem.<br> >> >> > # SELINUX=3D can take one of these three values:<br> >> >> > #=C2=A0 =C2=A0 =C2=A0enforcing - SELinux security po= licy is enforced.<br> >> >> > #=C2=A0 =C2=A0 =C2=A0permissive - SELinux prints war= nings instead of enforcing.<br> >> >> > #=C2=A0 =C2=A0 =C2=A0disabled - No SELinux policy is= loaded.<br> >> >> > SELINUX=3Denforcing<br> >> >> > # SELINUXTYPE=3D can take one of these values:<br> >> >> > #=C2=A0 =C2=A0 =C2=A0minimum - Minimum Security prot= ection.<br> >> >> > #=C2=A0 =C2=A0 =C2=A0standard - Standard Security pr= otection.<br> >> >> > #=C2=A0 =C2=A0 =C2=A0mls - Multi Level Security prot= ection.<br> >> >> > #=C2=A0 =C2=A0 =C2=A0targeted - Targeted processes a= re protected.<br> >> >> > #=C2=A0 =C2=A0 =C2=A0mcs - Multi Category Security p= rotection.<br> >> >> > SELINUXTYPE=3Dmcs<br> >> >> ><br> >> >> > # sestatus<br> >> >> > SELinux status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0disabled<br> >> >> ><br> >> >> > # getenforce<br> >> >> > Disabled<br> >> >> ><br> >> >> > # setenforce 1<br> >> >> > setenforce: SELinux is disabled<br> >> >> ><br> >> >> > # dmesg|grep SELi<br> >> >> > [=C2=A0 =C2=A0 5.604171] systemd[1]: Starting SELinu= x init for /dev service loading...<br> >> >> ><br> >> >> > # dmesg|grep SELI<br> >> >> > [=C2=A0 =C2=A0 4.180494] systemd[1]: systemd 250.5+ = running in system mode (+PAM +AUDIT +SELINUX -APPARMOR +IMA -SMACK +SECCOMP= -GCRYPT -GNUTLS -OPENSSL +ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IP= TC +KMOD -LIBCRYPTSETUP)<br> >> >> ><br> >> >> > "SELInux: Initializing" is not seen in dme= sg.<br> >> >> ><br> >> >> > Please comment on what is missing?<br> >> >> > On Sat, Aug 5, 2023 at 1:12=E2=80=AFAM Ondrej Mosnac= ek <<a href=3D"mailto:[email protected]" target=3D"_blank">omosnace@re= dhat.com</a>> wrote:<br> >> >> >><br> >> >> >> On Sat, Aug 5, 2023 at 2:53=E2=80=AFAM Henry Zha= ng <<a href=3D"mailto:[email protected]" target=3D"_blank">henryzha= [email protected]</a>> wrote:<br> >> >> >> ><br> >> >> >> > Hi guys,<br> >> >> >> ><br> >> >> >> > I am porting selinux from kernel 4.14 to 5.= 15. Everything works fine in kernel 4.14.<br> >> >> >> > keep same /etc/selinux/conf and kernel para= meters to enable SELinux.<br> >> >> >> ><br> >> >> >> > But the selinux_init() is not executed when= kernel 5.15 boots because no "SELinux: Initializing" is seen in = dmesg.<br> >> >> >> ><br> >> >> >> > This selinux_init() is defined in <a href= =3D"http://tomoyo.osdn.jp/cgi-bin/lxr/source/security/selinux/hooks.c" rel= =3D"noreferrer" target=3D"_blank">http://tomoyo.osdn.jp/cgi-bin/lxr/source/= security/selinux/hooks.c</a><br> >> >> >> ><br> >> >> >> >=C2=A0 DEFINE_LSM(selinux) =3D {<br> >> >> >> > 7288=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.name= =3D "selinux",<br> >> >> >> > 7289=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.flag= s =3D LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,<br> >> >> >> > 7290=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.enab= led =3D &selinux_enabled_boot,<br> >> >> >> > 7291=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.blob= s =3D &selinux_blob_sizes,<br> >> >> >> > 7292=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0.init= =3D selinux_init,<br> >> >> >> > 7293 };<br> >> >> >> ><br> >> >> >> > My question is why the selinux_init() is no= t called when kernel 5.15 boots up?<br> >> >> >><br> >> >> >> Hi Henry,<br> >> >> >><br> >> >> >> Can you share your kernel build config? If you d= on't know what it is<br> >> >> >> or how to get it, then the next question would b= e: How did you<br> >> >> >> obtain/build the kernel in question?<br> >> >> >><br> >> >> >> --<br> >> >> >> Ondrej Mosnacek<br> >> >> >> Senior Software Engineer, Linux Security - SELin= ux kernel<br> >> >> >> Red Hat, Inc.<br> >> >> >><br> >> >><br> >> >><br> >> >> --<br> >> >> Ondrej Mosnacek<br> >> >> Senior Software Engineer, Linux Security - SELinux kernel= <br> >> >> Red Hat, Inc.<br> >> >><br> >><br> >><br> >> --<br> >> Ondrej Mosnacek<br> >> Senior Software Engineer, Linux Security - SELinux kernel<br> >> Red Hat, Inc.<br> >><br> <br> <br> --<br> Ondrej Mosnacek<br> Senior Software Engineer, Linux Security - SELinux kernel<br> Red Hat, Inc.<br> <br> </blockquote></div> --0000000000003574e706028cb7ed-- --===============8208484111268138585== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2VsaW51eCBt YWlsaW5nIGxpc3QgLS0gc2VsaW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1YnNj cmliZSBzZW5kIGFuIGVtYWlsIHRvIHNlbGludXgtbGVhdmVAbGlzdHMuZmVkb3JhcHJvamVjdC5v cmcKRmVkb3JhIENvZGUgb2YgQ29uZHVjdDogaHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qub3Jn L2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LwpMaXN0IEd1aWRlbGluZXM6IGh0dHBzOi8v ZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWlsaW5nX2xpc3RfZ3VpZGVsaW5lcwpMaXN0IEFyY2hp dmVzOiBodHRwczovL2xpc3RzLmZlZG9yYXByb2plY3Qub3JnL2FyY2hpdmVzL2xpc3Qvc2VsaW51 eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpEbyBub3QgcmVwbHkgdG8gc3BhbSwgcmVwb3J0IGl0 OiBodHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFzdHJ1Y3R1cmUvbmV3X2lzc3VlCg== --===============8208484111268138585==--