selinux May 2025

selinux@lists.fedoraproject.org

1 participants
7 discussions

Setting context in early boot
by Frederick Grose 11 Dec '25

11 Dec '25

I have a general scoping question on setting SELinux context on files/directories during early boot. I'm working on a feature in dracut to implement general stacking of filesystem hierarchies via OverlayFS for the root filesystem within the dmsquash-live-root module. How should I address the setting of context for new files, directories, or links needed to assemble the components for the OverlayFS mount? For example, when I mkdir -m 0755 -p --context=system_u:object_r:root_t:s0 /run/somemountpoint I get this warning in the journal: mkdir: warning: ignoring --context; it requires an SELinux/SMACK-enabled kernel If the SELinux code is not active at this early stage, what is to be done?

3 3

SELinux is preventing systemd-tmpfile from using the sys_resource capability.
by Manfred Lotz 31 Jul '25

31 Jul '25

Hi there, Running Fedora 31 and SELinux still in permissive mode I got SELinux is preventing systemd-tmpfile from using the sys_resource capability. ***** Plugin sys_resource (91.4 confidence) suggests ********************** If you do not want processes to require capabilities to use up all the system resources on your syste> Then you need to diagnose why your system is running out of system resources and fix the problem. According to /usr/include/linux/capability.h, sys_resource is required to: /* Override resource limits. Set resource limits. */ /* Override quota limits. */ /* Override reserved space on ext2 filesystem */ /* Modify data journaling mode on ext3 filesystem (uses journaling resources) */ /* NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too */ /* Override size restrictions on IPC message queues */ /* Allow more than 64hz interrupts from the real-time clock */ /* Override max number of consoles on console allocation */ /* Override max number of keymaps */ Do fix the cause of the SYS_RESOURCE on your system. ***** Plugin catchall (9.59 confidence) suggests ************************** If you believe that systemd-tmpfile should have the sys_resource capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd-tmpfile' --raw | audit2allow -M my-systemdtmpfile # semodule -X 300 -i my-systemdtmpfile.pp I also see type=AVC msg=audit(1569414241.452:321): avc: denied { sys_resource } for pid=17409 comm="systemd-tmpfile" capability=24 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=capability permissive=1 type=AVC msg=audit(1569414241.452:322): avc: denied { setrlimit } for pid=17409 comm="systemd-tmpfile" scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=process permissive=1 I have to admit I don't know how to judge this. Before I do anything here I like to understand. -- Manfred

5 5

Apologies, wrong forum!
by Kalevi Kolttonen 13 May '25

13 May '25

Hello! ChatGPT lied to me again. It told me to send patches to this list. I now know I will have to send them to selinux(a)vger.kernel.org instead. Sorry for the noise. br, KK

1 0

[PATCH] Trivial fix comment
by Kalevi Kolttonen 12 May '25

12 May '25

The patch is attached.

1 0

Could early_security_init(void) return void?
by Kalevi Kolttonen 12 May '25

12 May '25

Hello! I am just going through the file linux/security/security.c. Could the function early_security_init(void) return void instead of int? After all, it always returns 0 and the only call site in init/main.c does not care about the return value. br, KK

1 1

[PATCH] Fix variable type to be 'bool' instead of incorrect 'int'.
by Kalevi Kolttonen 12 May '25

12 May '25

The patch is attached.

1 0

[PATCH] A trivial simplification to shorten the code a bit.
by Kalevi Kolttonen 12 May '25

12 May '25

The trivial simplification patch is attached. br, KK

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux May 2025