selinux

selinux@lists.fedoraproject.org

4898 discussions

Re: Setting context in early boot
by Frederick Grose 30 Jan '26

30 Jan '26

Some additional experimental findings: One may consider labeling these overlay directories during the initramfs phase of boot to avoid the post switch-root service. This would involve using load-policy -i and setting the SELinux mode to Permissive, as the current Fedora policy is not suitable for the initramfs phase of operation. However, this approach would still require a post switch-root directive to `setenforce` to the `Enforcing` default. This is because the kernel only interprets the `enforcing={0|1}` parameter or the `/etc/selinux/config SELINUX={permissive|enforcing}` setting *once* and very early during each boot. Consequently, even if `setenforce Permissive` or `echo 0 > /sys/fs/selinux/enforcing` is issued during the initramfs phase, certain critical components will still suffer denials that lead to failed boots. Permissive mode must be set from the very beginning to enable successful initramfs labeling of the directories within the context of an unsuitable policy.

1 1

Setting context in early boot
by Frederick Grose 11 Dec '25

11 Dec '25

I have a general scoping question on setting SELinux context on files/directories during early boot. I'm working on a feature in dracut to implement general stacking of filesystem hierarchies via OverlayFS for the root filesystem within the dmsquash-live-root module. How should I address the setting of context for new files, directories, or links needed to assemble the components for the OverlayFS mount? For example, when I mkdir -m 0755 -p --context=system_u:object_r:root_t:s0 /run/somemountpoint I get this warning in the journal: mkdir: warning: ignoring --context; it requires an SELinux/SMACK-enabled kernel If the SELinux code is not active at this early stage, what is to be done?

3 3

Migration from GitHub to Fedora Forge
by Artur Manuel 08 Dec '25

08 Dec '25

Good day, I'm curious to know if the SELinux team for Fedora would be willing to switch to Fedora Forge, which is a Forgejo instance hosted by the Fedora Project. Fedora teams, SIGs and WGs are moving to Fedora Forge from Pagure, and other scattered Git platforms. Holding out wouldn't really do anything other than separate the Fedora SELinux team from the Fedora project in my opinion. Furthermore, Zig recently departed from GitHub and moved to Codeberg, a Forgejo instance as GitHub has slowly been degrading as a platform[1]. I believe that by the time it would be embraced, it would have become unbearable to use. I think it would be better to depart now before it becomes central to the SELinux team. I would be glad to hear any opinions on this subject. Cheers, Artur Manuel amadaluzia [1]: https://ziglang.org/news/migrating-from-github-to-codeberg/

4 4

How to handle connecting to supervisord port 9001
by Orion Poplawski 04 Oct '25

04 Oct '25

cobblerd assumes that supervisord will be listening on port 9001. This isn't enabled by default, but is a commonly used port for supervisord. complicating things is apparently port 9001 is used by tor, and is actually registered in selinux: network_port(tor, tcp,6969,s0, tcp,9001,s0, tcp,9030,s0, tcp,9050,s0, tcp,9051,s0, tcp,9150,s0) So how should I give cobblerd access to connect to port 9001? Give it access to tor_port_t? Something else? -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

1 0

userdom_user_content_access_template in refpolicy vs Fedora policy
by Daniel Hast 31 Jul '25

31 Jul '25

Hello, I'm working on some SELinux policy that ideally should be compatible with both refpolicy and Fedora's SELinux policy. I see that refpolicy has a "userdom_user_content_access_template" template that provides a nice standard interface for granting user content access to application domains: https://github.com/SELinuxProject/refpolicy/blob/e570a8b238a4f15cbf9d5f1f6d… I'd like to use this, but it doesn't seem to exist in Fedora's policy. Is there a reason why Fedora's policy doesn't have this template? I'd be happy to make a PR to add it, but I figured I'd ask here first. Thanks, Daniel

1 0

SELinux is preventing systemd-tmpfile from using the sys_resource capability.
by Manfred Lotz 31 Jul '25

31 Jul '25

Hi there, Running Fedora 31 and SELinux still in permissive mode I got SELinux is preventing systemd-tmpfile from using the sys_resource capability. ***** Plugin sys_resource (91.4 confidence) suggests ********************** If you do not want processes to require capabilities to use up all the system resources on your syste> Then you need to diagnose why your system is running out of system resources and fix the problem. According to /usr/include/linux/capability.h, sys_resource is required to: /* Override resource limits. Set resource limits. */ /* Override quota limits. */ /* Override reserved space on ext2 filesystem */ /* Modify data journaling mode on ext3 filesystem (uses journaling resources) */ /* NOTE: ext2 honors fsuid when checking for resource overrides, so you can override using fsuid too */ /* Override size restrictions on IPC message queues */ /* Allow more than 64hz interrupts from the real-time clock */ /* Override max number of consoles on console allocation */ /* Override max number of keymaps */ Do fix the cause of the SYS_RESOURCE on your system. ***** Plugin catchall (9.59 confidence) suggests ************************** If you believe that systemd-tmpfile should have the sys_resource capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd-tmpfile' --raw | audit2allow -M my-systemdtmpfile # semodule -X 300 -i my-systemdtmpfile.pp I also see type=AVC msg=audit(1569414241.452:321): avc: denied { sys_resource } for pid=17409 comm="systemd-tmpfile" capability=24 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=capability permissive=1 type=AVC msg=audit(1569414241.452:322): avc: denied { setrlimit } for pid=17409 comm="systemd-tmpfile" scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:system_r:systemd_tmpfiles_t:s0 tclass=process permissive=1 I have to admit I don't know how to judge this. Before I do anything here I like to understand. -- Manfred

5 5

zabbix agent?
by lejeczek 18 Jun '25

18 Jun '25

Hi guys. Zabbix on Centos anyone? I'm on Centos 9 with: zabbix-agent-6.0.39-1.el9.x86_64 zabbix-server-6.0.39-1.el9.noarch zabbix-selinux-6.0.39-1.el9.noarch with some SE denials: ... SELinux is preventing /usr/bin/who from connectto access on the unix_stream_socket /run/systemd/userdb/io.systemd.DynamicUser. For complete SELinux messages run: sealert -l d7152358-4998-4950-aec4-fb9e5b0e7b49 allow zabbix_agent_t kernel_t:unix_stream_socket connectto; and I wonder if perhaps someone has seen it before and knows if this is can be helped with zabbix's config? Or if not - should a policy addition allow that 'agent' is asking for ? though Zabbix - from EPEL - comes with its own policies. thanks, L.

1 0

Apologies, wrong forum!
by Kalevi Kolttonen 13 May '25

13 May '25

Hello! ChatGPT lied to me again. It told me to send patches to this list. I now know I will have to send them to selinux(a)vger.kernel.org instead. Sorry for the noise. br, KK

1 0

[PATCH] Trivial fix comment
by Kalevi Kolttonen 12 May '25

12 May '25

The patch is attached.

1 0

Could early_security_init(void) return void?
by Kalevi Kolttonen 12 May '25

12 May '25

Hello! I am just going through the file linux/security/security.c. Could the function early_security_init(void) return void instead of int? After all, it always returns 0 and the only call site in init/main.c does not care about the return value. br, KK

1 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

selinux