CentOS virt - Feb 2017 - Selinux Problem

Selinux is way too complicated for Xen environment, there are other alternative
to security your system than SeLinux.

Xlord

-----Original Message-----
From: CentOS-virt [mailto:centos-virt-bounces at centos.org] On Behalf Of George
Dunlap
Sent: Monday, January 30, 2017 7:23 PM
To: Discussion about the virtualization on CentOS <centos-virt at
centos.org>
Subject: Re: [CentOS-virt] Selinux Problem

On Thu, Jan 26, 2017 at 8:08 PM, G?nther J. Niederwimmer <gjn at
gjn.priv.at> wrote:
> Hello,
>
> Am Donnerstag, 26. Januar 2017, 10:54:20 CET schrieb Johnny Hughes:
>> On 01/26/2017 10:06 AM, G?nther J. Niederwimmer wrote:
>> > Hello,
>> >
>> > CentOS 7.(3) Xen 4.4,
>> >
>> > Can I find any Doc for selinux with XEN, I found many Problems
with
>> > selinux on Dom0 ?
>> >
>> > Or have I to disable selinux when I install XEN.
>> >
>> > Thank's for a answer.
>>
>> We have not tried to make xen work with selinux on Dom0 .. in fact 
>> our
>> documentation:
>>
>> https://wiki.centos.org/Manuals/ReleaseNotes/Xen4-01
>>
>>  says:
>>
>> SELinux support is disabled, and you might need to disable SELinux on 
>> the dom0 for some operations; primarily when using qemu-xen and 
>> blktap backed storage.
>
> This is not the best Situation, but when I have no other way I have to 
> disable selinux :-(.
I think that comment may be a little old.  I do try to support SELinux
-- the smoke tests I use before pushing changes have it enabled by default, and
they use both qemu-xen and blktap.

But it's difficult to help debug problems when you haven't even said
what problem(s) you're having. :-)

Please be sure to include the output of `dmesg`, `xl dmesg`, your xl.cfg, and
/var/log/audit/audit.log.

Thanks,
 -George
_______________________________________________
CentOS-virt mailing list
CentOS-virt at centos.org
https://lists.centos.org/mailman/listinfo/centos-virt

On Thu, Feb 2, 2017 at 4:46 PM, -=X.L.O.R.D=- <xlord.sl at gmail.com>
wrote:
> Selinux is way too complicated for Xen environment, there are other
alternative to security your system than SeLinux.
But the core repository for SELinux has rules for all the Xen
functionality, which CentOS mostly inherits.  This is primarily, I
think, because Fedora has Xen packages (and also enables SELinux by
default).

 -George

George,
Selinux is a project originated from NSA and Linux adopted that in early
kernel 2.4.x which is far more advance if you required very persistent
object security on disk read and write. 
Otherwise, it is really not necessary.

Xlord
-----Original Message-----
From: CentOS-virt [mailto:centos-virt-bounces at centos.org] On Behalf Of
George Dunlap
Sent: Friday, February 3, 2017 1:19 AM
To: Discussion about the virtualization on CentOS <centos-virt at
centos.org>
Subject: Re: [CentOS-virt] Selinux Problem

On Thu, Feb 2, 2017 at 4:46 PM, -=X.L.O.R.D=- <xlord.sl at gmail.com>
wrote:
> Selinux is way too complicated for Xen environment, there are other
alternative to security your system than SeLinux.

But the core repository for SELinux has rules for all the Xen functionality,
which CentOS mostly inherits.  This is primarily, I think, because Fedora
has Xen packages (and also enables SELinux by default).

 -George
_______________________________________________
CentOS-virt mailing list
CentOS-virt at centos.org
https://lists.centos.org/mailman/listinfo/centos-virt