<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<div dir="ltr">
<div></div>
<div>
<div><br style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px">
<span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important">> I assume you mean SLES 15 SP3 and not Leap 15.3?</span></div>
<div dir="ltr"><br>
</div>
<div>Yes, this is the SLE mailing list.</div>
<div><br style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px">
<span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important">> In short: as documented since a long time, SLES does not come with a </span><span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important">SELinux
policy</span></div>
<div dir="ltr"><span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important"><br>
</span></div>
<div dir="ltr"><span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important">The release notes only states that 15.3 does support SELinux, it should probably add a warning that
it lacks default policies.</span></div>
<div dir="ltr"><br>
</div>
<div><span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important">> I don't know why this option is visible in YaST, as only SLE Micro comes </span><span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important">with
full SELinux support.</span><br>
</div>
<div dir="ltr"><span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important"><br>
</span></div>
<div dir="ltr"><span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important">What is SLE Micro?</span></div>
<div dir="ltr"><span style="caret-color: rgb(0, 0, 0); font-family: -apple-system, HelveticaNeue; font-size: 15.546666145324707px; display: inline !important"><br>
</span></div>
<div dir="ltr"><span style="font-size: 15.546666145324707px;">Gruss</span></div>
<div dir="ltr"><span style="font-size: 15.546666145324707px;">Bernd</span></div>
<div id="ms-outlook-mobile-signature">
<div style="direction: ltr">-- </div>
<div style="direction: ltr">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> sle-beta <sle-beta-bounces+ecki=zusammenkunft.net@lists.suse.com> im Auftrag von Thorsten Kukuk <kukuk@suse.de><br>
<b>Gesendet:</b> Sunday, May 16, 2021 12:53:33 PM<br>
<b>An:</b> sle-beta@lists.suse.com <sle-beta@lists.suse.com><br>
<b>Betreff:</b> Re: 15.3 PRC: SE Linux Policy loading failed</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText"><br>
Hi,<br>
<br>
On Sat, May 15, Bernd wrote:<br>
<br>
> Hello,<br>
> <br>
> I just installed 15.3 PRC in a Hyper-V VM (UEFI with secure boot) to do some<br>
> qualification testing. I used the Full ISO and installed SLES with only the<br>
> base system module in minimal configuration and no registration. In the<br>
> installer I enabled SELinux in advisory mode.<br>
<br>
I assume you mean SLES 15 SP3 and not Leap 15.3?<br>
It's really helpful to use correct product and version names, own created<br>
version numbers only lead to confusion and wrong advice.<br>
<br>
In short: as documented since a long time, SLES does not come with a<br>
SELinux policy, you need to bring your own with you.<br>
I don't know why this option is visible in YaST, as only SLE Micro comes<br>
with full SELinux support.<br>
<br>
Thorsten<br>
<br>
> This seems to freeze, in the first boot after Yast has installed the system.<br>
> Eearly in systemd after the kernel is loaded with:<br>
> <br>
> [8.5...] systemd[1]: Failed to load SELinux policy.<br>
> [!!!!!] Failed to load SELinux policy.<br>
> .. Freezing Execution<br>
> <br>
> When using the grub boot config editor and removing "security=selinux selinux=1<br>
> enforcing=1" from the linuxefi kernel command line, it succeeded to boot.<br>
> <br>
> BTW: when I only change enforcing=1 to enforcing=0 the boot continues but shows<br>
> quite a few errors about SELin ux label cannot be determined on systemd sockets<br>
> because "Function not implemented".and in operations there are errors like<br>
> broken name resolution.<br>
> <br>
> I have not yet tried with more modules. Do I need the Application Server<br>
> module?<br>
> <br>
> I noticed that selinux-tools (from base module) is not installed in minimal<br>
> (only "libselinux1" is present). If a user selects SELInux, it should probably<br>
> add that packacge to the list. However I added this package manually, and it<br>
> did not help with the situation.<br>
> <br>
> Want me to file a bugzilla? I havent seen it in "Known Issues" here: SLE Beta<br>
> (suse.com)<br>
> <br>
> BTW: I also turned off DHCPv6, but wicket dhcp6 seems to be started anyway?<br>
> <br>
> Gruss<br>
> Bernd<br>
<br>
-- <br>
Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS<br>
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany<br>
Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)<br>
</div>
</span></font></div>
</body>
</html>