<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hi,<br class="">
<blockquote type="cite" class="">On 16 May 2021, at 15:39, Bernd Eckenfels <<a href="mailto:ecki@zusammenkunft.net" class="">ecki@zusammenkunft.net</a>> wrote:<br class="">
<br class="">
<br class="">
> I assume you mean SLES 15 SP3 and not Leap 15.3?<br class="">
<br class="">
Yes, this is the SLE mailing list.<br class="">
</blockquote>
<div class=""><br class="">
</div>
<div class="">This is true, but since SLE and openSUSE are now <a href="https://www.suse.com/c/how-suse-builds-its-enterprise-linux-distribution-part-5/" class="">developed together</a>, there is absolutely no issue to discuss openSUSE Leap 15.3 in this mailing
list : ).</div>
<div class="">To say it differently we would like to have such SLE/openSUSE reports or discussions during the beta program since it will help our ambition to improve SLE and openSUSE.</div>
<br class="">
<blockquote type="cite" class="">> In short: as documented since a long time, SLES does not come with a SELinux policy<br class="">
<br class="">
The release notes only states that 15.3 does support SELinux, it should probably add a warning that it lacks default policies.<br class="">
</blockquote>
<div class=""><br class="">
</div>
<div class="">Yes, we are going to rewrote the Release Notes statement about SELinux thanks to your report and suggestion.</div>
<div class="">Thank you and have a nice day,</div>
<div class=""><br class="">
</div>
<div class="">Regards,</div>
--<br class="">
Vincent Moutoussamy<br class="">
SUSE Beta Program Manager<br class="">
JeOS Technical Project Manager<br class="">
Paris, France
<div class=""><br class="">
<blockquote type="cite" class="">Gruss<br class="">
Bernd<br class="">
--<br class="">
<a href="http://bernd.eckenfels.net" class="">http://bernd.eckenfels.net</a><br class="">
Von: sle-beta <sle-beta-bounces+ecki=zusammenkunft.net@lists.suse.com> im Auftrag von Thorsten Kukuk <kukuk@suse.de><br class="">
Gesendet: Sunday, May 16, 2021 12:53:33 PM<br class="">
An: sle-beta@lists.suse.com <sle-beta@lists.suse.com><br class="">
Betreff: Re: 15.3 PRC: SE Linux Policy loading failed<br class="">
<br class="">
<br class="">
Hi,<br class="">
<br class="">
On Sat, May 15, Bernd wrote:<br class="">
<br class="">
> Hello,<br class="">
> <br class="">
> I just installed 15.3 PRC in a Hyper-V VM (UEFI with secure boot) to do some<br class="">
> qualification testing. I used the Full ISO and installed SLES with only the<br class="">
> base system module in minimal configuration and no registration. In the<br class="">
> installer I enabled SELinux in advisory mode.<br class="">
<br class="">
I assume you mean SLES 15 SP3 and not Leap 15.3?<br class="">
It's really helpful to use correct product and version names, own created<br class="">
version numbers only lead to confusion and wrong advice.<br class="">
<br class="">
In short: as documented since a long time, SLES does not come with a<br class="">
SELinux policy, you need to bring your own with you.<br class="">
I don't know why this option is visible in YaST, as only SLE Micro comes<br class="">
with full SELinux support.<br class="">
<br class="">
Thorsten<br class="">
<br class="">
> This seems to freeze, in the first boot after Yast has installed the system.<br class="">
> Eearly in systemd after the kernel is loaded with:<br class="">
> <br class="">
> [8.5...] systemd[1]: Failed to load SELinux policy.<br class="">
> [!!!!!] Failed to load SELinux policy.<br class="">
> .. Freezing Execution<br class="">
> <br class="">
> When using the grub boot config editor and removing "security=selinux selinux=1<br class="">
> enforcing=1" from the linuxefi kernel command line, it succeeded to boot.<br class="">
> <br class="">
> BTW: when I only change enforcing=1 to enforcing=0 the boot continues but shows<br class="">
> quite a few errors about SELin ux label cannot be determined on systemd sockets<br class="">
> because "Function not implemented".and in operations there are errors like<br class="">
> broken name resolution.<br class="">
> <br class="">
> I have not yet tried with more modules. Do I need the Application Server<br class="">
> module?<br class="">
> <br class="">
> I noticed that selinux-tools (from base module) is not installed in minimal<br class="">
> (only "libselinux1" is present). If a user selects SELInux, it should probably<br class="">
> add that packacge to the list. However I added this package manually, and it<br class="">
> did not help with the situation.<br class="">
> <br class="">
> Want me to file a bugzilla? I havent seen it in "Known Issues" here: SLE Beta<br class="">
> (suse.com)<br class="">
> <br class="">
> BTW: I also turned off DHCPv6, but wicket dhcp6 seems to be started anyway?<br class="">
> <br class="">
> Gruss<br class="">
> Bernd<br class="">
<br class="">
-- <br class="">
Thorsten Kukuk, Distinguished Engineer, Senior Architect SLES & MicroOS<br class="">
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany<br class="">
Managing Director: Felix Imendoerffer (HRB 36809, AG Nürnberg)<br class="">
</blockquote>
<br class="">
</div>
</body>
</html>