ALT Linux kernel packages development
 help / color / mirror / Atom feed
* [d-kernel] [PATCH] [6.12] config: add selinux to CONFIG_LSM
@ 2026-03-03 14:39 Anton Midyukov
  2026-03-21 13:46 ` Vitaly Chikunov
  0 siblings, 1 reply; 6+ messages in thread
From: Anton Midyukov @ 2026-03-03 14:39 UTC (permalink / raw)
  To: devel-kernel

This is necessary to use Selinux.
Alternatively, can enable it in the kernel cmdline:
  lsm=selinux,lockdown,capability,landlock,yama,safesetid,bpf,kiosk,ima,evm
But this clutters the kernel cmdline.
Signed-off-by: Anton Midyukov <antohami@altlinux.org>
---
 config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config b/config
index 76dcac8f970d..ba51640d2b4f 100644
--- a/config
+++ b/config
@@ -10125,7 +10125,7 @@ CONFIG_EVM_EXTRA_SMACK_XATTRS=y
 # CONFIG_DEFAULT_SECURITY_SMACK is not set
 # CONFIG_DEFAULT_SECURITY_APPARMOR is not set
 CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf,altha,kiosk"
+CONFIG_LSM="selinux,landlock,lockdown,yama,loadpin,safesetid,integrity,bpf,altha,kiosk"
 
 #
 # Kernel hardening options
-- 
2.50.1



^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [d-kernel] [PATCH] [6.12] config: add selinux to CONFIG_LSM
  2026-03-03 14:39 [d-kernel] [PATCH] [6.12] config: add selinux to CONFIG_LSM Anton Midyukov
@ 2026-03-21 13:46 ` Vitaly Chikunov
  2026-05-13 12:19   ` Anton Midyukov
  0 siblings, 1 reply; 6+ messages in thread
From: Vitaly Chikunov @ 2026-03-21 13:46 UTC (permalink / raw)
  To: ALT Linux kernel packages development

On Tue, Mar 03, 2026 at 05:39:05PM +0300, Anton Midyukov wrote:
> This is necessary to use Selinux.
> Alternatively, can enable it in the kernel cmdline:
>   lsm=selinux,lockdown,capability,landlock,yama,safesetid,bpf,kiosk,ima,evm
> But this clutters the kernel cmdline.
> Signed-off-by: Anton Midyukov <antohami@altlinux.org>

Applied, thanks.

Только передвинул selinux после integrity.

> ---
>  config | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/config b/config
> index 76dcac8f970d..ba51640d2b4f 100644
> --- a/config
> +++ b/config
> @@ -10125,7 +10125,7 @@ CONFIG_EVM_EXTRA_SMACK_XATTRS=y
>  # CONFIG_DEFAULT_SECURITY_SMACK is not set
>  # CONFIG_DEFAULT_SECURITY_APPARMOR is not set
>  CONFIG_DEFAULT_SECURITY_DAC=y
> -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf,altha,kiosk"
> +CONFIG_LSM="selinux,landlock,lockdown,yama,loadpin,safesetid,integrity,bpf,altha,kiosk"
>  
>  #
>  # Kernel hardening options
> -- 
> 2.50.1
> 
> _______________________________________________
> devel-kernel mailing list
> devel-kernel@lists.altlinux.org
> https://lists.altlinux.org/mailman/listinfo/devel-kernel


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [d-kernel] [PATCH] [6.12] config: add selinux to CONFIG_LSM
  2026-03-21 13:46 ` Vitaly Chikunov
@ 2026-05-13 12:19   ` Anton Midyukov
  2026-05-14  2:30     ` Vitaly Chikunov
  0 siblings, 1 reply; 6+ messages in thread
From: Anton Midyukov @ 2026-05-13 12:19 UTC (permalink / raw)
  To: devel-kernel

21.03.2026 16:46, Vitaly Chikunov пишет:
> On Tue, Mar 03, 2026 at 05:39:05PM +0300, Anton Midyukov wrote:
>> This is necessary to use Selinux.
>> Alternatively, can enable it in the kernel cmdline:
>>   lsm=selinux,lockdown,capability,landlock,yama,safesetid,bpf,kiosk,ima,evm
>> But this clutters the kernel cmdline.
>> Signed-off-by: Anton Midyukov <antohami@altlinux.org>
> 
> Applied, thanks.
> 
> Только передвинул selinux после integrity.
> 

Прошу включить и в 6.18.

>> ---
>>  config | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/config b/config
>> index 76dcac8f970d..ba51640d2b4f 100644
>> --- a/config
>> +++ b/config
>> @@ -10125,7 +10125,7 @@ CONFIG_EVM_EXTRA_SMACK_XATTRS=y
>>  # CONFIG_DEFAULT_SECURITY_SMACK is not set
>>  # CONFIG_DEFAULT_SECURITY_APPARMOR is not set
>>  CONFIG_DEFAULT_SECURITY_DAC=y
>> -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf,altha,kiosk"
>> +CONFIG_LSM="selinux,landlock,lockdown,yama,loadpin,safesetid,integrity,bpf,altha,kiosk"
>>  
>>  #
>>  # Kernel hardening options
>> -- 
>> 2.50.1
>>
>> _______________________________________________
>> devel-kernel mailing list
>> devel-kernel@lists.altlinux.org
>> https://lists.altlinux.org/mailman/listinfo/devel-kernel
> _______________________________________________
> devel-kernel mailing list
> devel-kernel@lists.altlinux.org
> https://lists.altlinux.org/mailman/listinfo/devel-kernel

-- 
best regards, Anton Midyukov <antohami@altlinux.org>



^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [d-kernel] [PATCH] [6.12] config: add selinux to CONFIG_LSM
  2026-05-13 12:19   ` Anton Midyukov
@ 2026-05-14  2:30     ` Vitaly Chikunov
  2026-05-14 14:09       ` Ivan A. Melnikov
  0 siblings, 1 reply; 6+ messages in thread
From: Vitaly Chikunov @ 2026-05-14  2:30 UTC (permalink / raw)
  To: ALT Linux kernel packages development

Anton,

On Wed, May 13, 2026 at 03:19:15PM +0300, Anton Midyukov wrote:
> 21.03.2026 16:46, Vitaly Chikunov пишет:
> > On Tue, Mar 03, 2026 at 05:39:05PM +0300, Anton Midyukov wrote:
> >> This is necessary to use Selinux.
> >> Alternatively, can enable it in the kernel cmdline:
> >>   lsm=selinux,lockdown,capability,landlock,yama,safesetid,bpf,kiosk,ima,evm
> >> But this clutters the kernel cmdline.
> >> Signed-off-by: Anton Midyukov <antohami@altlinux.org>
> > 
> > Applied, thanks.
> > 
> > Только передвинул selinux после integrity.
> > 
> 
> Прошу включить и в 6.18.

Picked, thanks

  aefaa98ad5f1 N net/netlabel: Add mark s0 flag for NetLabel subsystem (6.12)
  aee1f8b1f607 N config: add selinux to CONFIG_LSM

> 
> >> ---
> >>  config | 2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/config b/config
> >> index 76dcac8f970d..ba51640d2b4f 100644
> >> --- a/config
> >> +++ b/config
> >> @@ -10125,7 +10125,7 @@ CONFIG_EVM_EXTRA_SMACK_XATTRS=y
> >>  # CONFIG_DEFAULT_SECURITY_SMACK is not set
> >>  # CONFIG_DEFAULT_SECURITY_APPARMOR is not set
> >>  CONFIG_DEFAULT_SECURITY_DAC=y
> >> -CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf,altha,kiosk"
> >> +CONFIG_LSM="selinux,landlock,lockdown,yama,loadpin,safesetid,integrity,bpf,altha,kiosk"
> >>  
> >>  #
> >>  # Kernel hardening options
> >> -- 
> >> 2.50.1
> >>
> >> _______________________________________________
> >> devel-kernel mailing list
> >> devel-kernel@lists.altlinux.org
> >> https://lists.altlinux.org/mailman/listinfo/devel-kernel
> > _______________________________________________
> > devel-kernel mailing list
> > devel-kernel@lists.altlinux.org
> > https://lists.altlinux.org/mailman/listinfo/devel-kernel
> 
> -- 
> best regards, Anton Midyukov <antohami@altlinux.org>
> 
> _______________________________________________
> devel-kernel mailing list
> devel-kernel@lists.altlinux.org
> https://lists.altlinux.org/mailman/listinfo/devel-kernel


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [d-kernel] [PATCH] [6.12] config: add selinux to CONFIG_LSM
  2026-05-14  2:30     ` Vitaly Chikunov
@ 2026-05-14 14:09       ` Ivan A. Melnikov
  2026-05-15  7:24         ` Vitaly Chikunov
  0 siblings, 1 reply; 6+ messages in thread
From: Ivan A. Melnikov @ 2026-05-14 14:09 UTC (permalink / raw)
  To: Vitaly Chikunov; +Cc: ALT Linux kernel packages development

On Thu, May 14, 2026 at 05:30:14AM +0300, Vitaly Chikunov wrote:
> Anton,
> 
> On Wed, May 13, 2026 at 03:19:15PM +0300, Anton Midyukov wrote:
> > 21.03.2026 16:46, Vitaly Chikunov пишет:
> > > On Tue, Mar 03, 2026 at 05:39:05PM +0300, Anton Midyukov wrote:
> > >> This is necessary to use Selinux.
> > >> Alternatively, can enable it in the kernel cmdline:
> > >>   lsm=selinux,lockdown,capability,landlock,yama,safesetid,bpf,kiosk,ima,evm
> > >> But this clutters the kernel cmdline.
> > >> Signed-off-by: Anton Midyukov <antohami@altlinux.org>
> > > 
> > > Applied, thanks.
> > > 
> > > Только передвинул selinux после integrity.
> > > 
> > 
> > Прошу включить и в 6.18.
> 
> Picked, thanks
> 
>   aefaa98ad5f1 N net/netlabel: Add mark s0 flag for NetLabel subsystem (6.12)

Кажется, что-то пошло не так.

net/netlabel/netlabel_mgmt.c: In function 'netlbl_mgmt_genl_init':
net/netlabel/netlabel_mgmt.c:963:9: error: implicit declaration of function 'security_current_getsecid_subj'; did you mean 'security_current_getlsmprop_subj'? [-Wimplicit-function-declaration]
  963 |         security_current_getsecid_subj(&audit_info.secid);
      |         security_current_getlsmprop_subj
net/netlabel/netlabel_mgmt.c:963:51: error: 'struct netlbl_audit' has no member named 'secid'
  963 |         security_current_getsecid_subj(&audit_info.secid);


Функция security_current_getsecid_subj вроде как была переименована в 6.13.

-- 
  wbr,
    iv m.


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [d-kernel] [PATCH] [6.12] config: add selinux to CONFIG_LSM
  2026-05-14 14:09       ` Ivan A. Melnikov
@ 2026-05-15  7:24         ` Vitaly Chikunov
  0 siblings, 0 replies; 6+ messages in thread
From: Vitaly Chikunov @ 2026-05-15  7:24 UTC (permalink / raw)
  To: ALT Linux kernel packages development

Ivan,

On Thu, May 14, 2026 at 06:09:14PM +0400, Ivan A. Melnikov wrote:
> On Thu, May 14, 2026 at 05:30:14AM +0300, Vitaly Chikunov wrote:
> > Anton,
> > 
> > On Wed, May 13, 2026 at 03:19:15PM +0300, Anton Midyukov wrote:
> > > 21.03.2026 16:46, Vitaly Chikunov пишет:
> > > > On Tue, Mar 03, 2026 at 05:39:05PM +0300, Anton Midyukov wrote:
> > > >> This is necessary to use Selinux.
> > > >> Alternatively, can enable it in the kernel cmdline:
> > > >>   lsm=selinux,lockdown,capability,landlock,yama,safesetid,bpf,kiosk,ima,evm
> > > >> But this clutters the kernel cmdline.
> > > >> Signed-off-by: Anton Midyukov <antohami@altlinux.org>
> > > > 
> > > > Applied, thanks.
> > > > 
> > > > Только передвинул selinux после integrity.
> > > > 
> > > 
> > > Прошу включить и в 6.18.
> > 
> > Picked, thanks
> > 
> >   aefaa98ad5f1 N net/netlabel: Add mark s0 flag for NetLabel subsystem (6.12)
> 
> Кажется, что-то пошло не так.
> 
> net/netlabel/netlabel_mgmt.c: In function 'netlbl_mgmt_genl_init':
> net/netlabel/netlabel_mgmt.c:963:9: error: implicit declaration of function 'security_current_getsecid_subj'; did you mean 'security_current_getlsmprop_subj'? [-Wimplicit-function-declaration]
>   963 |         security_current_getsecid_subj(&audit_info.secid);
>       |         security_current_getlsmprop_subj
> net/netlabel/netlabel_mgmt.c:963:51: error: 'struct netlbl_audit' has no member named 'secid'
>   963 |         security_current_getsecid_subj(&audit_info.secid);
> 
> 
> Функция security_current_getsecid_subj вроде как была переименована в 6.13.

Fixed, thanks

> 
> -- 
>   wbr,
>     iv m.


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-05-15  7:24 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-03-03 14:39 [d-kernel] [PATCH] [6.12] config: add selinux to CONFIG_LSM Anton Midyukov
2026-03-21 13:46 ` Vitaly Chikunov
2026-05-13 12:19   ` Anton Midyukov
2026-05-14  2:30     ` Vitaly Chikunov
2026-05-14 14:09       ` Ivan A. Melnikov
2026-05-15  7:24         ` Vitaly Chikunov

ALT Linux kernel packages development

This inbox may be cloned and mirrored by anyone:

	git clone --mirror http://lore.altlinux.org/devel-kernel/0 devel-kernel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 devel-kernel devel-kernel/ http://lore.altlinux.org/devel-kernel \
		devel-kernel@altlinux.org devel-kernel@altlinux.ru devel-kernel@altlinux.com
	public-inbox-index devel-kernel

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://lore.altlinux.org/org.altlinux.lists.devel-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git