Policy broken since kernel 5

Asked by Michael on 2019-08-25

Dear Maintainer,

I have tried to run SELinux on server/desktop from version 18 to 19 and it seems like everything from kernel 5 and above and it looks like the Policy is broken. we can see that PID 1 is unlabeled (when running in permissive and checking in journalctl)
the first two denies are:
avc: denied { compute_create } for pid=1 comm="systemd" scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1

avc: denied { setcurrent } for pid=1 comm="systemd" scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=process permissive=1

avc: denied { use } for pid=1 comm="systemd" path="/etc/selinux/default/contexts/files/file_contexts.bin" dev="dm-0" ino=129737 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=fd permissive=1

avc: denied { getcap } for pid=1 comm="systemd" scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=process permissive=1

avc: denied { module_load } for pid=1 comm="systemd" path="/usr/lib/modules/5.0.0-25-generic/kernel/fs/autofs/autofs4.ko" dev="dm-0" ino=397719 scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=system permissive=1

The installation was:
1. purge apparmor
2. install selinux-basics (also tried with the package selinux)
3. relabel the system
4. reboot
5. setenforce 1
and the system hangs.
It must be that i am doing something wrong since nobody else is complaining about this.

i would greatly appreciate any input.
Thanks,
Michael

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu selinux-basics Edit question
Assignee:
No assignee Edit question
Solved by:
Manfred Hampl
Solved:
2019-08-25
Last query:
2019-08-25
Last reply:
2019-08-25
Michael (silversliver) said : #2

Thank you for answering!
So this means that Ubuntu does not support SELinux in anyway since kernel 5?

Thanks again,
Michael

Best Manfred Hampl (m-hampl) said : #3

If you look at the document linked in comment #1 of bug #1805350 https://unix.stackexchange.com/questions/483246/selinux-demands-constant-relabeling you will see "Ubuntu does not fully support selinux policy".
You should also read the warning at the top of https://wiki.ubuntu.com/SELinux
And another link about that problem: https://askubuntu.com/q/1090842

Michael (silversliver) said : #4

Thanks Manfred Hampl, that solved my question.