[lkml]   [2018]   [Aug]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: WARNING in apparmor_secid_to_secctx
On 08/31/2018 12:07 PM, Paul Moore wrote:
> On Fri, Aug 31, 2018 at 12:01 PM Stephen Smalley <> wrote:
>> On 08/29/2018 10:21 PM, Dmitry Vyukov wrote:
>>> On Wed, Aug 29, 2018 at 7:17 PM, syzbot
>>> <> wrote:
>>>> Hello,
>>>> syzbot found the following crash on:
>>>> HEAD commit: 817e60a7a2bb Merge branch 'nfp-add-NFP5000-support'
>>>> git tree: net-next
>>>> console output:
>>>> kernel config:
>>>> dashboard link:
>>>> compiler: gcc (GCC) 8.0.1 20180413 (experimental)
>>>> Unfortunately, I don't have any reproducer for this crash yet.
>>>> IMPORTANT: if you fix the bug, please add the following tag to the commit:
>>>> Reported-by:
>>> Hi John, Tyler,
>>> I've switched syzbot from selinux to apparmor as we discussed on lss:
>> Sorry, does this mean that you are no longer testing selinux via syzbot?
>> That seems unfortunate. SELinux is default-enabled and used in
>> Fedora, RHEL and all derivatives (e.g. CentOS), and mandatory in Android
>> (and seemingly getting some use in ChromeOS now as well, at least for
>> the Android container and possibly wider), so it seems unwise to drop it
>> from your testing altogether. I was under the impression that you were
>> just going to add apparmor to your testing matrix, not drop selinux
>> altogether.
> It is also important to note that testing with SELinux enabled but no
> policy loaded is not going to be very helpful (last we talked that is
> what syzbot is/was doing). While syzbot did uncover some issues
> relating to the enabled-no-policy case, those are much less
> interesting and less relevant than the loaded-policy case.

I had thought that they had switched over to at least loading a policy
but possibly left it in permissive mode because the base distribution
didn't properly support SELinux out of the box. But I may be mistaken.
Regardless, the right solution is to migrate to testing with a policy
loaded not to stop testing altogether.

Optimally, they'd test on at least one distribution/OS where SELinux is
in fact supported out of the box, e.g. CentOS, Android, and/or ChromeOS.

 \ /
  Last update: 2018-08-31 18:24    [W:0.084 / U:0.552 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site