On 2015-09-21 23:34, J. R. Okajima wrote: [...] > (from the quoted post) > ---------------------------------------------------------------------- > aufs doesn't support SELinux, so I had to switch to overlayfs. > So now my target is Debian 8 / Linux 4.1 / systemd / overlayfs / SELinux. > ---------------------------------------------------------------------- > > I know aufs is not your main concern, but would you tell me why do you > think that aufs doesn't support SELinux? If I remember correctly, aufs > can live with SELinux. It might be due to your (or your distribution's) > configuration, especially CONFIG_AUFS_XATTR. If I recall correctly, there are two problems here. The main problem is that we upgraded to Linux 4.1 to support newer hardware, and given that has overlayfs in mainline, the Debian kernel maintainers, I believe, completely removed support for aufs in the kernel, leaving us with little choice unless we wanted to apply our own patches, which we'd very much rather avoid. The other problem seems to be that I can't find that CONFIG_AUFS_XATTR option in the kernel config I'm using. It may be that the aufs version I'm using doesn't support xattrs at all, but a newer version does. The kernel that I just checked this on was https://packages.debian.org/jessie/linux-image-3.16.0-4-amd64. Additionally, I've not chased this up yet, but I've received a response from the SELinux list indicating that the problem is related to me not having the policy loaded yet: http://thread.gmane.org/gmane.comp.security.selinux/23045/focus=23053. I think this will be the next thing I investigate. -- Regards, Matthew Cengia
Attachment:
signature.asc
Description: Digital signature
