【22.03 LTS】【loongarch64】selinux状态从disabled更改为enforcing过程中报错

iso下载地址：ftp://10.2.5.21/tmp/lqw/openEuler/openEuler-22.03-0919/openEuler-22.03-LTS-everything-loongarch64-dvd.iso

内核版本：5.10.0-60.110.0.137.oe2203.loongarch64
系统版本：openEuler release 22.03 LTS

【测试源】
[OS]
name=OS
#baseurl=http://repo.openeuler.org/openEuler-22.03-LTS/OS/$basearch/
#baseurl=file:///root/iso/
#下方的源地址为everything仓库地址
baseurl=http://119.3.219.20:82/openEuler:/22.03:/LTS:/LoongArch/standard_loongarch64/
enabled=1
gpgcheck=0
gpgkey=http://repo.openeuler.org/openEuler-22.03-LTS/OS/$basearch/RPM-GPG-KEY-openEuler

[openEuler]
name=openEuler
#baseurl=http://repo.openeuler.org/openEuler-22.03-LTS/OS/$basearch/
#baseurl=file:///root/iso/
#下方的源地址为epol仓库地址
baseurl=http://119.3.219.20:82/openEuler:/22.03:/LTS:/LoongArch:/Epol/standard_loongarch64/
enabled=1
gpgcheck=0
gpgkey=http://repo.openeuler.org/openEuler-22.03-LTS/OS/$basearch/RPM-GPG-KEY-openEuler

【复现步骤】
1、查看selinux的状态：终端输入getenforce
2、首先修改/etc/selinux/config配置以下内容
SELINUX=permissive
在/boot/efi/EFI/loongnix-server/grub.cfg启动项中增加
security=selinux
3、重启操作系统，并执行以下命令，生成规则文件
grep "avc:  denied" audit.log >audit.txt 2>&1
audit2allow -m loongson-policy -i audit.txt > loongson-policy.te
cat loongson-policy.te
checkmodule -M -m loongson-policy.te -o loongson-policy.mod
semodule_package -m loongson-policy.mod -o loongson-policy.pp
4、安装规则文件
semodule -i loongson-policy.pp
重启操作系统，
重复执行步骤3、4,直到audit.log中不存在新增的denied相关字段

5、修改/etc/selinux/config配置以下内容
SELINUX=enforcing
6、重启操作系统并查看selinux状态，终端输入getenforce或sestatus
执行过程报错
[root@localhost ~]# grep "avc:  denied" audit.log >audit.txt 2>&1
[root@localhost ~]# audit2allow -m openEuler-policy -i audit.txt > openEuler-policy.te
Nothing to do
[root@localhost ~]# cat openEuler-policy.te 
[root@localhost ~]#
[root@localhost ~]# checkmodule -M -m openEuler-policy.te -o openEuler-policy.mod
openEuler-policy.te:1:ERROR 'Building a policy module, but no module specification found.
' at token '' on line 1:

checkmodule:  error(s) encountered while parsing configuration

openEuler/openeuler-os-build

内容风险标识

评论 (1)

openEuler/openeuler-os-build .gitee-modal { width: 500px !important; }

内容风险标识