Revert "config: Enable CONFIG_SECURITY_SELINUX"

[albertofaria]

This reverts commit ce7277c.

SELinux was enabled for crun-vm's [1] use case of running bootc-install, but the dependency on SELinux was since dropped.

Re-disable SELinux to avoid bloat. This has no effect on the x86_64 image since its defconfig includes CONFIG_SECURITY_SELINUX=y, but it should help reduce the aarch64 image size.

[1] https://github.com/containers/crun-vm

[albertofaria]

Re-disable SELinux to avoid bloat. This has no effect on the x86_64 image since its defconfig includes CONFIG_SECURITY_SELINUX=y, but it should help reduce the aarch64 image size.

Actually, if this is true I wonder how x86_64 buils at all without the adjustment to the downstream patches. I'm missing something here.

[tylerfanelli]

@albertofaria What are you referring to by "downstream patches"? Are you referring to the patches already applied to the kernel provided by libkrunfw?

[albertofaria]

@albertofaria What are you referring to by "downstream patches"? Are you referring to the patches already applied to the kernel provided by libkrunfw?

Yes.

[slp]

Re-disable SELinux to avoid bloat. This has no effect on the x86_64 image since its defconfig includes CONFIG_SECURITY_SELINUX=y, but it should help reduce the aarch64 image size.

Actually, if this is true I wonder how x86_64 buils at all without the adjustment to the downstream patches. I'm missing something here.

We're using make olddefconfig so the kernel config system is not using the value for SELinux from x86_64_defconfig.

Thanks for the PR!

[albertofaria]

@slp I see. FWIW I didn't see a reduction in image size when disabling CONFIG_SECURITY_SELINUX.

[germag]

I think this was reverted too quickly, it seems that SELinux is a requirement again

[albertofaria]

@germag Do you mean it is a requirement for crun-vm specifically, or for bootc install in general?

[germag]

@germag Do you mean it is a requirement for crun-vm specifically, or for bootc install in general?

bootc install it fails to install when it tries to set the selinux labels (at least for me)

[germag]

bootc install it fails to install when it tries to set the selinux labels (at least for me)

@albertofaria it seems my issue is unrelated to this PR.
But, in any case, installing a bootc image using a kernel that doesn't support selinux is not well tested

[albertofaria]

True:

Host kernel does not have SELinux support, but target enables it by default; this is less well tested. See https://github.com/containers/bootc/issues/419

But containers/bootc#419 seems to indicate that it will eventually be (sufficiently?) tested?

[germag]

True:

Host kernel does not have SELinux support, but target enables it by default; this is less well tested. See https://github.com/containers/bootc/issues/419

But containers/bootc#419 seems to indicate that it will eventually be (sufficiently?) tested?

I have this discussion with Colin about installing with different kernel/kernel feature, I'm not sure if it will be free of issues. Since it doesn't change the kernel size, maybe it's safer to leave it enabled (?)