Skip to content

SELinux: Label /usr and sysext image contents #1517

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pothos wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

SELinux: Label /usr and sysext image contents #1517

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/portage-stable-packages-list
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -592,6 +592,7 @@ sec-policy/selinux-base
sec-policy/selinux-base-policy
sec-policy/selinux-container
sec-policy/selinux-dbus
sec-policy/selinux-docker
sec-policy/selinux-policykit
sec-policy/selinux-sssd
sec-policy/selinux-unconfined
Expand Down
23 changes: 14 additions & 9 deletions build_library/build_image_util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -518,6 +518,18 @@ start_image() {
--board="${BOARD}"
}

# Actions common to the dev container and the image
# but which should be run before the image branches off
# the base squashfs (used for systemd-sysext image building)
finish_image_common() {
local root_fs_dir="$1"

# Build the selinux policy
if pkg_use_enabled coreos-base/coreos selinux; then
sudo semodule -n -s mcs -p "${root_fs_dir}" -i "${root_fs_dir}"/usr/share/selinux/mcs/*.pp
fi
}

finish_image() {
local image_name="$1"
local disk_layout="$2"
Expand Down Expand Up @@ -634,11 +646,6 @@ EOF
"${BUILD_DIR}/${image_kconfig}"
fi

# Build the selinux policy
if pkg_use_enabled coreos-base/coreos selinux; then
sudo semodule -n -s mcs -p "${root_fs_dir}" -i "${root_fs_dir}"/usr/share/selinux/mcs/*.pp
fi

# Run tmpfiles once to make sure that /etc has everything in place before
# we freeze it in /usr/share/flatcar/etc as lowerdir in the overlayfs.

Expand Down Expand Up @@ -674,10 +681,8 @@ EOF
# setfiles from version 3.11 requires the passed path to have no symlinks
local real_root_fs_dir
real_root_fs_dir=$(realpath "${root_fs_dir}")
# TODO: Breaks the system:
# sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"
# sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr
# For now we only try it with /etc
sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"
sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr
sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/etc
fi

Expand Down
3 changes: 3 additions & 0 deletions build_library/dev_container_util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,9 @@ create_dev_container() {
# The remount services are provided by coreos-base/coreos-init
systemd_enable "${root_fs_dir}" "multi-user.target" "remount-usr.service"

finish_image_common \
"${root_fs_dir}"

finish_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${image_contents}" "${image_contents_wtd}"

declare -a files_to_evaluate
Expand Down
3 changes: 3 additions & 0 deletions build_library/prod_image_util.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,9 @@ create_prod_image() {
ROOT="${root_fs_dir}" PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \
test_image_content "${root_fs_dir}"

finish_image_common \
"${root_fs_dir}"
Comment thread
chewi marked this conversation as resolved.
Resolved

local root_with_everything="${root_fs_dir}"

# Call helper script for adding sysexts to the base OS.
Expand Down
10 changes: 9 additions & 1 deletion build_sysext
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,7 +244,6 @@ export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release

# Unmount in order to get rid of the overlay
umount "${BUILD_DIR}/${FLAGS_install_root_basename}"
umount "${BUILD_DIR}/fs-root"

if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then
info " Creating pkginfo squashfs '${BUILD_DIR}/${SYSEXT_ID}_pkginfo.raw'"
Expand Down Expand Up @@ -305,6 +304,15 @@ EOF
info "Removing opaque directory markers to always merge all contents"
find "${BUILD_DIR}/${FLAGS_install_root_basename}" -xdev -type d -exec sh -c 'if [ "$(attr -R -q -g overlay.opaque {} 2>/dev/null)" = y ]; then attr -R -r overlay.opaque {}; fi' \;

if pkg_use_enabled coreos-base/coreos selinux; then
# setfiles from version 3.11 requires the passed path to have no symlinks
real_install_root=$(realpath "${BUILD_DIR}/${FLAGS_install_root_basename}")
real_fs_root=$(realpath "${BUILD_DIR}/fs-root")
sudo setfiles -Dv -r "${real_install_root}" "${real_fs_root}/etc/selinux/mcs/contexts/files/file_contexts" "${real_install_root}/usr"
fi

umount "${BUILD_DIR}/fs-root"

info "Checking for invalid file ownership"
invalid_files=$(find "${BUILD_DIR}/${FLAGS_install_root_basename}" -user sdk -or -group sdk)
if [[ -n "${invalid_files}" ]]; then
Expand Down
0 ...reos-base/coreos/coreos-0.0.1-r321.ebuild → ...reos-base/coreos/coreos-0.0.1-r322.ebuild
View file
Open in desktop
File renamed without changes.
1 change: 1 addition & 0 deletions sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,7 @@ RDEPEND="${RDEPEND}
sec-policy/selinux-base-policy
sec-policy/selinux-container
sec-policy/selinux-dbus
sec-policy/selinux-docker
sec-policy/selinux-policykit
sec-policy/selinux-unconfined
sys-apps/acl
Expand Down
Loading