From 70f3eff233e230c520228040e74516c26a179b1a Mon Sep 17 00:00:00 2001 From: Kai Lueke Date: Wed, 20 Dec 2023 11:20:39 +0100 Subject: [PATCH] SELinux: Label /usr and sysext image contents So far we did not correctly label /usr because it broke certain things like Docker. With the sysext Docker and new policies we should try again. First generate the policy before branching off the base squashfs (which already misses a lot of things because they the most postprocessing is done late in finish_image!). Then label /usr and also the sysext contents in their folder - not in the overlay mount because this would operate on the whole image. Signed-off-by: James Le Cuirot --- .../workflows/portage-stable-packages-list | 1 + build_library/build_image_util.sh | 23 +++++++++++-------- build_library/dev_container_util.sh | 3 +++ build_library/prod_image_util.sh | 3 +++ build_sysext | 10 +++++++- ...1-r321.ebuild => coreos-0.0.1-r322.ebuild} | 0 .../coreos-base/coreos/coreos-0.0.1.ebuild | 1 + 7 files changed, 31 insertions(+), 10 deletions(-) rename sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/{coreos-0.0.1-r321.ebuild => coreos-0.0.1-r322.ebuild} (100%) diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list index 0949ca56b16..585579004ba 100644 --- a/.github/workflows/portage-stable-packages-list +++ b/.github/workflows/portage-stable-packages-list @@ -592,6 +592,7 @@ sec-policy/selinux-base sec-policy/selinux-base-policy sec-policy/selinux-container sec-policy/selinux-dbus +sec-policy/selinux-docker sec-policy/selinux-policykit sec-policy/selinux-sssd sec-policy/selinux-unconfined diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index b7795ade839..2eae88fa615 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -518,6 +518,18 @@ start_image() { --board="${BOARD}" } +# Actions common to the dev container and the image +# but which should be run before the image branches off +# the base squashfs (used for systemd-sysext image building) +finish_image_common() { + local root_fs_dir="$1" + + # Build the selinux policy + if pkg_use_enabled coreos-base/coreos selinux; then + sudo semodule -n -s mcs -p "${root_fs_dir}" -i "${root_fs_dir}"/usr/share/selinux/mcs/*.pp + fi +} + finish_image() { local image_name="$1" local disk_layout="$2" @@ -634,11 +646,6 @@ EOF "${BUILD_DIR}/${image_kconfig}" fi - # Build the selinux policy - if pkg_use_enabled coreos-base/coreos selinux; then - sudo semodule -n -s mcs -p "${root_fs_dir}" -i "${root_fs_dir}"/usr/share/selinux/mcs/*.pp - fi - # Run tmpfiles once to make sure that /etc has everything in place before # we freeze it in /usr/share/flatcar/etc as lowerdir in the overlayfs. @@ -674,10 +681,8 @@ EOF # setfiles from version 3.11 requires the passed path to have no symlinks local real_root_fs_dir real_root_fs_dir=$(realpath "${root_fs_dir}") - # TODO: Breaks the system: - # sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}" - # sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr - # For now we only try it with /etc + sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}" + sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/etc fi diff --git a/build_library/dev_container_util.sh b/build_library/dev_container_util.sh index 5bee2889e55..c885e269572 100755 --- a/build_library/dev_container_util.sh +++ b/build_library/dev_container_util.sh @@ -99,6 +99,9 @@ create_dev_container() { # The remount services are provided by coreos-base/coreos-init systemd_enable "${root_fs_dir}" "multi-user.target" "remount-usr.service" + finish_image_common \ + "${root_fs_dir}" + finish_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${image_contents}" "${image_contents_wtd}" declare -a files_to_evaluate diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh index 0ea886b9a00..0a392fd94c2 100755 --- a/build_library/prod_image_util.sh +++ b/build_library/prod_image_util.sh @@ -101,6 +101,9 @@ create_prod_image() { ROOT="${root_fs_dir}" PORTAGE_CONFIGROOT="${BUILD_DIR}"/configroot \ test_image_content "${root_fs_dir}" + finish_image_common \ + "${root_fs_dir}" + local root_with_everything="${root_fs_dir}" # Call helper script for adding sysexts to the base OS. diff --git a/build_sysext b/build_sysext index 6ecbdb5f500..f637efbfb07 100755 --- a/build_sysext +++ b/build_sysext @@ -244,7 +244,6 @@ export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release # Unmount in order to get rid of the overlay umount "${BUILD_DIR}/${FLAGS_install_root_basename}" -umount "${BUILD_DIR}/fs-root" if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then info " Creating pkginfo squashfs '${BUILD_DIR}/${SYSEXT_ID}_pkginfo.raw'" @@ -305,6 +304,15 @@ EOF info "Removing opaque directory markers to always merge all contents" find "${BUILD_DIR}/${FLAGS_install_root_basename}" -xdev -type d -exec sh -c 'if [ "$(attr -R -q -g overlay.opaque {} 2>/dev/null)" = y ]; then attr -R -r overlay.opaque {}; fi' \; +if pkg_use_enabled coreos-base/coreos selinux; then + # setfiles from version 3.11 requires the passed path to have no symlinks + real_install_root=$(realpath "${BUILD_DIR}/${FLAGS_install_root_basename}") + real_fs_root=$(realpath "${BUILD_DIR}/fs-root") + sudo setfiles -Dv -r "${real_install_root}" "${real_fs_root}/etc/selinux/mcs/contexts/files/file_contexts" "${real_install_root}/usr" +fi + +umount "${BUILD_DIR}/fs-root" + info "Checking for invalid file ownership" invalid_files=$(find "${BUILD_DIR}/${FLAGS_install_root_basename}" -user sdk -or -group sdk) if [[ -n "${invalid_files}" ]]; then diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r321.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r322.ebuild similarity index 100% rename from sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r321.ebuild rename to sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1-r322.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild index b6e64960492..e58e45a82d0 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild @@ -148,6 +148,7 @@ RDEPEND="${RDEPEND} sec-policy/selinux-base-policy sec-policy/selinux-container sec-policy/selinux-dbus + sec-policy/selinux-docker sec-policy/selinux-policykit sec-policy/selinux-unconfined sys-apps/acl