diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list index f9dada95f09..dbf828ec1bf 100644 --- a/.github/workflows/portage-stable-packages-list +++ b/.github/workflows/portage-stable-packages-list @@ -590,6 +590,7 @@ sec-policy/selinux-base sec-policy/selinux-base-policy sec-policy/selinux-container sec-policy/selinux-dbus +sec-policy/selinux-docker sec-policy/selinux-policykit sec-policy/selinux-sssd sec-policy/selinux-unconfined diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index d942857eab0..aa943d7e568 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -529,6 +529,30 @@ start_image() { --board="${BOARD}" } +# Actions common to the dev container and the image +# but which should be run before the image branches off +# the base squashfs (used for systemd-sysext image building) +finish_image_common() { + local image_name="$1" + local disk_layout="$2" + local root_fs_dir="$3" + local image_contents="$4" + local image_contents_wtd="$5" + local image_kernel="$6" + local pcr_policy="$7" + local image_grub="$8" + local image_shim="$9" + local image_kconfig="${10}" + local image_initrd_contents="${11}" + local image_initrd_contents_wtd="${12}" + local image_disk_space_usage="${13}" + + # Build the selinux policy + if pkg_use_enabled coreos-base/coreos selinux; then + sudo chroot "${root_fs_dir}" bash -c "cd /usr/share/selinux/mcs && semodule -s mcs -i *.pp" + fi +} + finish_image() { local image_name="$1" local disk_layout="$2" @@ -645,11 +669,6 @@ EOF "${BUILD_DIR}/${image_kconfig}" fi - # Build the selinux policy - if pkg_use_enabled coreos-base/coreos selinux; then - sudo chroot "${root_fs_dir}" bash -c "cd /usr/share/selinux/mcs && semodule -s mcs -i *.pp" - fi - # Run tmpfiles once to make sure that /etc has everything in place before # we freeze it in /usr/share/flatcar/etc as lowerdir in the overlayfs. @@ -685,10 +704,8 @@ EOF # setfiles from version 3.11 requires the passed path to have no symlinks local real_root_fs_dir real_root_fs_dir=$(realpath "${root_fs_dir}") - # TODO: Breaks the system: - # sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}" - # sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr - # For now we only try it with /etc + sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}" + sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/etc fi diff --git a/build_library/dev_container_util.sh b/build_library/dev_container_util.sh index b0e08474c0e..c44da3e0187 100755 --- a/build_library/dev_container_util.sh +++ b/build_library/dev_container_util.sh @@ -113,6 +113,8 @@ create_dev_container() { # The remount services are provided by coreos-base/coreos-init systemd_enable "${root_fs_dir}" "multi-user.target" "remount-usr.service" + finish_image_common "${image_name}" "${disk_layout}" "${root_fs_dir}" "${image_contents}" "${image_contents_wtd}" + finish_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${image_contents}" "${image_contents_wtd}" declare -a files_to_evaluate diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh index 955ec5542be..a4ac4da3ca8 100755 --- a/build_library/prod_image_util.sh +++ b/build_library/prod_image_util.sh @@ -98,6 +98,21 @@ create_prod_image() { run_ldconfig "${root_fs_dir}" run_localedef "${root_fs_dir}" + finish_image_common \ + "${image_name}" \ + "${disk_layout}" \ + "${root_fs_dir}" \ + "${image_contents}" \ + "${image_contents_wtd}" \ + "${image_kernel}" \ + "${image_pcr_policy}" \ + "${image_grub}" \ + "${image_shim}" \ + "${image_kconfig}" \ + "${image_initrd_contents}" \ + "${image_initrd_contents_wtd}" \ + "${image_disk_usage}" + local root_with_everything="${root_fs_dir}" # Call helper script for adding sysexts to the base OS. diff --git a/build_sysext b/build_sysext index 6ecbdb5f500..40f56af6809 100755 --- a/build_sysext +++ b/build_sysext @@ -244,6 +244,7 @@ export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release # Unmount in order to get rid of the overlay umount "${BUILD_DIR}/${FLAGS_install_root_basename}" +sudo setfiles -Dv -r "${BUILD_DIR}/${FLAGS_install_root_basename}" "${BUILD_DIR}/fs-root"/etc/selinux/mcs/contexts/files/file_contexts "${BUILD_DIR}/${FLAGS_install_root_basename}"/usr umount "${BUILD_DIR}/fs-root" if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild index b6e64960492..e58e45a82d0 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild @@ -148,6 +148,7 @@ RDEPEND="${RDEPEND} sec-policy/selinux-base-policy sec-policy/selinux-container sec-policy/selinux-dbus + sec-policy/selinux-docker sec-policy/selinux-policykit sec-policy/selinux-unconfined sys-apps/acl diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest new file mode 100644 index 00000000000..b593733d9d7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest @@ -0,0 +1,6 @@ +DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616 +DIST patchbundle-selinux-base-policy-2.20260312_p1.tar.bz2 9408379 BLAKE2B d5cb2ff2de4cf0e00dd1e84046729a69c255627d083a9dad4c750d87222001696043f58ed94e3ab0562314645cb38e41339e36dcf5cec0765749751b42389cc3 SHA512 7b0f87bb0084258a931cbace7c7b6828ed6e592cf348f1c695ec6f6b49030920eeb78cd558b14420951cc5ca6a1c1afa9e74023a7b7dae046eb13561256cd4e1 +DIST patchbundle-selinux-base-policy-2.20260616_p1.tar.bz2 297301 BLAKE2B a0fb3505d10044e02e34b5d72cc88dac7e9d1234a504d2cfb894827573a1cd69020722ef8023f2d37ad33e571ddeb00d377f5f37d9bed1925e0ab750235574c2 SHA512 dcf1becdf8bf75c4cf4f3e9b96a39fecd329d5f9accb2bb39fd6f61df511654fbe6f9c34094dbf0f8ae4e5e24faa59502df0a80af80a0d29adfdfb9b8be10ddd +DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8 +DIST refpolicy-2.20260312.tar.bz2 649774 BLAKE2B 11f6150010a57f9dba6284021cd4c6521cec8e907f1f08fad45191fe9966846265d3c03d00aec9f3210659e864b4d40cac6cb8e4793a686a00f754191bc41079 SHA512 a34b5b08f9cd969fd6c3a2ed07ccdfea359054d0071e25e99b3978fd678e2314975eaf67c3f0931a68a407e675a73a16bb021106dde1dd20c1fff115dd8d3b29 +DIST refpolicy-2.20260616.tar.bz2 655092 BLAKE2B b8dbfce78d68bb771f7f3795b00bee063d84d3eb4025e1ddb97592bfd25d8ae42868e9c03a0e2d86fb981c724f25e2d0dca73e21f978e3dffd1947ae2aa21064 SHA512 14336a518ac074e03ece3a97d61ba2e1e1edac270a80feb605c56a0d871166989043142534511c70c151c78b4ad5748c3aea9d77125538acdebdab8f2e06f21f diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml new file mode 100644 index 00000000000..781bc07e6d5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml @@ -0,0 +1,8 @@ + + + + + selinux@gentoo.org + SELinux Team + + diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618_p1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618_p1.ebuild new file mode 100644 index 00000000000..13dc7de976b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618_p1.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +MODS="docker" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for docker" + +if [[ ${PV} != 9999* ]] ; then + KEYWORDS="amd64 arm arm64 x86" +fi + +DEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" +RDEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260312_p1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260312_p1.ebuild new file mode 100644 index 00000000000..13dc7de976b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260312_p1.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +MODS="docker" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for docker" + +if [[ ${PV} != 9999* ]] ; then + KEYWORDS="amd64 arm arm64 x86" +fi + +DEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" +RDEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260616_p1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260616_p1.ebuild new file mode 100644 index 00000000000..fb3e74bebf6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260616_p1.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +MODS="docker" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for docker" + +if [[ ${PV} != 9999* ]] ; then + KEYWORDS="~amd64 ~arm ~arm64 ~x86" +fi + +DEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" +RDEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild new file mode 100644 index 00000000000..fb3e74bebf6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +MODS="docker" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for docker" + +if [[ ${PV} != 9999* ]] ; then + KEYWORDS="~amd64 ~arm ~arm64 ~x86" +fi + +DEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" +RDEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]"