From 1d9db50bb431ed1d5c4ccaea817b650281fc5e23 Mon Sep 17 00:00:00 2001 From: Kai Lueke Date: Wed, 20 Dec 2023 11:20:39 +0100 Subject: [PATCH 1/2] SELinux: Label /usr and sysext image contents So far we did not correctly label /usr because it broke certain things like Docker. With the sysext Docker and new policies we should try again. First generate the policy before branching off the base squashfs (which already misses a lot of things because they the most postprocessing is done late in finish_image!). Then label /usr and also the sysext contents in their folder - not in the overlay mount because this would operate on the whole image. --- build_library/build_image_util.sh | 35 +++++++++++++++++++++-------- build_library/dev_container_util.sh | 2 ++ build_library/prod_image_util.sh | 15 +++++++++++++ build_sysext | 1 + 4 files changed, 44 insertions(+), 9 deletions(-) diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index d942857eab0..aa943d7e568 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -529,6 +529,30 @@ start_image() { --board="${BOARD}" } +# Actions common to the dev container and the image +# but which should be run before the image branches off +# the base squashfs (used for systemd-sysext image building) +finish_image_common() { + local image_name="$1" + local disk_layout="$2" + local root_fs_dir="$3" + local image_contents="$4" + local image_contents_wtd="$5" + local image_kernel="$6" + local pcr_policy="$7" + local image_grub="$8" + local image_shim="$9" + local image_kconfig="${10}" + local image_initrd_contents="${11}" + local image_initrd_contents_wtd="${12}" + local image_disk_space_usage="${13}" + + # Build the selinux policy + if pkg_use_enabled coreos-base/coreos selinux; then + sudo chroot "${root_fs_dir}" bash -c "cd /usr/share/selinux/mcs && semodule -s mcs -i *.pp" + fi +} + finish_image() { local image_name="$1" local disk_layout="$2" @@ -645,11 +669,6 @@ EOF "${BUILD_DIR}/${image_kconfig}" fi - # Build the selinux policy - if pkg_use_enabled coreos-base/coreos selinux; then - sudo chroot "${root_fs_dir}" bash -c "cd /usr/share/selinux/mcs && semodule -s mcs -i *.pp" - fi - # Run tmpfiles once to make sure that /etc has everything in place before # we freeze it in /usr/share/flatcar/etc as lowerdir in the overlayfs. @@ -685,10 +704,8 @@ EOF # setfiles from version 3.11 requires the passed path to have no symlinks local real_root_fs_dir real_root_fs_dir=$(realpath "${root_fs_dir}") - # TODO: Breaks the system: - # sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}" - # sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr - # For now we only try it with /etc + sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}" + sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/usr sudo setfiles -Dv -r "${real_root_fs_dir}" "${real_root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${real_root_fs_dir}"/etc fi diff --git a/build_library/dev_container_util.sh b/build_library/dev_container_util.sh index b0e08474c0e..c44da3e0187 100755 --- a/build_library/dev_container_util.sh +++ b/build_library/dev_container_util.sh @@ -113,6 +113,8 @@ create_dev_container() { # The remount services are provided by coreos-base/coreos-init systemd_enable "${root_fs_dir}" "multi-user.target" "remount-usr.service" + finish_image_common "${image_name}" "${disk_layout}" "${root_fs_dir}" "${image_contents}" "${image_contents_wtd}" + finish_image "${image_name}" "${disk_layout}" "${root_fs_dir}" "${image_contents}" "${image_contents_wtd}" declare -a files_to_evaluate diff --git a/build_library/prod_image_util.sh b/build_library/prod_image_util.sh index 955ec5542be..a4ac4da3ca8 100755 --- a/build_library/prod_image_util.sh +++ b/build_library/prod_image_util.sh @@ -98,6 +98,21 @@ create_prod_image() { run_ldconfig "${root_fs_dir}" run_localedef "${root_fs_dir}" + finish_image_common \ + "${image_name}" \ + "${disk_layout}" \ + "${root_fs_dir}" \ + "${image_contents}" \ + "${image_contents_wtd}" \ + "${image_kernel}" \ + "${image_pcr_policy}" \ + "${image_grub}" \ + "${image_shim}" \ + "${image_kconfig}" \ + "${image_initrd_contents}" \ + "${image_initrd_contents_wtd}" \ + "${image_disk_usage}" + local root_with_everything="${root_fs_dir}" # Call helper script for adding sysexts to the base OS. diff --git a/build_sysext b/build_sysext index 6ecbdb5f500..40f56af6809 100755 --- a/build_sysext +++ b/build_sysext @@ -244,6 +244,7 @@ export SOURCE_DATE_EPOCH=$(stat -c '%Y' "${BUILD_DIR}/fs-root/usr/lib/os-release # Unmount in order to get rid of the overlay umount "${BUILD_DIR}/${FLAGS_install_root_basename}" +sudo setfiles -Dv -r "${BUILD_DIR}/${FLAGS_install_root_basename}" "${BUILD_DIR}/fs-root"/etc/selinux/mcs/contexts/files/file_contexts "${BUILD_DIR}/${FLAGS_install_root_basename}"/usr umount "${BUILD_DIR}/fs-root" if [[ "$FLAGS_generate_pkginfo" = "${FLAGS_TRUE}" ]] ; then From 283b697dc8c2f7cacb4a5ade3cd5f4e5aab9b398 Mon Sep 17 00:00:00 2001 From: Mathieu Tortuyaux Date: Fri, 29 Nov 2024 09:48:48 +0100 Subject: [PATCH 2/2] sec-policy/selinux-docker: add selinux-docker This is missing for containerd and docker labels: Current: ``` $ selabel_lookup -k /usr/bin/docker Default context: system_u:object_r:bin_t:s0 ``` Signed-off-by: Mathieu Tortuyaux --- .github/workflows/portage-stable-packages-list | 1 + .../coreos-base/coreos/coreos-0.0.1.ebuild | 1 + .../sec-policy/selinux-docker/Manifest | 6 ++++++ .../sec-policy/selinux-docker/metadata.xml | 8 ++++++++ .../selinux-docker-2.20250618_p1.ebuild | 17 +++++++++++++++++ .../selinux-docker-2.20260312_p1.ebuild | 17 +++++++++++++++++ .../selinux-docker-2.20260616_p1.ebuild | 17 +++++++++++++++++ .../selinux-docker/selinux-docker-9999.ebuild | 17 +++++++++++++++++ 8 files changed, 84 insertions(+) create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618_p1.ebuild create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260312_p1.ebuild create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260616_p1.ebuild create mode 100644 sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list index f9dada95f09..dbf828ec1bf 100644 --- a/.github/workflows/portage-stable-packages-list +++ b/.github/workflows/portage-stable-packages-list @@ -590,6 +590,7 @@ sec-policy/selinux-base sec-policy/selinux-base-policy sec-policy/selinux-container sec-policy/selinux-dbus +sec-policy/selinux-docker sec-policy/selinux-policykit sec-policy/selinux-sssd sec-policy/selinux-unconfined diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild index b6e64960492..e58e45a82d0 100644 --- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild +++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild @@ -148,6 +148,7 @@ RDEPEND="${RDEPEND} sec-policy/selinux-base-policy sec-policy/selinux-container sec-policy/selinux-dbus + sec-policy/selinux-docker sec-policy/selinux-policykit sec-policy/selinux-unconfined sys-apps/acl diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest new file mode 100644 index 00000000000..b593733d9d7 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/Manifest @@ -0,0 +1,6 @@ +DIST patchbundle-selinux-base-policy-2.20250618-r1.tar.bz2 306720 BLAKE2B b90de06fd143293d67f244013b9a6d775864e7fdfa54c3b5852e31c7594338dfb927b1ef105f4dd688e68932d1d20f91ad7d5cfb909a93f962a427a0a8708c0c SHA512 124424dc8c8eb0f82735d30b000568a8c4c9969363d55cf4f15a5b82a2ca7619e93e5f908cafa9f1a2c4d35d2dcf76869cac85cff909e3fccf47c8666ec15616 +DIST patchbundle-selinux-base-policy-2.20260312_p1.tar.bz2 9408379 BLAKE2B d5cb2ff2de4cf0e00dd1e84046729a69c255627d083a9dad4c750d87222001696043f58ed94e3ab0562314645cb38e41339e36dcf5cec0765749751b42389cc3 SHA512 7b0f87bb0084258a931cbace7c7b6828ed6e592cf348f1c695ec6f6b49030920eeb78cd558b14420951cc5ca6a1c1afa9e74023a7b7dae046eb13561256cd4e1 +DIST patchbundle-selinux-base-policy-2.20260616_p1.tar.bz2 297301 BLAKE2B a0fb3505d10044e02e34b5d72cc88dac7e9d1234a504d2cfb894827573a1cd69020722ef8023f2d37ad33e571ddeb00d377f5f37d9bed1925e0ab750235574c2 SHA512 dcf1becdf8bf75c4cf4f3e9b96a39fecd329d5f9accb2bb39fd6f61df511654fbe6f9c34094dbf0f8ae4e5e24faa59502df0a80af80a0d29adfdfb9b8be10ddd +DIST refpolicy-2.20250618.tar.bz2 632711 BLAKE2B f522c16552fbbf66d4549bf082ece4be740018822b9b7da318c12aa3f3108a905b5f71fc6bb5e894468126123d81aa4e309912ec04c2a2e27feda00689a5ecd8 SHA512 3bfd32be63d0928c5be47707ce6d53bc3bb7b3d922fda2441d455b913eb79d33b16ba31320394aa1d9ec7afb6d9c853c3cd4c025962c6f355dbb7194bdb1c1a8 +DIST refpolicy-2.20260312.tar.bz2 649774 BLAKE2B 11f6150010a57f9dba6284021cd4c6521cec8e907f1f08fad45191fe9966846265d3c03d00aec9f3210659e864b4d40cac6cb8e4793a686a00f754191bc41079 SHA512 a34b5b08f9cd969fd6c3a2ed07ccdfea359054d0071e25e99b3978fd678e2314975eaf67c3f0931a68a407e675a73a16bb021106dde1dd20c1fff115dd8d3b29 +DIST refpolicy-2.20260616.tar.bz2 655092 BLAKE2B b8dbfce78d68bb771f7f3795b00bee063d84d3eb4025e1ddb97592bfd25d8ae42868e9c03a0e2d86fb981c724f25e2d0dca73e21f978e3dffd1947ae2aa21064 SHA512 14336a518ac074e03ece3a97d61ba2e1e1edac270a80feb605c56a0d871166989043142534511c70c151c78b4ad5748c3aea9d77125538acdebdab8f2e06f21f diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml new file mode 100644 index 00000000000..781bc07e6d5 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/metadata.xml @@ -0,0 +1,8 @@ + + + + + selinux@gentoo.org + SELinux Team + + diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618_p1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618_p1.ebuild new file mode 100644 index 00000000000..13dc7de976b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20250618_p1.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +MODS="docker" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for docker" + +if [[ ${PV} != 9999* ]] ; then + KEYWORDS="amd64 arm arm64 x86" +fi + +DEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" +RDEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260312_p1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260312_p1.ebuild new file mode 100644 index 00000000000..13dc7de976b --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260312_p1.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +MODS="docker" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for docker" + +if [[ ${PV} != 9999* ]] ; then + KEYWORDS="amd64 arm arm64 x86" +fi + +DEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" +RDEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260616_p1.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260616_p1.ebuild new file mode 100644 index 00000000000..fb3e74bebf6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-2.20260616_p1.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +MODS="docker" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for docker" + +if [[ ${PV} != 9999* ]] ; then + KEYWORDS="~amd64 ~arm ~arm64 ~x86" +fi + +DEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" +RDEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" diff --git a/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild new file mode 100644 index 00000000000..fb3e74bebf6 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/sec-policy/selinux-docker/selinux-docker-9999.ebuild @@ -0,0 +1,17 @@ +# Copyright 1999-2026 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +MODS="docker" + +inherit selinux-policy-2 + +DESCRIPTION="SELinux policy for docker" + +if [[ ${PV} != 9999* ]] ; then + KEYWORDS="~amd64 ~arm ~arm64 ~x86" +fi + +DEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]" +RDEPEND+="sec-policy/selinux-container[${SELINUX_POLICY_USEDEP}]"