Enable SELinux for tumbleweed and rename it to green

Signed-off-by: David Cassany <[email protected]>
rancher · Apr 22, 2024 · 6588e72 · 6588e72
1 parent c80eaa9
commit 6588e72
Show file tree

Hide file tree

Showing 13 changed files with 90 additions and 57 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -29,7 +29,7 @@ jobs:
     - id: set-matrix
       run: |
         if [ "${{ contains(github.event.pull_request.labels.*.name, 'all-distros') }}" == "true" ]; then
-          echo "flavor=['green', 'tumbleweed', 'blue', 'orange']" >> $GITHUB_OUTPUT
+          echo "flavor=['green', 'blue', 'orange']" >> $GITHUB_OUTPUT
         else
           echo "flavor=['green']" >> $GITHUB_OUTPUT
         fi

diff --git a/.github/workflows/manual_arm.yaml b/.github/workflows/manual_arm.yaml
@@ -10,7 +10,7 @@ jobs:
   build-matrix:
     strategy:
       matrix:
-        flavor: ['green', 'tumbleweed']
+        flavor: ['green']
     uses: ./.github/workflows/build_and_test_arm.yaml
     with:
       flavor: ${{ matrix.flavor }}
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
@@ -31,7 +31,7 @@ jobs:
   build-matrix:
     strategy:
       matrix:
-        flavor: ['green', 'tumbleweed']
+        flavor: ['green']
     uses: ./.github/workflows/build_and_test_x86.yaml
     with:
       flavor: ${{ matrix.flavor }}
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,4 @@
-ARG BASE_OS_IMAGE=registry.opensuse.org/opensuse/leap
-ARG BASE_OS_VERSION=15.5
+ARG BASE_OS_IMAGE=registry.opensuse.org/opensuse/tumbleweed
 ARG GO_VERSION=1.22
 
 FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine as elemental-bin
@@ -31,7 +30,7 @@ RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build \
     -X github.com/rancher/elemental-toolkit/v2/internal/version.gitCommit=${ELEMENTAL_COMMIT}" \
     -o /usr/bin/elemental
 
-FROM ${BASE_OS_IMAGE}:${BASE_OS_VERSION} AS elemental-toolkit
+FROM ${BASE_OS_IMAGE} AS elemental-toolkit
 # This helps invalidate the cache on each build so the following steps are really run again getting the latest packages
 # versions, as long as the elemental commit has changed
 ARG ELEMENTAL_COMMIT=""
@@ -56,6 +55,12 @@ RUN ARCH=$(uname -m); \
         xorriso \
         cosign \
         gptfdisk \
+        selinux-tools \
+        selinux-policy \
+        selinux-policy-targeted \
+        container-selinux \
+        k3s-selinux \
+        btrfsprogs \
         lvm2 && \
     zypper cc -a
 

diff --git a/Makefile b/Makefile
@@ -11,7 +11,7 @@ IMAGE_SIZE?=20G
 REPO?=local/elemental-$(FLAVOR)
 TOOLKIT_REPO?=local/elemental-toolkit
 DOCKER?=docker
-BASE_OS_IMAGE?=registry.opensuse.org/opensuse/leap
+BASE_OS_IMAGE?=registry.opensuse.org/opensuse/tumbleweed
 BASE_OS_VERSION?=15.5
 DOCKER_SOCK?=/var/run/docker.sock
 

diff --git a/examples/tumbleweed/05_network.yaml → examples/green-legacy/05_network.yaml b/examples/tumbleweed/05_network.yaml → examples/green-legacy/05_network.yaml
diff --git a/examples/tumbleweed/Dockerfile → examples/green-legacy/Dockerfile b/examples/tumbleweed/Dockerfile → examples/green-legacy/Dockerfile
@@ -1,38 +1,24 @@
 # run `make build` to build local/elemental-toolkit image
 ARG TOOLKIT_REPO
 ARG VERSION
-ARG OS_IMAGE=registry.opensuse.org/opensuse/tumbleweed
-ARG OS_VERSION=latest
-
 FROM ${TOOLKIT_REPO}:${VERSION} AS TOOLKIT
 
 # OS base image of our choice
-FROM ${OS_IMAGE}:${OS_VERSION} AS OS
+FROM registry.opensuse.org/opensuse/leap:15.5 as OS
 ARG REPO
 ARG VERSION
-ENV REPO=${REPO}
 ENV VERSION=${VERSION}
 
-# Workaround for RISC-V, specific kernel might be needed for some boards
-ARG ADD_REPO
-ENV ADD_REPO=${ADD_REPO}
-
-# Install kernel, systemd, dracut, grub2 and other required tools
+# install kernel, systemd, dracut, grub2 and other required tools
 RUN ARCH=$(uname -m); \
-    zypper --non-interactive removerepo repo-update || true; \
-    if [[ -n "${ADD_REPO}" ]]; then \
-      zypper --non-interactive addrepo --enable --refresh ${ADD_REPO} added-repo; \
-    fi; \
-    if [[ "${ARCH}" != "riscv64" ]]; then \
-      ADD_PKGS+=" shim"; \
-      [[ "${ARCH}" == "aarch64" ]] && ARCH="arm64"; \
-    fi; \
-    zypper --non-interactive --gpg-auto-import-keys install --no-recommends -- \
+    [[ "${ARCH}" == "aarch64" ]] && ARCH="arm64"; \
+    zypper --non-interactive install --no-recommends -- \
       kernel-default \
       device-mapper \
       dracut \
       grub2 \
       grub2-${ARCH}-efi \
+      shim \
       haveged \
       systemd \
       NetworkManager \
@@ -56,28 +42,31 @@ RUN ARCH=$(uname -m); \
       less \
       sudo \
       curl \
-      sed \
-      patch \
       iproute2 \
+      btrfsprogs \
+      btrfsmaintenance \
+      snapper \
       podman \
-      ${ADD_PKGS} && \
+      sed && \
     zypper clean --all
 
 # Just add the elemental cli
 COPY --from=TOOLKIT /usr/bin/elemental /usr/bin/elemental
 
 # Enable essential services
-RUN systemctl enable NetworkManager.service && \
-    systemctl enable sshd.service
+RUN systemctl enable NetworkManager.service
 
-# This is for automatic testing purposes, do not do this in production.
-RUN echo "PermitRootLogin yes" > /etc/ssh/sshd_config.d/rootlogin.conf
+# Enable /tmp to be on tmpfs
+RUN cp /usr/share/systemd/tmp.mount /etc/systemd/system
 
 # Add default network configuration
 ADD 05_network.yaml /system/oem/05_network.yaml
 
 # Generate initrd with required elemental services
-RUN elemental --debug init --force
+RUN elemental init --debug --force
+
+# Add default snapshotter setup
+ADD snapshotter.yaml /etc/elemental/config.d/snapshotter.yaml
 
 # Update os-release file with some metadata
 RUN echo IMAGE_REPO=\"${REPO}\"         >> /etc/os-release && \

diff --git a/examples/green-legacy/snapshotter.yaml b/examples/green-legacy/snapshotter.yaml
@@ -0,0 +1,3 @@
+snapshotter:
+  type: btrfs
+  max-snaps: 4
diff --git a/examples/green/Dockerfile b/examples/green/Dockerfile
@@ -1,24 +1,38 @@
 # run `make build` to build local/elemental-toolkit image
 ARG TOOLKIT_REPO
 ARG VERSION
+ARG OS_IMAGE=registry.opensuse.org/opensuse/tumbleweed
+ARG OS_VERSION=latest
+
 FROM ${TOOLKIT_REPO}:${VERSION} AS TOOLKIT
 
 # OS base image of our choice
-FROM registry.opensuse.org/opensuse/leap:15.5 as OS
+FROM ${OS_IMAGE}:${OS_VERSION} AS OS
 ARG REPO
 ARG VERSION
+ENV REPO=${REPO}
 ENV VERSION=${VERSION}
 
-# install kernel, systemd, dracut, grub2 and other required tools
+# Workaround for RISC-V, specific kernel might be needed for some boards
+ARG ADD_REPO
+ENV ADD_REPO=${ADD_REPO}
+
+# Install kernel, systemd, dracut, grub2 and other required tools
 RUN ARCH=$(uname -m); \
-    [[ "${ARCH}" == "aarch64" ]] && ARCH="arm64"; \
-    zypper --non-interactive install --no-recommends -- \
+    zypper --non-interactive removerepo repo-update || true; \
+    if [[ -n "${ADD_REPO}" ]]; then \
+      zypper --non-interactive addrepo --enable --refresh ${ADD_REPO} added-repo; \
+    fi; \
+    if [[ "${ARCH}" != "riscv64" ]]; then \
+      ADD_PKGS+=" shim"; \
+      [[ "${ARCH}" == "aarch64" ]] && ARCH="arm64"; \
+    fi; \
+    zypper --non-interactive --gpg-auto-import-keys install --no-recommends -- \
       kernel-default \
       device-mapper \
       dracut \
       grub2 \
       grub2-${ARCH}-efi \
-      shim \
       haveged \
       systemd \
       NetworkManager \
@@ -42,29 +56,39 @@ RUN ARCH=$(uname -m); \
       less \
       sudo \
       curl \
+      sed \
+      patch \
       iproute2 \
+      audit \
+      selinux-tools \
+      selinux-policy \
+      selinux-policy-targeted \
+      container-selinux \
+      k3s-selinux \
       btrfsprogs \
       btrfsmaintenance \
       snapper \
-      transactional-update \
-      podman \
-      sed && \
+      ${ADD_PKGS} && \
     zypper clean --all
 
 # Just add the elemental cli
 COPY --from=TOOLKIT /usr/bin/elemental /usr/bin/elemental
 
 # Enable essential services
-RUN systemctl enable NetworkManager.service
+RUN systemctl enable NetworkManager.service && \
+    systemctl enable sshd.service
 
-# Enable /tmp to be on tmpfs
-RUN cp /usr/share/systemd/tmp.mount /etc/systemd/system
+# This is for automatic testing purposes, do not do this in production.
+RUN echo "PermitRootLogin yes" > /etc/ssh/sshd_config.d/rootlogin.conf
 
 # Add default network configuration
 ADD 05_network.yaml /system/oem/05_network.yaml
 
+# SELinux in enforce mode
+RUN sed -i "s|SELINUX=.*|SELINUX=enforcing|g" /etc/selinux/config
+
 # Generate initrd with required elemental services
-RUN elemental init --debug --force
+RUN elemental --debug init --force
 
 # Add default snapshotter setup
 ADD snapshotter.yaml /etc/elemental/config.d/snapshotter.yaml

diff --git a/pkg/features/embedded/cloud-config-defaults/system/oem/04_accounting.yaml b/pkg/features/embedded/cloud-config-defaults/system/oem/04_accounting.yaml
@@ -14,4 +14,4 @@ stages:
          entity: |
             kind: "shadow"
             username: "root"
-            password: "cos"
+            password: "root"
diff --git a/pkg/features/embedded/cloud-config-defaults/system/oem/10_selinux.yaml b/pkg/features/embedded/cloud-config-defaults/system/oem/10_selinux.yaml
@@ -8,10 +8,23 @@
 name: "SELinux"
 stages:
    initramfs:
-     - name: "Relabelling"
+     - name: "SELinux labels for targeted policy"
        commands:
        - | 
-         if grep -q "selinux=1" /proc/cmdline; then
-           load_policy -i
-           restorecon -R -i -v /etc /root /opt /srv /var /home /usr/local /oem
+         if grep -qw selinux /sys/kernel/security/lsm; then
+           # Some extended attributes are lost on copy-up bsc#1210690. Workaround visit children first, then parents
+           for path in /etc /srv /var /oem /home /root /opt; do
+             if [ -d "${path}" ]; then
+               find ${path} -depth -exec /sbin/setfiles -F -v "/etc/selinux/targeted/contexts/files/file_contexts" \{\} +
+             fi
+           done
+         fi
+   fs:
+     - name: "Restore SELinux labels for targeted policy after switching root"
+       commands:
+       - | 
+         if grep -qw selinux /sys/kernel/security/lsm; then
+           # Once SELinux label kicks in there is a relabel step for /run causing an unwanted relabelling
+           # to /etc and other tmpfs upper dirs, lets restore the context here.
+           restorecon -R -i -v /etc /srv /var /oem /home /root /opt
          fi
diff --git a/pkg/features/embedded/grub-default-bootargs/etc/elemental/bootargs.cfg b/pkg/features/embedded/grub-default-bootargs/etc/elemental/bootargs.cfg
@@ -15,12 +15,12 @@ if [ -n "${img}" ]; then
 fi
 
 if [ "${mode}" == "recovery" ]; then
-  set kernelcmd="console=tty1 console=ttyS0 root=LABEL=${recovery_label} ${img_arg} elemental.mode=${mode} elemental.oemlabel=${oem_label} security=selinux selinux=0 rd.neednet=1"
+  set kernelcmd="console=tty1 console=ttyS0 root=LABEL=${recovery_label} ${img_arg} elemental.mode=${mode} elemental.oemlabel=${oem_label} security=selinux selinux=1 enforcing=0 rd.neednet=1"
 else
   if [ "${snapshotter}" == "btrfs" ]; then
     set snap_arg="elemental.snapshotter=btrfs"
   fi
-  set kernelcmd="console=tty1 console=ttyS0 root=LABEL=${state_label} ${img_arg} ${snap_arg} elemental.mode=${mode} elemental.oemlabel=${oem_label} panic=5 security=selinux selinux=0 rd.neednet=1 fsck.mode=force fsck.repair=yes"
+  set kernelcmd="console=tty1 console=ttyS0 root=LABEL=${state_label} ${img_arg} ${snap_arg} elemental.mode=${mode} elemental.oemlabel=${oem_label} panic=5 security=selinux selinux=1 rd.neednet=1 fsck.mode=force fsck.repair=yes"
 fi
 
 set kernel=/boot/vmlinuz

diff --git a/tests/vm/sut.go b/tests/vm/sut.go
@@ -48,7 +48,6 @@ const (
 	Ext2 = "ext2"
 	Ext3 = "ext3"
 	Ext4 = "ext4"
-	Cos  = "cos"
 )
 
 // DiskLayout is the struct that contains the disk output from lsblk
@@ -91,7 +90,7 @@ func NewSUT() *SUT {
 	}
 	pass := os.Getenv("COS_PASS")
 	if pass == "" {
-		pass = Cos
+		pass = "root"
 	}
 
 	host := os.Getenv("COS_HOST")
@@ -137,9 +136,9 @@ func (s *SUT) ChangeBoot(b string) error {
 
 	switch b {
 	case Active:
-		bootEntry = Cos
+		bootEntry = "active"
 	case Passive:
-		bootEntry = "fallback"
+		bootEntry = "1"
 	case Recovery:
 		bootEntry = "recovery"
 	}