Enable SELinux for tumbleweed and green #2052
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
davidcassany
force-pushed
the
SELinux_in_enforce_mode_TW
branch
2 times, most recently
from
b64d099
to
817021c
Compare
frelon
reviewed
Apr 22, 2024
pkg/features/embedded/cloud-config-defaults/system/oem/04_accounting.yaml
Outdated
Show resolved
Hide resolved
davidcassany
force-pushed
the
SELinux_in_enforce_mode_TW
branch
from
817021c
to
3dcc2d3
Compare
|
@davidcassany FYI on Tumbleweed a |
davidcassany
force-pushed
the
SELinux_in_enforce_mode_TW
branch
2 times, most recently
from
6588e72
to
40a71de
Compare
fgiudici
previously approved these changes
Apr 23, 2024
davidcassany
force-pushed
the
SELinux_in_enforce_mode_TW
branch
5 times, most recently
from
56debcf
to
b748a92
Compare
Signed-off-by: David Cassany <[email protected]>
Signed-off-by: David Cassany <[email protected]>
Signed-off-by: David Cassany <[email protected]>
davidcassany
force-pushed
the
SELinux_in_enforce_mode_TW
branch
4 times, most recently
from
54a4fa4
to
67b94f9
Compare
Signed-off-by: David Cassany <[email protected]>
Signed-off-by: David Cassany <[email protected]>
davidcassany
force-pushed
the
SELinux_in_enforce_mode_TW
branch
from
67b94f9
to
2fb783e
Compare
frelon
approved these changes
Apr 29, 2024
frelon
reviewed
Apr 29, 2024
| contextFile := filepath.Join(rootDir, cnst.SELinuxTargetedContextFile) | ||
| contextExists, _ := utils.Exists(c.Fs, contextFile) | ||
|
|
||
| if err == nil && contextExists && c.Runner.CommandExists("setfiles") { | ||
| if contextExists && c.Runner.CommandExists("setfiles") { |
There was a problem hiding this comment.
maybe we should check that rootDir is RW as well? might be enough to get the recovery test green.
There was a problem hiding this comment.
It is RW... disable selinux and the test will pass, I believe the snapper error msg is just misleading, it could not write due to some denial, but not because of being RO.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR uses SELinux in enforce mode for the active/passive systems and in permissive mode for recovery and ISO systems.
The elemental labelling code changed slightly, basically the change is that now it is also executed as part of the close transaction step once the new root is already rsynced. In addition it also tries to label from the outer system any eventual mountpoint that was labeled in a chroot env (
/dev,/proc,/sys, etc.).Current unsolved issues:
In github actions the host has SELinux enabled and relabeling the new root within a container turns to fail (see build disk and build iso logs in GH)... as a consequence the disk and iso images are not properly labeled, hence they are not really usabled in enforce mode. This does not happen in a host without the
container-selinuxpolicy module. This has impact on our capability to build ISOs and Disks inside a k8s cluster using unprivileged pods.Running upgrades from the recovery system (
elemental upgradecommand) is not functional if the target is in btrfs. There seams to be an issue with selinux labels when mounting the.snapshotssubvolume preventing snapper to properly operate. One option would be to rethink the btrfs snapshotter env in recovery mode, instead of mounting.snapshotsin<some/root>/.snapshotsjust use/.snapshotsso any eventual relabel is done with the appropriate path.Fixes #2054
Signed-off-by: David Cassany [email protected]