libpriv: Rebuild policy during postprocessing by jlebon · Pull Request #1754 · coreos/rpm-ostree

jlebon · 2019-02-06T17:14:44Z

It's possible for some postprocessing scripts to affect the final
SELinux policy. This is the case for the new /etc/default/useradd edit
we now do (#1726), but it could've been the case beforehand too with
user scripts modifying e.g. booleans (though ideally all these
modifications would be part of RPMs).

Do a final semodule -nB during postprocessing so that the final policy
we commit is "up to date". Otherwise, users may only see changes take
effect if they layer packages that trigger a rebuild.

The motivation for this is specifically for /etc/default/useradd.
There is magic in selinux-policy that parses the file and generates
templated rules from the value of HOME.

For more info, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1669982
https://src.fedoraproject.org/rpms/selinux-policy/pull-request/14

It's possible for some postprocessing scripts to affect the final SELinux policy. This is the case for the new `/etc/default/useradd` edit we now do (coreos#1726), but it could've been the case beforehand too with user scripts modifying e.g. booleans (though ideally all these modifications would be part of RPMs). Do a final `semodule -nB` during postprocessing so that the final policy we commit is "up to date". Otherwise, users may only see changes take effect if they layer packages that trigger a rebuild. The motivation for this is specifically for `/etc/default/useradd`. There is magic in `selinux-policy` that parses the file and generates templated rules from the value of `HOME`. For more info, see: https://bugzilla.redhat.com/show_bug.cgi?id=1669982 https://src.fedoraproject.org/rpms/selinux-policy/pull-request/14

rfairley

LGTM - works on my end doing a compose.

rust/src/composepost.rs

rfairley · 2019-02-08T17:18:15Z

Note: holding on merging this, awaiting confirmation in https://src.fedoraproject.org/rpms/selinux-policy/pull-request/14

cgwalters · 2019-02-12T15:12:33Z

So...sorry about delaying on this. Again my primary concern here is making sure we're not breaking anything in the version combination matrix.

For example we believe this shouldn't cause any harm for e.g. RHEL7 systems with older selinux policy?

jlebon · 2019-02-12T16:19:52Z

For RHCOS & CAHC, we're shipping the latest rpm-ostree there, so it should also be affected by the useradd rule generation issue (though we're not really planning to overlay packages on RHCOS, so it's less likely to manifest). Let me double-check this and confirm that this fixes it.

Manually patch `file_contexts.subs_dist` so that `/home` is equivalent to `/var/home`. This is required now that the generated homedirs rules use `/var/home`. Otherwise, `matchpathcon` for example will return wrong results. This patch also includes the *removal* of `/var/home -> /home` so that we're not dependent on this selinux-policy patch making it at the same time as downstream: https://src.fedoraproject.org/rpms/selinux-policy/pull-request/14 (See the conversation there for more information.)

jlebon · 2019-02-12T22:42:02Z

OK, so testing this on the latest RHCOS. Because the compose wasn't done with v2019.1, it didn't have #1726 yet. So I started off with manually modifying this:

[root@localhost ~]# rpm-ostree status
State: idle
AutomaticUpdates: disabled
Deployments:
● pivot://registry.svc.ci.openshift.org/rhcos/maipo@sha256:deaee0...
              CustomOrigin: Provisioned from oscontainer
                   Version: 47.313 (2019-02-12T00:09:45Z)
                    Commit: b6f729503ebf3b15da2414699156d2340630864a4f93dc75ae55cff4df1966c9
[root@localhost ~]# mkdir -p rootfs/usr/etc/default/                                                                   
[root@localhost ~]# sed 's/HOME=.*/HOME=\/var\/home/' < /usr/etc/default/useradd > rootfs/usr/etc/default/useradd
[root@localhost ~]# ostree commit -b with-useradd-tweak --tree=ref=b6f729503ebf3b15da2414699156d2340630864a4f93dc75ae55cff4df1966c9 --tree=dir=rootfs
9559fec423d642f19d1453ef17f66ac17280898c427fa7d4cbca017e324e5c7c
[root@localhost ~]# rpm-ostree rebase :with-useradd-tweak
...
[root@localhost ~]# reboot

I then triggered a policy regen by layering a pkg that does semodule -nB in its %post, and we then see the same issue as on Fedora:

[root@localhost ~]# rpm-ostree install ./foobar-1.0-1.x86_64.rpm
...
[root@localhost ~]# reboot
...
[root@localhost ~]# matchpathcon /home
/home   system_u:object_r:default_t:s0
[root@localhost ~]# matchpathcon /home/nonexistent
/home/nonexistent       system_u:object_r:default_t:s0
[root@localhost ~]# useradd newuser
[root@localhost ~]# ls -laZ /home/newuser
drwx------. newuser newuser system_u:object_r:default_t:s0   .
drwxr-xr-x. root    root    system_u:object_r:default_t:s0   ..
-rw-r--r--. newuser newuser system_u:object_r:default_t:s0   .bash_logout
-rw-r--r--. newuser newuser system_u:object_r:default_t:s0   .bash_profile
-rw-r--r--. newuser newuser system_u:object_r:default_t:s0   .bashrc

Removing the /var/home -> /home rule and adding the /home -> /var/home rule as done in this PR fixes things:

[root@localhost ~]# sed -i '/\/var\/home /d' /etc/selinux/targeted/contexts/files/file_contexts.subs_dist
[root@localhost ~]# echo '/home /var/home' >> /etc/selinux/targeted/contexts/files/file_contexts.subs_dist
[root@localhost ~]# useradd newuser2
[root@localhost ~]# ls -laZ /home/newuser2
drwx------. newuser2 newuser2 unconfined_u:object_r:user_home_dir_t:s0 .
drwxr-xr-x. root     root     system_u:object_r:default_t:s0   ..
-rw-r--r--. newuser2 newuser2 unconfined_u:object_r:user_home_t:s0 .bash_logout
-rw-r--r--. newuser2 newuser2 unconfined_u:object_r:user_home_t:s0 .bash_profile
-rw-r--r--. newuser2 newuser2 unconfined_u:object_r:user_home_t:s0 .bashrc

One thing I don't quite understand yet is that the /home symlink itself is labeled correctly as home_root_t, unlike in Fedora.

jlebon · 2019-02-14T16:38:25Z

https://src.fedoraproject.org/rpms/selinux-policy/pull-request/14 was merged! Let's get this one in and do a release?

cgwalters · 2019-02-14T17:24:01Z

@rh-atomic-bot r+ 13377fc

rh-atomic-bot · 2019-02-14T17:24:13Z

⚡ Test exempted: merge already tested.

Manually patch `file_contexts.subs_dist` so that `/home` is equivalent to `/var/home`. This is required now that the generated homedirs rules use `/var/home`. Otherwise, `matchpathcon` for example will return wrong results. This patch also includes the *removal* of `/var/home -> /home` so that we're not dependent on this selinux-policy patch making it at the same time as downstream: https://src.fedoraproject.org/rpms/selinux-policy/pull-request/14 (See the conversation there for more information.) Closes: #1754 Approved by: cgwalters

Let's get the SELinux fix out (coreos#1754).

Let's get the SELinux fix out (#1754). Closes: #1757 Approved by: cgwalters

jlebon added 2 commits February 6, 2019 12:13

fixup! libpriv: Rebuild policy during postprocessing

1bf5e04

rfairley approved these changes Feb 8, 2019

View reviewed changes

rust/src/composepost.rs Outdated Show resolved Hide resolved

jlebon force-pushed the pr/fix-subs-dist branch from ae048c4 to 3a06cdc Compare February 12, 2019 22:40

fixup! postprocess: Add /home -> /var/home SELinux substitution

13377fc

cgwalters added the reviewed/approved label Feb 14, 2019

rh-atomic-bot closed this in 677c083 Feb 14, 2019

jlebon added a commit to jlebon/rpm-ostree that referenced this pull request Feb 14, 2019

Release 2019.2

8bcbad4

Let's get the SELinux fix out (coreos#1754).

jlebon mentioned this pull request Feb 14, 2019

Release 2019.2 #1757

Closed

rh-atomic-bot pushed a commit that referenced this pull request Feb 14, 2019

Release 2019.2

97a60f9

Let's get the SELinux fix out (#1754). Closes: #1757 Approved by: cgwalters

jlebon mentioned this pull request Oct 25, 2023

treefile: Add option to label /usr/etc as /etc #4640

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

libpriv: Rebuild policy during postprocessing#1754

libpriv: Rebuild policy during postprocessing#1754
jlebon wants to merge 4 commits intocoreos:masterfrom
jlebon:pr/fix-subs-dist

jlebon commented Feb 6, 2019

Uh oh!

rfairley left a comment

Uh oh!

Uh oh!

rfairley commented Feb 8, 2019

Uh oh!

cgwalters commented Feb 12, 2019

Uh oh!

jlebon commented Feb 12, 2019

Uh oh!

jlebon commented Feb 12, 2019

Uh oh!

jlebon commented Feb 14, 2019

Uh oh!

cgwalters commented Feb 14, 2019

Uh oh!

rh-atomic-bot commented Feb 14, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

jlebon commented Feb 6, 2019

Uh oh!

rfairley left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rfairley commented Feb 8, 2019

Uh oh!

cgwalters commented Feb 12, 2019

Uh oh!

jlebon commented Feb 12, 2019

Uh oh!

jlebon commented Feb 12, 2019

Uh oh!

jlebon commented Feb 14, 2019

Uh oh!

cgwalters commented Feb 14, 2019

Uh oh!

rh-atomic-bot commented Feb 14, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants