Current situation

Given issues with having the whole system labeled in the past, not every file in the base distribution is labeled with the appropriate SELinux type. On the other hand, crucial boot-time tooling such as torcx has historically had issues with SELinux enforcing at boot time.

In order to provide a smoother experience in a SELinux enforcing deployment, it would be ideal to get these issues sorted out.

As of file system labeling, an example is the lack of labeling for sssd-related files. Another example is the lack of labeling of everything under /usr/bin. Labeling these would allow us to have more thorough policies and to start enforcing appropriate domain transitions from these binaries.

We can see that the default context is correct while the actual type is unlabeled.

$ ls -Z /usr/bin/cat
system_u:object_r:unlabeled_t:s0 /usr/bin/cat
$ selabel_lookup -v -k /usr/bin/cat
Default context: system_u:object_r:bin_t:s0
$  ls -Za /var/log/sssd/
system_u:object_r:unlabeled_t:s0 .    system_u:object_r:var_log_t:s0 ..

Goals

• Enable Flatcar to boot on a SELinux enforcing mode without hiccups
• Appropriately label files accordingly to allow enforcing policies more thoroughly

Non-Goals

• Set SELinux to enforcing by default: While this would be a better security default, this change would be too disruptive to bring in one go.

Impact

This would require us to revisit the SELinux packages that are provided and fix the necessary bits for the policy to work in Flatcar.

This might also require some updates to more recent versions of refpolicy for us to get the latest changes in policy and support containers better.

Ideal future situation

• One is able to turn SELinux to enforcing at boot time and be able to run relevant workloads with the required confinement.
• One is able to limit workloads to access parts of the system in a safe manner. This would require us to label the whole filesystem accordingly.

Implementation options

• add setfiles to the initramfs and enable the selinuxRelabel Ignition feature to relabel files created by Ignition (dracut/ignition: add setfiles to initramfs bootengine#42)

Additional information

Related issues:

• Kube Flannel (> 0.14.1) does not start in SELinux enforcing mode #635
• Can't install Kubernetes >=1.22 with RKE due to missing SELinux custom policies #598
• All Docker containers fail to start after update to 2983.2.0 #544
• SELinux prevents usage of execsnoop in enforcing mode #509
• [RFE] new package: sec-policy/selinux-container #479
• build_library: set correct SELinux contexts in final images scripts#368
• [RFE] rework SELinux patches #695
• Flannel >= 0.17.0 is crashing with enforced SELinux #779
• when selinux is enforcing unsigned kernel modules can't be loaded #783
• Improve SELinux docs #303
• [RFE] Enforce SELinux on all Mantle tests #1186