Skip to content
This repository was archived by the owner on May 30, 2023. It is now read-only.

profiles: Enable selinux for all targets#1245

Merged
pothos merged 1 commit intomainfrom
kai/enable-selinux-on-all-targets-v2
Sep 2, 2021
Merged

profiles: Enable selinux for all targets#1245
pothos merged 1 commit intomainfrom
kai/enable-selinux-on-all-targets-v2

Conversation

@pothos
Copy link
Copy Markdown
Contributor

@pothos pothos commented Sep 1, 2021 •
edited
Loading

Move the USE options out of the amd64 path, specify selinux
packages as explicit dependency, and add accept keywords.

Replaces #135

How to use

The goal is to enable the selinux tests again in kola.

Testing done

Ongoing, have to check if selinux use flags get enabled and whether removing the kola exemption for selinux on arm64 works
http://jenkins.infra.kinvolk.io:8080/job/os/job/manifest/3470/cldsv/

@pothos pothos force-pushed the kai/enable-selinux-on-all-targets-v2 branch from 6032e18 to c0de751 Compare September 1, 2021 14:23
This was referenced Sep 1, 2021
Closed
Closed
@pothos
Copy link
Copy Markdown
Contributor Author

pothos commented Sep 1, 2021

The selinux use flags are still not enabled dbus and systemd on arm64, need to find out why

@tormath1 tormath1 mentioned this pull request Sep 1, 2021
Merged
@tormath1
Copy link
Copy Markdown
Contributor

tormath1 commented Sep 1, 2021

a PR has been created for mantle: flatcar/mantle#222

@pothos
Copy link
Copy Markdown
Contributor Author

pothos commented Sep 2, 2021

The use flags don't get picked up which causes this failure as SELinux is always disabled and not in permissive mode:

2021-09-02T09:18:29Z kola: creating new machine for semver check: machine "12fe8823-4ca4-42b9-9aa9-6605b0c8aebb" failed to enable selinux: Unable to enable SELinux: Process exited with status 1: setenforce: SELinux is disabled

tormath1
tormath1 reviewed Sep 2, 2021
View reviewed changes
@pothos pothos force-pushed the kai/enable-selinux-on-all-targets-v2 branch from c0de751 to 69a64a5 Compare September 2, 2021 11:38
@pothos
profiles: Enable selinux for all targets
f60ad69 
Move the USE options out of the amd64 path, specify selinux
packages as explicit dependency, and add accept keywords.
@pothos pothos force-pushed the kai/enable-selinux-on-all-targets-v2 branch from 69a64a5 to f60ad69 Compare September 2, 2021 13:13
@pothos
Copy link
Copy Markdown
Contributor Author

pothos commented Sep 2, 2021

I am a bit confused by the solution but unmasking for all boards in the same way helped:

Calculating dependencies... done!
[ebuild   R    ] sys-apps/coreutils-8.32-r1::coreos to /build/arm64-usr/ USE="selinux* xattr -acl -caps -gmp -hostname -kill -multicall -nls -split-usr -static -test -vanilla" 5424 KiB
[ebuild   R    ] app-arch/tar-1.34::portage-stable to /build/arm64-usr/ USE="minimal selinux* xattr -acl -nls" 0 KiB
[ebuild   R    ] sys-process/lsof-4.89::portage-stable to /build/arm64-usr/ USE="ipv6 rpc selinux* -examples -static" 767 KiB
[ebuild   R    ] sys-apps/systemd-247.9:0/2::coreos to /build/arm64-usr/ USE="build cryptsetup curl gcrypt http hwdb idn importd kmod lz4 lzma nat pam pcre policykit resolvconf seccomp selinux* (sysv-utils) (vanilla) zstd -acl (-apparmor) (-audit) -dns-over-tls -elfutils -gnuefi -homed -pkcs11 -pwquality -qrcode -repart -split-usr -ssl -test -xkb" 0 KiB
[ebuild   R    ] sys-apps/dbus-1.12.20-r1::coreos to /build/arm64-usr/ USE="selinux* (systemd) -X -debug -doc (-elogind) -static-libs -test -user-session" 0 KiB
[ebuild   R    ] coreos-base/coreos-0.0.1-r300::coreos to /build/arm64-usr/ USE="selinux*" 0 KiB

@pothos pothos marked this pull request as ready for review September 2, 2021 18:42
@pothos
Copy link
Copy Markdown
Contributor Author

pothos commented Sep 2, 2021

Now the new failure is this here when running kola tests after kola turns SELinux to enforcing mode:

semver check: machine "de5db1e9-6dfa-4a65-bf1e-46436371bde4" failed basic checks: some systemd units failed:
��� sys-kernel-tracing.mount loaded failed failed Kernel Trace File System

But in general we have SELinux installed and somehow present, finally after this started in Dec. 2019.

@pothos pothos requested a review from a team September 2, 2021 18:43
@pothos
Copy link
Copy Markdown
Contributor Author

pothos commented Sep 2, 2021

Actually it was a temporary unit failure due to qemu being a bit slow on the test machine

@pothos pothos merged commit f091976 into main Sep 2, 2021
@pothos pothos deleted the kai/enable-selinux-on-all-targets-v2 branch September 2, 2021 19:14
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

2 more reviewers

@tormath1 tormath1 tormath1 left review comments

@krnowak krnowak krnowak approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@pothos @tormath1 @krnowak @vbatts @sayanchowdhury @dongsupark