@Gerblesh did you ever figure anything else more about this selinux issue? https://github.com/ublue-

@Gerblesh did you ever figure anything else more about this selinux issue? https://github.com/ublue-os/main/issues/223 i bothered two incorrect upstreams, so i appreciate you filing the issue

GitHub

greetd + SELinux issues · Issue #223 · ublue-os/main

this issue is detailing the repeated problems we had with greetd and SELinux in the discord, don't know if this will ever be solved or if it can be solved but it's good to have it as an iss...

Jjpeeler @Gerblesh did you ever figure anything else more about this selinux issue? https...

Gerblesh•7/28/23, 2:34 PM

Not really

akdev•7/28/23, 2:35 PM

The last error message in that issue can probably be worked around by specifiying the full selinux label the file should have

akdev•7/28/23, 2:35 PM

This is probably a bug in rpm-ostree ultimately because the rpm package has the correct things set

Gerblesh•7/28/23, 2:36 PM

It works when layering in a booted image

Gerblesh•7/28/23, 2:36 PM

But not when layering in the image

jpeelerOP•7/28/23, 2:36 PM

i feel like i layered it initially and still had a problem, perhaps i'm misremembering

jpeelerOP•7/28/23, 2:40 PM

also tuigreet package maintainer said it wasn't a problem on his Sericea system, so that makes me think it's not an rpm-ostree issue

akdev•7/28/23, 2:42 PM

We should try having a minimum verified compilable/runnable example

akdev•7/28/23, 2:42 PM

if we do like:

FROM fedora-ostree-upstream:latest

RUN rpm-ostree install -y greeted

FROM fedora-ostree-upstream:latest

RUN rpm-ostree install -y greeted

akdev•7/28/23, 2:43 PM

Does it have the right label or not?

akdev•7/28/23, 2:43 PM

If we do

rpm-ostree install -y greetd

rpm-ostree install -y greetd

does it work ok or not?

j0rge•7/28/23, 3:01 PM

https://github.com/ublue-os/config/pull/86 can someone take a look? this seems fine to me

Aakdev if we do like: ``` FROM fedora-ostree-upstream:latest RUN rpm-ostree install -...

jpeelerOP•7/28/23, 3:07 PM

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

yields system_u:object_r:container_file_t:s0:c119,c174. seems wrong, but i don't know what i'm talking about on this.

akdev•7/28/23, 3:08 PM

It is wrong indeed

akdev•7/28/23, 3:08 PM

container_file_t is the default label for files created by a container

akdev•7/28/23, 3:09 PM

If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#_4

akdev•7/28/23, 3:09 PM

system_u:object_r:xdm_exec_t,s0

Sofie•7/28/23, 3:10 PM

hey? when updating my distrobox fedora 39 container it says: Unpack error: shadow-utils-2:4.13-8.fc39.x86_64 and in the logs its cpio: cap_set_file failed - No data available

Aakdev If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#...

jpeelerOP•7/28/23, 3:13 PM

right, well i suppose we have our reproducer then

akdev•7/28/23, 3:14 PM

Could you try

rpm -E '%{with selinux}'

rpm -E '%{with selinux}'

inside the container?

akdev•7/28/23, 3:14 PM

I’m looking at different ways that this could be skipped

akdev•7/28/23, 3:15 PM

If that commands prints 0 then that could be the reason

jpeelerOP•7/28/23, 3:19 PM

it does print 0

akdev•7/28/23, 3:20 PM

Could you try on your fedora system? It should print 1

akdev•7/28/23, 3:21 PM

If this prints 0 the package will skip selinux labeling

Sofie•7/28/23, 3:21 PM

is this like official https://marketplace.visualstudio.com/items?itemName=skellock.just

just - Visual Studio Marketplace

Extension for Visual Studio Code - Provides syntax and recipe launcher for Just scripts.

Sofie•7/28/23, 3:21 PM

probably not

Sofie•7/28/23, 3:22 PM

just looking for extensions for just

Aakdev Could you try on your fedora system? It should print 1

akdev•7/28/23, 3:32 PM

Mm prints 0 on my fedora system (outside the container too)

jpeelerOP•7/28/23, 3:42 PM

sestatus reports disabled, though i'm not sure selinux has to be reported as enabled to have proper file labeling

akdev•7/28/23, 3:44 PM

It does, sort of - but the report can inaccurate from within a container

akdev•7/28/23, 3:44 PM

The kernel actually needs to have selinux enabled at least in permissive mode or it won’t do any file labeling

akdev•7/28/23, 3:45 PM

Within a container the report may be inaccurate due to lack of permissions, even if the underlying kernel has selinux enabled it can report disabled

Jj0rge <https://github.com/ublue-os/config/pull/86> can someone take a look? this seems...

bsherman•7/28/23, 3:45 PM

i replied... i do have mild concern... mostly that it's not adding clear value and could add confusion.

akdev•7/28/23, 4:19 PM

mm getenforcegetenforce and sestatussestatus just straight up lie in a container context

akdev•7/28/23, 4:21 PM

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

akdev•7/28/23, 4:31 PM

ah, libselinuxlibselinux is looking for two things:

/sys/fs/selinux/sys/fs/selinux needs to be mounted and /etc/selinux/config/etc/selinux/config also needs to be mounted

akdev•7/28/23, 4:34 PM

but even after this:

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

akdev•7/28/23, 4:34 PM

the bug is actually reproducible on regular fedora container

akdev•7/28/23, 4:46 PM

and it is also reproducible by installing gdm

jpeelerOP•7/28/23, 4:48 PM

yeah i mean the fact that everything is getting labeled similarly is good since it's not a snowflake problem. but i have no idea how to fix this - assuming the container labeling is related to preventing breakouts

Aakdev but even after this: ``` [root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd -r...

Gerblesh•7/28/23, 6:20 PM

There was an issue for this

akdev•7/28/23, 6:21 PM

I’m not really sure what relabels the file

Gerblesh•7/28/23, 6:21 PM

In rpm-ostree

Gerblesh•7/28/23, 6:23 PM

https://github.com/coreos/rpm-ostree/issues/4516

GitHub

restorecon doesn't work in ostree native container builds · Issue #...

Host system details State: idle Deployments: ● ostree-unverified-image:containers-storage:localhost/swtpm-test Digest: sha256:142d1951e54e6cdb10cfe7f385d1be569772f8928b73ac5708625ed87e37d553 Versio...

akdev•7/28/23, 6:26 PM

No, this is reproducible in a regular fedora container

akdev•7/28/23, 6:26 PM

Ah I remember this swtpm issue

akdev•7/28/23, 6:26 PM

I can use that to verify too

akdev•7/28/23, 6:27 PM

In a regular fedora container that is running as unconfined_u the resulting files should have unlabeled_t as part of their context

akdev•7/28/23, 6:28 PM

But instead it gives me container_file_t

@Gerblesh did you ever figure anything else more about this selinux issue? https://github.com/ublue-

Similar Threads

Similar Threads

Similar Threads