<https://github.com/ublue-os/config/pull/86> can someone take a look? this seems fine to me

Aakdev if we do like: ``` FROM fedora-ostree-upstream:latest RUN rpm-ostree install -...

J

jpeeler•7/28/23, 3:07 PM

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

yields system_u:object_r:container_file_t:s0:c119,c174. seems wrong, but i don't know what i'm talking about on this.

A

akdev•7/28/23, 3:08 PM

It is wrong indeed

A

akdev•7/28/23, 3:08 PM

container_file_t is the default label for files created by a container

A

akdev•7/28/23, 3:09 PM

If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#_4

A

akdev•7/28/23, 3:09 PM

system_u:object_r:xdm_exec_t,s0

S

Sofie•7/28/23, 3:10 PM

hey? when updating my distrobox fedora 39 container it says: Unpack error: shadow-utils-2:4.13-8.fc39.x86_64 and in the logs its cpio: cap_set_file failed - No data available

Aakdev If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#...

J

jpeeler•7/28/23, 3:13 PM

right, well i suppose we have our reproducer then

A

akdev•7/28/23, 3:14 PM

Could you try

rpm -E '%{with selinux}'

rpm -E '%{with selinux}'

rpm -E '%{with selinux}'

rpm -E '%{with selinux}' inside the container?

A

akdev•7/28/23, 3:14 PM

I’m looking at different ways that this could be skipped

A

akdev•7/28/23, 3:15 PM

If that commands prints 0 then that could be the reason

J

jpeeler•7/28/23, 3:19 PM

it does print 0

A

akdev•7/28/23, 3:20 PM

Could you try on your fedora system? It should print 1

A

akdev•7/28/23, 3:21 PM

If this prints 0 the package will skip selinux labeling

S

Sofie•7/28/23, 3:21 PM

is this like official https://marketplace.visualstudio.com/items?itemName=skellock.just

just - Visual Studio Marketplace

Extension for Visual Studio Code - Provides syntax and recipe launcher for Just scripts.

S

Sofie•7/28/23, 3:21 PM

probably not

S

Sofie•7/28/23, 3:22 PM

just looking for extensions for just

Aakdev Could you try on your fedora system? It should print 1

A

akdev•7/28/23, 3:32 PM

Mm prints 0 on my fedora system (outside the container too)

J

jpeeler•7/28/23, 3:42 PM

sestatus reports disabled, though i'm not sure selinux has to be reported as enabled to have proper file labeling

A

akdev•7/28/23, 3:44 PM

It does, sort of - but the report can inaccurate from within a container

A

akdev•7/28/23, 3:44 PM

The kernel actually needs to have selinux enabled at least in permissive mode or it won’t do any file labeling

A

akdev•7/28/23, 3:45 PM

Within a container the report may be inaccurate due to lack of permissions, even if the underlying kernel has selinux enabled it can report disabled

Jj0rge <https://github.com/ublue-os/config/pull/86> can someone take a look? this seems...

B

bsherman•7/28/23, 3:45 PM

i replied... i do have mild concern... mostly that it's not adding clear value and could add confusion.

A

akdev•7/28/23, 4:19 PM

mm

getenforce

getenforce

getenforce

getenforce and

sestatus

sestatus

sestatus

sestatus just straight up lie in a container context

A

akdev•7/28/23, 4:21 PM

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

A

akdev•7/28/23, 4:31 PM

ah,

libselinux

libselinux

libselinux

libselinux is looking for two things:

/sys/fs/selinux

/sys/fs/selinux

/sys/fs/selinux

/sys/fs/selinux needs to be mounted and

/etc/selinux/config

/etc/selinux/config

/etc/selinux/config

/etc/selinux/config also needs to be mounted

A

akdev•7/28/23, 4:34 PM

but even after this:

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

A

akdev•7/28/23, 4:34 PM

the bug is actually reproducible on regular fedora container

A

akdev•7/28/23, 4:46 PM

and it is also reproducible by installing gdm

J

jpeeler•7/28/23, 4:48 PM

yeah i mean the fact that everything is getting labeled similarly is good since it's not a snowflake problem. but i have no idea how to fix this - assuming the container labeling is related to preventing breakouts

Aakdev but even after this: ``` [root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd -r...

G

Gerblesh•7/28/23, 6:20 PM

There was an issue for this

A

akdev•7/28/23, 6:21 PM

I’m not really sure what relabels the file

G

Gerblesh•7/28/23, 6:21 PM

In rpm-ostree

G

Gerblesh•7/28/23, 6:23 PM

https://github.com/coreos/rpm-ostree/issues/4516

GitHub

restorecon doesn't work in ostree native container builds · Issue #...

Host system details State: idle Deployments: ● ostree-unverified-image:containers-storage:localhost/swtpm-test Digest: sha256:142d1951e54e6cdb10cfe7f385d1be569772f8928b73ac5708625ed87e37d553 Versio...

A

akdev•7/28/23, 6:26 PM

No, this is reproducible in a regular fedora container

A

akdev•7/28/23, 6:26 PM

Ah I remember this swtpm issue

A

akdev•7/28/23, 6:26 PM

I can use that to verify too

A

akdev•7/28/23, 6:27 PM

In a regular fedora container that is running as unconfined_u the resulting files should have unlabeled_t as part of their context

A

akdev•7/28/23, 6:28 PM

But instead it gives me container_file_t

G

Gerblesh•7/28/23, 6:28 PM

So it's a podman issue?

A

akdev•7/28/23, 6:28 PM

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

restorecon fails due to

lsetxattr()

lsetxattr()

lsetxattr()

lsetxattr() call failing

GGerblesh So it's a podman issue?

A

akdev•7/28/23, 6:28 PM

I do think so

A

akdev•7/28/23, 6:29 PM

I’m not sure why lsetxattr is failing when my container is running as rootful and —privileged

G

Gerblesh•7/28/23, 6:30 PM

https://github.com/containers/podman/issues/19376

GitHub

CI SystemTests: FAIL: SELinux role should always be system_r · Iss...

Issue Description In CI, with updated Rawhide, and Fedora images (c20230706t200047z-f38f37d13 at time of opening issue), the entire matrix fails on three tests with the same/similar error: Failed t...

G

Gerblesh•7/28/23, 6:32 PM

Nvm

G

Gerblesh•7/28/23, 6:32 PM

Doesn't seem to be the right issue

A

akdev•7/28/23, 6:33 PM

Yeah looks like they actually get unlabeled_t there when they shouldn’t

A

akdev•7/28/23, 6:33 PM

the weird thing is that if I do like

touch test

touch test

touch test

touch test then that file is unlabeled_t

A

akdev•7/28/23, 6:34 PM

But the files installed via rpm get container_file_t

G

Gerblesh•7/28/23, 6:34 PM

Whar

S

Sofie•7/28/23, 6:37 PM

how initate a release-please action manually?

<https://github.com/ublue-os/config/pull/86> can someone take a look? this seems fine to me

Similar Threads

Similar Threads

Similar Threads