Could you try on your fedora system? It should print 1

A

akdevOP•7/28/23, 3:21 PM

If this prints 0 the package will skip selinux labeling

S

Sofie•7/28/23, 3:21 PM

is this like official https://marketplace.visualstudio.com/items?itemName=skellock.just

just - Visual Studio Marketplace

Extension for Visual Studio Code - Provides syntax and recipe launcher for Just scripts.

S

Sofie•7/28/23, 3:21 PM

probably not

S

Sofie•7/28/23, 3:22 PM

just looking for extensions for just

Aakdev Could you try on your fedora system? It should print 1

A

akdevOP•7/28/23, 3:32 PM

Mm prints 0 on my fedora system (outside the container too)

J

jpeeler•7/28/23, 3:42 PM

sestatus reports disabled, though i'm not sure selinux has to be reported as enabled to have proper file labeling

A

akdevOP•7/28/23, 3:44 PM

It does, sort of - but the report can inaccurate from within a container

A

akdevOP•7/28/23, 3:44 PM

The kernel actually needs to have selinux enabled at least in permissive mode or it won’t do any file labeling

A

akdevOP•7/28/23, 3:45 PM

Within a container the report may be inaccurate due to lack of permissions, even if the underlying kernel has selinux enabled it can report disabled

Jj0rge <https://github.com/ublue-os/config/pull/86> can someone take a look? this seems...

B

bsherman•7/28/23, 3:45 PM

i replied... i do have mild concern... mostly that it's not adding clear value and could add confusion.

A

akdevOP•7/28/23, 4:19 PM

mm

getenforce

getenforce

getenforce

getenforce and

sestatus

sestatus

sestatus

sestatus just straight up lie in a container context

A

akdevOP•7/28/23, 4:21 PM

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

A

akdevOP•7/28/23, 4:31 PM

ah,

libselinux

libselinux

libselinux

libselinux is looking for two things:

/sys/fs/selinux

/sys/fs/selinux

/sys/fs/selinux

/sys/fs/selinux needs to be mounted and

/etc/selinux/config

/etc/selinux/config

/etc/selinux/config

/etc/selinux/config also needs to be mounted

A

akdevOP•7/28/23, 4:34 PM

but even after this:

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

A

akdevOP•7/28/23, 4:34 PM

the bug is actually reproducible on regular fedora container

A

akdevOP•7/28/23, 4:46 PM

and it is also reproducible by installing gdm

J

jpeeler•7/28/23, 4:48 PM

yeah i mean the fact that everything is getting labeled similarly is good since it's not a snowflake problem. but i have no idea how to fix this - assuming the container labeling is related to preventing breakouts

Aakdev but even after this: ``` [root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd -r...

G

Gerblesh•7/28/23, 6:20 PM

There was an issue for this

A

akdevOP•7/28/23, 6:21 PM

I’m not really sure what relabels the file

G

Gerblesh•7/28/23, 6:21 PM

In rpm-ostree

G

Gerblesh•7/28/23, 6:23 PM

https://github.com/coreos/rpm-ostree/issues/4516

GitHub

restorecon doesn't work in ostree native container builds · Issue #...

Host system details State: idle Deployments: ● ostree-unverified-image:containers-storage:localhost/swtpm-test Digest: sha256:142d1951e54e6cdb10cfe7f385d1be569772f8928b73ac5708625ed87e37d553 Versio...

A

akdevOP•7/28/23, 6:26 PM

No, this is reproducible in a regular fedora container

A

akdevOP•7/28/23, 6:26 PM

Ah I remember this swtpm issue

A

akdevOP•7/28/23, 6:26 PM

I can use that to verify too

A

akdevOP•7/28/23, 6:27 PM

In a regular fedora container that is running as unconfined_u the resulting files should have unlabeled_t as part of their context

A

akdevOP•7/28/23, 6:28 PM

But instead it gives me container_file_t

G

Gerblesh•7/28/23, 6:28 PM

So it's a podman issue?

A

akdevOP•7/28/23, 6:28 PM

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

restorecon fails due to

lsetxattr()

lsetxattr()

lsetxattr()

lsetxattr() call failing

GGerblesh So it's a podman issue?

A

akdevOP•7/28/23, 6:28 PM

I do think so

A

akdevOP•7/28/23, 6:29 PM

I’m not sure why lsetxattr is failing when my container is running as rootful and —privileged

G

Gerblesh•7/28/23, 6:30 PM

https://github.com/containers/podman/issues/19376

GitHub

CI SystemTests: FAIL: SELinux role should always be system_r · Iss...

Issue Description In CI, with updated Rawhide, and Fedora images (c20230706t200047z-f38f37d13 at time of opening issue), the entire matrix fails on three tests with the same/similar error: Failed t...

G

Gerblesh•7/28/23, 6:32 PM

Nvm

G

Gerblesh•7/28/23, 6:32 PM

Doesn't seem to be the right issue

A

akdevOP•7/28/23, 6:33 PM

Yeah looks like they actually get unlabeled_t there when they shouldn’t

A

akdevOP•7/28/23, 6:33 PM

the weird thing is that if I do like

touch test

touch test

touch test

touch test then that file is unlabeled_t

A

akdevOP•7/28/23, 6:34 PM

But the files installed via rpm get container_file_t

G

Gerblesh•7/28/23, 6:34 PM

Whar

S

Sofie•7/28/23, 6:37 PM

how initate a release-please action manually?

S

Sofie•7/28/23, 6:37 PM

like for testing purposes?

GGerblesh Whar

A

akdevOP•7/28/23, 6:38 PM

If you run a container with

—security-opt label=disable

—security-opt label=disable

—security-opt label=disable

—security-opt label=disable then the files you create there should be unlabeled by default

A

akdevOP•7/28/23, 6:38 PM

I confirm that by creating a new file with

touch

touch

touch

touch

A

akdevOP•7/28/23, 6:38 PM

But then doing dnf install -y greetd still gives me files with

container_file_t

container_file_t

container_file_t

container_file_t

G

Gerblesh•7/28/23, 6:40 PM

Huh

G

Gerblesh•7/28/23, 6:40 PM

Is there already an issue reported in this?

A

akdevOP•7/28/23, 6:40 PM

I don’t think so

G

Gerblesh•7/28/23, 6:41 PM

Probably should make one then

G

Gerblesh•7/28/23, 6:42 PM

As a side note: when installing sddm, it doesn't add the user

G

Gerblesh•7/28/23, 6:42 PM

So post install you need to manually add the sddm user

A

akdevOP•7/28/23, 6:42 PM

Yeah I see that with some packages

A

akdevOP•7/28/23, 6:43 PM

I also stared to think about how selinux interacts with containers

Could you try on your fedora system? It should print 1

Similar Threads

Similar Threads

Similar Threads