but even after this: ``` [root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd -rwxr-xr-x. 1 root roo

but even after this:

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

akdevOP•7/28/23, 4:34 PM

the bug is actually reproducible on regular fedora container

akdevOP•7/28/23, 4:46 PM

and it is also reproducible by installing gdm

jpeeler•7/28/23, 4:48 PM

yeah i mean the fact that everything is getting labeled similarly is good since it's not a snowflake problem. but i have no idea how to fix this - assuming the container labeling is related to preventing breakouts

Aakdev but even after this: ``` [root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd -r...

Gerblesh•7/28/23, 6:20 PM

There was an issue for this

akdevOP•7/28/23, 6:21 PM

I’m not really sure what relabels the file

Gerblesh•7/28/23, 6:21 PM

In rpm-ostree

Gerblesh•7/28/23, 6:23 PM

https://github.com/coreos/rpm-ostree/issues/4516

GitHub

restorecon doesn't work in ostree native container builds · Issue #...

Host system details State: idle Deployments: ● ostree-unverified-image:containers-storage:localhost/swtpm-test Digest: sha256:142d1951e54e6cdb10cfe7f385d1be569772f8928b73ac5708625ed87e37d553 Versio...

akdevOP•7/28/23, 6:26 PM

No, this is reproducible in a regular fedora container

akdevOP•7/28/23, 6:26 PM

Ah I remember this swtpm issue

akdevOP•7/28/23, 6:26 PM

I can use that to verify too

akdevOP•7/28/23, 6:27 PM

In a regular fedora container that is running as unconfined_u the resulting files should have unlabeled_t as part of their context

akdevOP•7/28/23, 6:28 PM

But instead it gives me container_file_t

Gerblesh•7/28/23, 6:28 PM

So it's a podman issue?

akdevOP•7/28/23, 6:28 PM

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c102 /usr/sbin/gdm
setfattr: /usr/sbin/gdm: Operation not supported

restorecon fails due to lsetxattr()lsetxattr() call failing

GGerblesh So it's a podman issue?

akdevOP•7/28/23, 6:28 PM

I do think so

akdevOP•7/28/23, 6:29 PM

I’m not sure why lsetxattr is failing when my container is running as rootful and —privileged

Gerblesh•7/28/23, 6:30 PM

https://github.com/containers/podman/issues/19376

GitHub

CI SystemTests: FAIL: SELinux role should always be system_r · Iss...

Issue Description In CI, with updated Rawhide, and Fedora images (c20230706t200047z-f38f37d13 at time of opening issue), the entire matrix fails on three tests with the same/similar error: Failed t...

Gerblesh•7/28/23, 6:32 PM

Nvm

Gerblesh•7/28/23, 6:32 PM

Doesn't seem to be the right issue

akdevOP•7/28/23, 6:33 PM

Yeah looks like they actually get unlabeled_t there when they shouldn’t

akdevOP•7/28/23, 6:33 PM

the weird thing is that if I do like touch testtouch test then that file is unlabeled_t

akdevOP•7/28/23, 6:34 PM

But the files installed via rpm get container_file_t

Gerblesh•7/28/23, 6:34 PM

Whar

Sofie•7/28/23, 6:37 PM

how initate a release-please action manually?

Sofie•7/28/23, 6:37 PM

like for testing purposes?

GGerblesh Whar

akdevOP•7/28/23, 6:38 PM

If you run a container with —security-opt label=disable—security-opt label=disable then the files you create there should be unlabeled by default

akdevOP•7/28/23, 6:38 PM

I confirm that by creating a new file with touchtouch

akdevOP•7/28/23, 6:38 PM

But then doing dnf install -y greetd still gives me files with container_file_tcontainer_file_t

Gerblesh•7/28/23, 6:40 PM

Huh

Gerblesh•7/28/23, 6:40 PM

Is there already an issue reported in this?

akdevOP•7/28/23, 6:40 PM

I don’t think so

Gerblesh•7/28/23, 6:41 PM

Probably should make one then

Gerblesh•7/28/23, 6:42 PM

As a side note: when installing sddm, it doesn't add the user

Gerblesh•7/28/23, 6:42 PM

So post install you need to manually add the sddm user

akdevOP•7/28/23, 6:42 PM

Yeah I see that with some packages

akdevOP•7/28/23, 6:43 PM

I also stared to think about how selinux interacts with containers

Aakdev Yeah I see that with some packages

Gerblesh•7/28/23, 6:43 PM

rpm-ostree or podman? I'm thinking rpm-ostree but idk

akdevOP•7/28/23, 6:44 PM

Just plain dnf install on a fedora container shows the errors

akdevOP•7/28/23, 6:44 PM

The bugs are probably in the packaging

Gerblesh•7/28/23, 6:44 PM

Bigpod•7/28/23, 6:48 PM

rpm-ostree is essentially just downloading packages then using rpm to install them on a seperate root filesystem (with help of --root argument)(its a bit more complex but thats the gist of it)

Bigpod•7/28/23, 6:49 PM

ok then it creates a ostree thing from it and sets it as a what to be booted to on next boot

akdevOP•7/28/23, 6:49 PM

I guess the first thing to fix is to get lsetxattr()lsetxattr() working inside a rootful container

akdevOP•7/28/23, 6:49 PM

I don’t see any reasons why it doesn’t work

akdevOP•7/28/23, 6:51 PM

https://github.com/containers/common/blob/main/pkg/seccomp/seccomp.json#L244C6-L244C6

afaict it should be allowed

Bigpod•7/28/23, 6:51 PM

is that in any way connected to selinux cause selinux is one of rare mysteries to me in linux

akdevOP•7/28/23, 6:52 PM

selinux file labels are just extended filesystem attributes

Aakdev ``` setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c1...

akdevOP•7/28/23, 6:53 PM

This setfattr command is equivalent to chconchcon

akdevOP•7/28/23, 6:54 PM

in theory we should able to relabel a file manually by calling setfattr

akdevOP•7/28/23, 6:54 PM

This is failing inside a container

but even after this: ``` [root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd -rwxr-xr-x. 1 root roo

Similar Threads

Similar Threads

Similar Threads