Universal Blue•3y ago

Yeah I see that with some packages

akdevOP•7/28/23, 6:43 PM

I also stared to think about how selinux interacts with containers

Aakdev Yeah I see that with some packages

Gerblesh•7/28/23, 6:43 PM

rpm-ostree or podman? I'm thinking rpm-ostree but idk

akdevOP•7/28/23, 6:44 PM

Just plain dnf install on a fedora container shows the errors

akdevOP•7/28/23, 6:44 PM

The bugs are probably in the packaging

Gerblesh•7/28/23, 6:44 PM

Bigpod•7/28/23, 6:48 PM

rpm-ostree is essentially just downloading packages then using rpm to install them on a seperate root filesystem (with help of --root argument)(its a bit more complex but thats the gist of it)

Bigpod•7/28/23, 6:49 PM

ok then it creates a ostree thing from it and sets it as a what to be booted to on next boot

akdevOP•7/28/23, 6:49 PM

I guess the first thing to fix is to get

lsetxattr()

lsetxattr()

working inside a rootful container

akdevOP•7/28/23, 6:49 PM

I don’t see any reasons why it doesn’t work

akdevOP•7/28/23, 6:51 PM

https://github.com/containers/common/blob/main/pkg/seccomp/seccomp.json#L244C6-L244C6

afaict it should be allowed

Bigpod•7/28/23, 6:51 PM

is that in any way connected to selinux cause selinux is one of rare mysteries to me in linux

akdevOP•7/28/23, 6:52 PM

selinux file labels are just extended filesystem attributes

Aakdev ``` setfattr --name security.selinux -v system_u:object_r:xdm_exec_t:s0:c1022,c1...

akdevOP•7/28/23, 6:53 PM

This setfattr command is equivalent to

chcon

chcon

akdevOP•7/28/23, 6:54 PM

in theory we should able to relabel a file manually by calling setfattr

akdevOP•7/28/23, 6:54 PM

This is failing inside a container

Bigpod•7/28/23, 7:01 PM

possibly a limitation of overlayFS

Aakdev This is failing inside a container

Bigpod•7/28/23, 7:01 PM

could that be it

Kyle Gospo•7/28/23, 7:01 PM

Noticed this recently, can't setcap either

Gerblesh•7/28/23, 7:01 PM

It fails in a normal container too

Gerblesh•7/28/23, 7:02 PM

In a fedora container I mean

BBigpod possibly a limitation of overlayFS

akdevOP•7/28/23, 7:23 PM

Mm maybe but then it should work on bind mounts no?

akdevOP•7/28/23, 7:24 PM

Some research suggest overlayfs supports selinux

akdevOP•7/28/23, 7:26 PM

https://bugzilla.redhat.com/show_bug.cgi?id=1765243

Gerblesh•7/30/23, 3:00 AM

@akdev did you report the podman restorecon issue?

akdevOP•7/30/23, 3:01 AM

No, but I did identify why I was getting container_t - turns out that rootful podman sets the filesystem label for the underlying overlayfs

akdevOP•7/30/23, 3:03 AM

I’m not really sure what issue to file tbh, restorecon works on bind mounts

akdevOP•7/30/23, 3:03 AM

So it is related to overlayfs somehow

akdevOP•7/30/23, 3:10 AM

Mm I found:

label=nested: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without nested, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels.

akdevOP•7/30/23, 3:10 AM

This could be the solution

Aakdev Mm I found: > label=nested: Allows SELinux modifications within the container. ...

Gerblesh•7/30/23, 3:15 AM

Do we want to try to fix the podman build action then?

akdevOP•7/30/23, 3:20 AM

I tried locally and it looks like it doesn't fix this

akdevOP•7/30/23, 3:43 AM

it's more complex than I thought:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-working_with_selinux-mounting_file_systems

To mount a file system with the specified context, overriding existing contexts if they exist, or to specify a different, default context for a file system that does not support extended attributes, as the root user, use the mount -o context=SELinux_user:role:type:level command when mounting the required file system.

Newly-created files and directories on this file system appear to have the SELinux context specified with -o context. However, since these changes are not written to disk, the context specified with this option does not persist between mounts.

so:

podman sets context=container_t
this stops restorecon from working
no clue what that means for ostree

akdevOP•7/30/23, 3:45 AM

on another note I found out this super cool podman usage:

sudo podman run \
  --privileged \
  --rm -it \
  --security-opt label=disable \
  -v /sys/fs/selinux:/sys/fs/selinux \
  -v /etc/selinux/config:/etc/selinux/config:ro \
  --userns=host \
  -v "$HOME:$HOME" \
  --rootfs /:O \
  /bin/bash

sudo podman run \
  --privileged \
  --rm -it \
  --security-opt label=disable \
  -v /sys/fs/selinux:/sys/fs/selinux \
  -v /etc/selinux/config:/etc/selinux/config:ro \
  --userns=host \
  -v "$HOME:$HOME" \
  --rootfs /:O \
  /bin/bash

the

--rootfs /:O

--rootfs /:O

mounts the rootfs from your current system into a temporary overlay(rw) then puts you inside that

Aakdev on another note I found out this super cool podman usage: ```bash sudo podman r...

Gerblesh•7/30/23, 4:06 AM

Is there any way to get around this or is it just an inherent limitation then?

Gerblesh•7/30/23, 4:07 AM

How does ostree/rpm-ostree handle it?

Gerblesh•7/30/23, 4:07 AM

Because they do have SELinux policies loaded by default

Gerblesh•7/30/23, 4:08 AM

Idk of those are from the OCI

Gerblesh•7/30/23, 4:09 AM

Might want to see if there's a way to define it in ostree?

akdevOP•7/30/23, 4:10 AM

what I am thinking that happens is that ostree is running restorecon on the deployment

Gerblesh•7/30/23, 4:12 AM

Hmmmm

Gerblesh•7/30/23, 4:12 AM

How do we define it in ostree?

Gerblesh•7/30/23, 4:13 AM

That's the question

akdevOP•7/30/23, 4:17 AM

looks like I was right about that, they relabel on deployment:

https://github.com/ostreedev/ostree/blob/a2663e8041ffadb764c71a055dd63dba4e7ff378/src/libostree/ostree-sysroot-deploy.c#L799

https://github.com/ostreedev/ostree/blob/a2663e8041ffadb764c71a055dd63dba4e7ff378/src/libostree/ostree-sysroot-deploy.c#L737C8-L737C34

https://github.com/ostreedev/ostree/blob/main/src/libostree/ostree-sepolicy.c#L593

akdevOP•7/30/23, 4:17 AM

mm I think

ostree_sepolicy_restorecon()

ostree_sepolicy_restorecon()

might be buggy from ostree

akdevOP•7/30/23, 4:19 AM

according to this ostree is trying to follow the selinux policy

akdevOP•7/30/23, 4:20 AM

this is reimplementing

restorecon

restorecon

Gerblesh•7/30/23, 4:26 AM

So the issue was in the right place?

Gerblesh•7/30/23, 4:27 AM

rpm-ostree?

akdevOP•7/30/23, 4:28 AM

no, just plain ostree

sudo podman run \ --privileged \ --rm -it \ --security-opt label=disable \ -v /sys/fs/selinux:/sys/fs/selinux \ -v /etc/selinux/config:/etc/selinux/config:ro \ --userns=host \ -v "$HOME:$HOME" \ --rootfs /:O \ /bin/bash

Yeah I see that with some packages

Similar Threads

Similar Threads

Similar Threads