xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-11-12 11:06:17 +00:00
Code Issues Projects Releases Wiki Activity

Set full SELinux contexts on images built with --selinux

Browse Source 
setfiles without -F only corrects the type of a file and keeps its user,
role and range. Files of a new build tree get the SELinux user of the
process that created them, so about 1800 of them stayed unconfined_u
instead of system_u. Label the new tree with -F. Pack keeps relabeling
without it, so contexts set on purpose in a captured or edited tree stay.
This commit is contained in:
Markus Hilger
2026-11-01 22:41:06 +01:00
parent 89787671cf
commit cb09845fcd
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
imgutil/imgutil
+11 -6
View File
@@ -995,8 +995,9 @@ def get_selinux_policy(rootpath, enabledonly=True):
return policy
def selinux_relabel(rootpath, policy):
"""Label rootpath with its own policy, return False if it has none"""
def selinux_relabel(rootpath, policy, force=False):
"""Label rootpath with its own policy, return False if it has none.
force also resets user, role and range, not only the type"""
if not policy:
return False
fcontexts = os.path.join(
@@ -1004,6 +1005,8 @@ def selinux_relabel(rootpath, policy):
if not os.path.exists(fcontexts):
return False
cmd = ['setfiles', '-r', rootpath]
if force:
cmd.append('-F')
# Validate against the image policy rather than the one loaded on the
# build host, which may be older and reject contexts of newer modules
binpolicies = [x for x in glob.glob(os.path.join(
@@ -1015,14 +1018,14 @@ def selinux_relabel(rootpath, policy):
return True
def relabel_image(rootpath):
def relabel_image(rootpath, force=False):
"""Label rootpath with its own policy if its config enables SELinux,
return False if that was needed but could not be done"""
policy = get_selinux_policy(rootpath)
if not policy:
return True
try:
if not selinux_relabel(rootpath, policy):
if not selinux_relabel(rootpath, policy, force):
sys.stderr.write('SELinux is enabled in {0}, but its {1} policy is missing\n'.format(rootpath, policy))
return False
except OSError as e:
@@ -1643,8 +1646,10 @@ def build_root(args):
sys.stderr.write('Image build failed\n')
sys.exit(exitcode)
if args.selinux:
# label with the policy installed in the image
if not relabel_image(args.scratchdir):
# label with the policy installed in the image, a new tree gets full
# contexts: its files carry the SELinux user of whoever created
# them, unconfined_u rather than system_u
if not relabel_image(args.scratchdir, force=True):
sys.exit(1)
#if len(args) > 1:
# pack_image(opts, args)