From ebdb71f321c1f13a359d755f72645fd2efd76025 Mon Sep 17 00:00:00 2001 From: Markus Hilger Date: Sun, 1 Nov 2026 22:16:57 +0100 Subject: [PATCH] Let tethered SELinux images reach the image server urlmount is started by the initramfs before the policy is loaded, so it keeps running as kernel_t. The EL10 targeted policy denies kernel_t connecting to http_port_t, so after systemd loads the policy every read of a tethered root image that needs a new connection fails and the node freezes. imageboot.sh also runs dd from the initramfs later, which is denied entrypoint. Install a small module with exactly these two rules in images built with --selinux. --- imgutil/imgutil | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/imgutil/imgutil b/imgutil/imgutil index 0bf73230..b9edea23 100644 --- a/imgutil/imgutil +++ b/imgutil/imgutil @@ -940,6 +940,18 @@ class ElHandler(OsHandler): # not sys.exit, run_constrained would turn it into success sys.stderr.write('SELinux was requested, but the image has no /etc/selinux/config\n') raise Exception('SELinux not enabled in image') + # Processes the initramfs starts before the policy loads keep + # kernel_t: urlmount serves the root image of a tethered node over + # https, and imageboot.sh later runs dd from the initramfs + modfile = os.path.join(self.targpath, 'tmp/confluent_diskless.cil') + with open(modfile, 'w') as modout: + modout.write('(allow kernel_t http_port_t (tcp_socket (name_connect)))\n' + '(allow kernel_t root_t (file (entrypoint)))\n') + args.cmd = ['semodule', '-n', '-i', '/tmp/confluent_diskless.cil'] + rc = run_constrainedx(fancy_chroot, (args, self.targpath)) + os.remove(modfile) + if rc: + raise Exception('Installing the confluent SELinux module failed') return try: with open(os.path.join(self.targpath, 'etc/selinux/config'), 'r') as seconfigin: