xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2026-11-14 12:58:05 +00:00
Code Issues Projects Releases Wiki Activity

Label overlay upper layer of diskless images for SELinux

Browse Source 
With a tethered root (and on EL8 always), the initramfs writes the
overlay upper layer before the SELinux policy is loaded, so those files
are unlabeled_t. On a captured enforcing image sshd-keygen then cannot
search / and the node comes up without sshd.

Label exactly the upper layer paths with matchpathcon and chcon.
setfiles would recurse into the merged tree and restorecon is a no-op
before policy load. Built images have SELinux disabled and skip this.
This commit is contained in:
Markus Hilger
2026-10-30 09:43:18 +01:00
parent 0c57184ef1
commit dc909e6f0b
3 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh
+31
View File
@@ -140,6 +140,37 @@ set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/onboot
set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/apiclient
ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service
cp /etc/confluent/functions /sysroot/etc/confluent/functions
if [ $TETHERED -eq 1 ] && [ -x /sysroot/usr/sbin/matchpathcon ] && grep -Eq '^SELINUX=(enforcing|permissive)' /sysroot/etc/selinux/config 2> /dev/null; then
# Files written to the upper layer before policy load are unlabeled.
# Label only those, using globstar since the initramfs has no find.
selinuxpolicy=$(sed -n 's/^SELINUXTYPE=//p' /sysroot/etc/selinux/config)
shopt -s globstar dotglob nullglob
relabel=()
if [ -f /tmp/mountparts.sh ]; then
overlayparts=$(awk '{print $3}' /tmp/mountparts.sh)
else
overlayparts=/mnt/remote
fi
for srcmount in $overlayparts; do
upperdir=/mnt/overlay/upper
if [ -f /tmp/mountparts.sh ]; then
upperdir=/mnt/overlay${srcmount}/upper
fi
prefix=${srcmount#/mnt/remote}
prefix=${prefix%/}
relabel+=("${prefix:-/}")
for relpath in "$upperdir"/**; do
relabel+=("$prefix${relpath#$upperdir}")
done
done
shopt -u globstar dotglob nullglob
# Not setfiles (recurses) or restorecon (no-op before policy load).
chroot /sysroot /usr/sbin/matchpathcon -f /etc/selinux/$selinuxpolicy/contexts/files/file_contexts "${relabel[@]}" | while IFS=$'\t' read -r relpath context; do
if [ "$context" != "<<none>>" ]; then
chcon -h "$context" "/sysroot$relpath"
fi
done
fi
if grep installtodisk /proc/cmdline > /dev/null; then
. /etc/confluent/functions
run_remote installimage
confluent_osdeploy/el8-diskless/profiles/default/scripts/imageboot.sh
+31
View File
@@ -128,6 +128,37 @@ set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/onboot
set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/apiclient
ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service
cp /etc/confluent/functions /sysroot/etc/confluent/functions
if [ -x /sysroot/usr/sbin/matchpathcon ] && grep -Eq '^SELINUX=(enforcing|permissive)' /sysroot/etc/selinux/config 2> /dev/null; then
# Files written to the upper layer before policy load are unlabeled.
# Label only those, using globstar since the initramfs has no find.
selinuxpolicy=$(sed -n 's/^SELINUXTYPE=//p' /sysroot/etc/selinux/config)
shopt -s globstar dotglob nullglob
relabel=()
if [ -f /tmp/mountparts.sh ]; then
overlayparts=$(awk '{print $3}' /tmp/mountparts.sh)
else
overlayparts=/mnt/remote
fi
for srcmount in $overlayparts; do
upperdir=/mnt/overlay/upper
if [ -f /tmp/mountparts.sh ]; then
upperdir=/mnt/overlay${srcmount}/upper
fi
prefix=${srcmount#/mnt/remote}
prefix=${prefix%/}
relabel+=("${prefix:-/}")
for relpath in "$upperdir"/**; do
relabel+=("$prefix${relpath#$upperdir}")
done
done
shopt -u globstar dotglob nullglob
# Not setfiles (recurses) or restorecon (no-op before policy load).
chroot /sysroot /usr/sbin/matchpathcon -f /etc/selinux/$selinuxpolicy/contexts/files/file_contexts "${relabel[@]}" | while IFS=$'\t' read -r relpath context; do
if [ "$context" != "<<none>>" ]; then
chcon -h "$context" "/sysroot$relpath"
fi
done
fi
if grep installtodisk /proc/cmdline > /dev/null; then
. /etc/confluent/functions
run_remote installimage
confluent_osdeploy/el9-diskless/profiles/default/scripts/imageboot.sh
+31
View File
@@ -142,6 +142,37 @@ set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/onboot
set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/apiclient
ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service
cp /etc/confluent/functions /sysroot/etc/confluent/functions
if [ $TETHERED -eq 1 ] && [ -x /sysroot/usr/sbin/matchpathcon ] && grep -Eq '^SELINUX=(enforcing|permissive)' /sysroot/etc/selinux/config 2> /dev/null; then
# Files written to the upper layer before policy load are unlabeled.
# Label only those, using globstar since the initramfs has no find.
selinuxpolicy=$(sed -n 's/^SELINUXTYPE=//p' /sysroot/etc/selinux/config)
shopt -s globstar dotglob nullglob
relabel=()
if [ -f /tmp/mountparts.sh ]; then
overlayparts=$(awk '{print $3}' /tmp/mountparts.sh)
else
overlayparts=/mnt/remote
fi
for srcmount in $overlayparts; do
upperdir=/mnt/overlay/upper
if [ -f /tmp/mountparts.sh ]; then
upperdir=/mnt/overlay${srcmount}/upper
fi
prefix=${srcmount#/mnt/remote}
prefix=${prefix%/}
relabel+=("${prefix:-/}")
for relpath in "$upperdir"/**; do
relabel+=("$prefix${relpath#$upperdir}")
done
done
shopt -u globstar dotglob nullglob
# Not setfiles (recurses) or restorecon (no-op before policy load).
chroot /sysroot /usr/sbin/matchpathcon -f /etc/selinux/$selinuxpolicy/contexts/files/file_contexts "${relabel[@]}" | while IFS=$'\t' read -r relpath context; do
if [ "$context" != "<<none>>" ]; then
chcon -h "$context" "/sysroot$relpath"
fi
done
fi
if grep installtodisk /proc/cmdline > /dev/null; then
. /etc/confluent/functions
run_remote installimage