BZ 1956836: overlay: Add rhcos-usrlocal-selinux-fixup.service by cgwalters · Pull Request #551 · openshift/os

cgwalters · 2021-05-14T18:22:39Z

A fix is inbound for policy, but we really should fixup existing
systems in place.

jlebon · 2021-05-14T21:27:54Z

Hmm, I think we need this and also temporarily carry https://src.fedoraproject.org/rpms/selinux-policy/pull-request/24 until it makes it into RHEL8. Something like:

diff --git a/manifest.yaml b/manifest.yaml
index 4205ec4..30d74f9 100644
--- a/manifest.yaml
+++ b/manifest.yaml
@@ -163,6 +163,18 @@ postprocess:
      # NB: we don't use -f here so we break when this is no longer needed
      rm -v /etc/iscsi/initiatorname.iscsi

+  # Carry https://src.fedoraproject.org/rpms/selinux-policy/pull-request/24
+  # until it gets into RHEL8. Tracked at https://bugzilla.redhat.com/show_bug.cgi?id=1943381.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+
+    f=/etc/selinux/targeted/contexts/files/file_contexts.subs_dist
+    if ! grep /var/usrlocal $f; then
+      echo "# https://src.fedoraproject.org/rpms/selinux-policy/pull-request/24" >> $f
+      echo "/var/usrlocal /usr/local" >> $f
+    fi
+
 etc-group-members:
   - wheel
   - sudo

?

This should also allow you to simplify the systemd service to just do restorecon -rv /var/usrlocal. Testing locally (after applying the change above live, not from a new compose):

[root@cosa-devsh ~]# echo foobar > /usr/local/sbin/foobar
[root@cosa-devsh ~]# chmod a+x /usr/local/sbin/foobar
[root@cosa-devsh ~]# restorecon -rv /var/usrlocal
Relabeled /var/usrlocal from system_u:object_r:var_t:s0 to system_u:object_r:usr_t:s0
Relabeled /var/usrlocal/etc from system_u:object_r:var_t:s0 to system_u:object_r:usr_t:s0
Relabeled /var/usrlocal/games from system_u:object_r:var_t:s0 to system_u:object_r:usr_t:s0
Relabeled /var/usrlocal/include from system_u:object_r:var_t:s0 to system_u:object_r:usr_t:s0
Relabeled /var/usrlocal/lib from system_u:object_r:var_t:s0 to system_u:object_r:lib_t:s0
Relabeled /var/usrlocal/man from system_u:object_r:var_t:s0 to system_u:object_r:usr_t:s0
Relabeled /var/usrlocal/sbin from system_u:object_r:var_t:s0 to system_u:object_r:bin_t:s0
Relabeled /var/usrlocal/sbin/foobar from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:bin_t:s0
Relabeled /var/usrlocal/share from system_u:object_r:var_t:s0 to system_u:object_r:usr_t:s0
Relabeled /var/usrlocal/src from system_u:object_r:var_t:s0 to system_u:object_r:usr_t:s0

travier · 2021-05-17T16:50:36Z

This should also allow you to simplify the systemd service to just do restorecon -rv /var/usrlocal. Testing locally (after applying the change above live, not from a new compose):
Relabeled /var/usrlocal/sbin/foobar from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:bin_t:s0

To fix the (SELinux) user part too with restorecon you need -F.

cgwalters · 2021-05-17T16:51:36Z

OK wow I had thought systemd-tmpfiles did nothing if the file exists, but it does seem to always reset the security context each boot, plus if e.g. I do chown bin:bin /usr/local/sbin && reboot then it gets reset back to root:root. Did you come across this before?

Mmmm. Locally changing policy feels riskier than just having this service run every time.

cgwalters · 2021-05-17T17:25:36Z

OK reworked to always restorecon /var/usrlocal/sbin, but still only do the recursive relabel once.

cgwalters · 2021-05-17T17:29:31Z

The unit test doesn't cover actually injecting binaries via Ignition right now, but I extensively tested this manually too.

jlebon

Minor comments, but LGTM generally!

cgwalters · 2021-05-17T20:57:02Z

Squashed the suggestions (thanks!) and updated Documentation=

travier · 2021-05-18T12:26:03Z

OK wow I had thought systemd-tmpfiles did nothing if the file exists, but it does seem to always reset the security context each boot, plus if e.g. I do chown bin:bin /usr/local/sbin && reboot then it gets reset back to root:root. Did you come across this before?

I had a similar issue earlier: coreos/ignition#1156

travier · 2021-05-18T12:27:53Z

 systemctl is-enabled logrotate.timer
 echo "ok logrotate"

+<<<<<<< HEAD


Looks like a broken merge 🙂

A fix is inbound for policy, but we really should fixup existing systems in place.

jlebon · 2021-05-19T16:35:58Z

INFO[2021-05-19T16:25:48Z] error: Packages not found: audit, authselect, bash-completion, bind-utils, bsdtar, bzip2, chrony, cifs-utils, cloud-utils-growpart, compat-openssl10, conntrack-tools, coreutils, cryptsetup, cryptsetup-reencrypt, device-mapper-multipath, dhcp-client, dnsmasq, e2fsprogs, efibootmgr, git-core, glusterfs-fuse, gnupg2, grub2, grub2-efi-x64, gzip, hostname, iproute, iproute-tc, iptables, irqbalance, iscsi-initiator-utils, kernel, kernel-core, kernel-modules, kernel-modules-extra, kexec-tools, less, logrotate, lvm2, mdadm, microcode_ctl, nano, net-tools, nfs-utils, nftables, nmap-ncat, open-vm-tools, openssh-clients, openssh-server, passwd, perl-interpreter, qemu-guest-agent, rdma-core, rpm-ostree, rsync, selinux-policy-targeted, sg3_utils, shadow-utils, shim, socat, sssd, stalld, strace, subscription-manager-rhsm-certificates, sudo, systemd, systemd-journal-gateway, systemd-journal-remote, tar, teamd, tmux, tpm2-tools, vim-minimal, xfsprogs, xz

Hmm, something to do with the recent repo changes I suppose? /cc @travier

jlebon · 2021-05-19T16:36:28Z

/lgtm
for PR itself!

openshift-ci · 2021-05-19T16:36:44Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cgwalters, jlebon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [cgwalters,jlebon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-05-19T18:20:26Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2021-05-19T21:05:27Z

/retest

Please review the full test history for this PR and help us cut down flakes.

cgwalters · 2021-05-19T21:17:05Z

/hold
until repos are fixed

cgwalters · 2021-05-20T15:36:34Z

/retest

travier · 2021-05-20T18:55:49Z

Blocked by openshift/release#18691 🙁

travier · 2021-05-20T22:01:14Z

Should be good to go now but maybe a full retest would be best

miabbott · 2021-05-21T14:55:58Z

/retest

miabbott · 2021-05-21T15:02:03Z

/unhold

BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1956836 Unfortunately right now, executing `bash` skips a domain transition (see fedora-selinux/selinux-policy#778) so the way we're sourcing the script means we stay in `initrc_t` and end up triggering a SELinux policy denial. (BTW this denial turns out to just delay the successful exit of the script, which will then end up just delaying kubelet start. it's otherwise harmless, but we also don't want SELinux policy denials in our product by default) Fix this in two ways: - First, just move the thing to `/usr/local/bin` to avoid issues with labeling of `/usr/local/sbin` that were fixed in openshift/os#551 - Second, rework it to be executed directly While we're here: - Clean the confusing+outdated comment about being a NM dispatcher - Drop the `logger` bit which was only necessary as a NM dispatcher; since we're *always* running under systemd, this makes `journalctl -u node-valid-hostname` actually show the script output. - Make it crystal clear that the "truncate hostname" is only run in GCP. - Fix various typos - Use the more precise term "non-localhost" in various places instead of the more ambiguous terms "real"/"valid"

openshift-ci Bot requested review from jlebon and miabbott May 14, 2021 18:22

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 14, 2021

cgwalters force-pushed the restorecon-usr-sbin branch from dc66f57 to ca53463 Compare May 14, 2021 18:23

cgwalters marked this pull request as draft May 17, 2021 17:16

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 17, 2021

cgwalters force-pushed the restorecon-usr-sbin branch from ca53463 to 4b53424 Compare May 17, 2021 17:25

cgwalters marked this pull request as ready for review May 17, 2021 17:25

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 17, 2021

jlebon approved these changes May 17, 2021

View reviewed changes

Comment thread overlay.d/05rhcos/usr/lib/systemd/system/rhcos-usrlocal-selinux-fixup.service Outdated

Comment thread tests/kola/misc-ro/misc-ro.sh Outdated

Comment thread tests/kola/misc-ro/misc-ro.sh Outdated

cgwalters force-pushed the restorecon-usr-sbin branch from ae96e53 to d0f2b98 Compare May 17, 2021 20:56

travier reviewed May 18, 2021

View reviewed changes

BZ 1956836: overlay: Add rhcos-usrlocal-selinux-fixup.service

fb007ee

A fix is inbound for policy, but we really should fixup existing systems in place.

cgwalters force-pushed the restorecon-usr-sbin branch from d0f2b98 to fb007ee Compare May 19, 2021 16:16

openshift-ci Bot assigned jlebon May 19, 2021

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label May 19, 2021

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 19, 2021

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 21, 2021

openshift-merge-robot merged commit a721b30 into openshift:master May 21, 2021

cgwalters mentioned this pull request Jun 14, 2021

Bug 1956836: templates: Rework node-valid-hostname to fix SELinux denial openshift/machine-config-operator#2618

Merged

Conversation

cgwalters commented May 14, 2021

Uh oh!

jlebon commented May 14, 2021

Uh oh!

travier commented May 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cgwalters commented May 17, 2021

Uh oh!

cgwalters commented May 17, 2021

Uh oh!

cgwalters commented May 17, 2021

Uh oh!

jlebon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cgwalters commented May 17, 2021

Uh oh!

travier commented May 18, 2021

Uh oh!

travier May 18, 2021

Choose a reason for hiding this comment

Uh oh!

jlebon commented May 19, 2021

Uh oh!

jlebon commented May 19, 2021

Uh oh!

openshift-ci Bot commented May 19, 2021

Uh oh!

openshift-bot commented May 19, 2021

Uh oh!

openshift-bot commented May 19, 2021

Uh oh!

cgwalters commented May 19, 2021

Uh oh!

cgwalters commented May 20, 2021

Uh oh!

travier commented May 20, 2021

Uh oh!

travier commented May 20, 2021

Uh oh!

miabbott commented May 21, 2021

Uh oh!

miabbott commented May 21, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

travier commented May 17, 2021 •

edited

Loading