refactor: clean up osguard base definition (microsoft#14514)

Remove duplicate veritysetup entry.
Remove commented-out packages.
Create an selinux-ci-uki.semanage in osguard files and reference file from new location.

Signed-off-by: Chris Co <[email protected]>

Author: christopherco

toolkit/imageconfigs/files/osguard/selinux-ci-uki.semanage

@@ -0,0 +1,21 @@
+boolean -D
+login -D
+interface -D
+user -D
+port -D
+node -D
+fcontext -D
+module -D
+ibendport -D
+ibpkey -D
+permissive -D
+boolean -m -1 cloudinit_manage_non_security
+boolean -m -1 container_mounton_non_security
+boolean -m -1 init_mounton_non_security
+login -m -s ci_unconfined_u -r 's0' root
+login -m -s ci_unconfined_u -r 's0' __default__
+fcontext -a -f f -t bin_t -r 's0' '/etc/grub\.d/.*'
+fcontext -a -f f -t fsadm_exec_t -r 's0' '/usr/bin/lsblk'
+fcontext -a -f f -t dockerd_exec_t -r 's0' '/usr/bin/tardev-snapshotter'
+fcontext -a -f f -t bin_t -r 's0' '/usr/share/netplan/netplan\.script'
+fcontext -a -e /etc/selinux /usr/etc/selinux

toolkit/imageconfigs/osguard-amd64.yaml

@@ -84,7 +84,6 @@ os:
     - WALinuxAgent
     - device-mapper
     - kernel-ipe
-    - veritysetup
     - cni
     - containerd2
     - cri-tools
@@ -150,7 +149,7 @@ os:
     destination: /etc/repart.d
     childFilePermissions: 644
   additionalFiles:
-  - source: files/linuxguard/selinux-ci-uki.semanage
+  - source: files/osguard/selinux-ci-uki.semanage
     destination: /etc/selinux/targeted/selinux-ci.semanage
   - source: files/osguard/cloud.cfg
     destination: /etc/cloud/cloud.cfg

toolkit/imageconfigs/templates/osguard-base.yaml

@@ -96,17 +96,10 @@ os:
       # OS
       - device-mapper
       - kernel-ipe
-      # servicing
-      # - trident
-      # - trident-service
-      - veritysetup
       # OCI
       - cni
       - containerd2
       - cri-tools
-      # - erofs-utils
-      # - notation
-      # - tardev-snapshotter
       # UKI
       - systemd-boot
       # hyperv
@@ -179,7 +172,7 @@ os:
 
   additionalFiles:
     # SELinux customizations
-    - source: files/linuxguard/selinux-ci-uki.semanage
+    - source: files/osguard/selinux-ci-uki.semanage
       destination: /etc/selinux/targeted/selinux-ci.semanage
     # Cloud-init configuration
     - source: files/osguard/cloud.cfg