Dedup sepolicy handling

For historical reasons the ostree sepolicy API can exist as a
no-op even if it didn't find a policy, one has to query `.csum()`
or `.name()` to verify it's present.

In our code just map that case to None.

Followup to 99d30df
to ensure we consistently handle this case.

Signed-off-by: Colin Walters <[email protected]>

Author: cgwalters

lib/src/install.rs

@@ -385,16 +385,14 @@ pub(crate) struct State {
 impl State {
     #[context("Loading SELinux policy")]
     pub(crate) fn load_policy(&self) -> Result<Option<ostree::SePolicy>> {
-        use std::os::fd::AsRawFd;
         if !self.selinux_state.enabled() {
             return Ok(None);
         }
         // We always use the physical container root to bootstrap policy
-        let r = ostree::SePolicy::new_at(self.container_root.as_raw_fd(), gio::Cancellable::NONE)?;
-        let csum = r
-            .csum()
+        let r = lsm::new_sepolicy_at(&self.container_root)?
             .ok_or_else(|| anyhow::anyhow!("SELinux enabled, but no policy found in root"))?;
-        tracing::debug!("Loaded SELinux policy: {csum}");
+        // SAFETY: Policy must have a checksum here
+        tracing::debug!("Loaded SELinux policy: {}", r.csum().unwrap());
         Ok(Some(r))
     }
 

lib/src/install/completion.rs

@@ -13,7 +13,6 @@ use fn_error_context::context;
 use ostree_ext::{gio, ostree};
 use rustix::fs::Mode;
 use rustix::fs::OFlags;
-use std::os::fd::AsRawFd;
 
 use crate::utils::deployment_fd;
 
@@ -294,13 +293,12 @@ pub(crate) async fn impl_completion(
     if !bound_images.is_empty() {
         // load the selinux policy from the target ostree deployment
         let deployment_fd = deployment_fd(sysroot, deployment)?;
-        let sepolicy =
-            &ostree::SePolicy::new_at(deployment_fd.as_raw_fd(), gio::Cancellable::NONE)?;
+        let sepolicy = crate::lsm::new_sepolicy_at(deployment_fd)?;
 
         // When we're run through ostree, we only lazily initialize the podman storage to avoid
         // having a hard dependency on it.
         let imgstorage =
-            &crate::imgstorage::Storage::create(&sysroot_dir, &rundir, Some(sepolicy))?;
+            &crate::imgstorage::Storage::create(&sysroot_dir, &rundir, sepolicy.as_ref())?;
         crate::boundimage::pull_images_impl(imgstorage, bound_images)
             .await
             .context("pulling bound images")?;

lib/src/lsm.rs

@@ -169,6 +169,19 @@ pub(crate) fn selinux_ensure_install_or_setenforce() -> Result<Option<SetEnforce
     Ok(g)
 }
 
+/// A thin wrapper for loading a SELinux policy that maps "policy nonexistent" to None.
+pub(crate) fn new_sepolicy_at(fd: impl AsFd) -> Result<Option<ostree::SePolicy>> {
+    let fd = fd.as_fd();
+    let cancellable = gio::Cancellable::NONE;
+    let sepolicy = ostree::SePolicy::new_at(fd.as_raw_fd(), cancellable)?;
+    let r = if sepolicy.csum().is_none() {
+        None
+    } else {
+        Some(sepolicy)
+    };
+    Ok(r)
+}
+
 #[context("Setting SELinux permissive mode")]
 #[allow(dead_code)]
 pub(crate) fn selinux_set_permissive(permissive: bool) -> Result<()> {

lib/src/store/mod.rs

@@ -8,13 +8,13 @@ use cap_std_ext::cap_std::fs::Dir;
 use cap_std_ext::dirext::CapStdExtDirExt;
 use clap::ValueEnum;
 use fn_error_context::context;
-use std::os::fd::AsRawFd;
 
 use ostree_ext::container::OstreeImageReference;
 use ostree_ext::keyfileext::KeyFileExt;
+use ostree_ext::ostree;
 use ostree_ext::sysroot::SysrootLock;
-use ostree_ext::{gio, ostree};
 
+use crate::lsm;
 use crate::spec::ImageStatus;
 use crate::utils::deployment_fd;
 
@@ -94,25 +94,20 @@ impl Storage {
             // this should only happen during cleanup of a broken install
             tracing::trace!("falling back to container root's selinux policy");
             let container_root = Dir::open_ambient_dir("/", cap_std::ambient_authority())?;
-            &ostree::SePolicy::new_at(container_root.as_raw_fd(), gio::Cancellable::NONE)?
+            lsm::new_sepolicy_at(&container_root)?
         } else {
             // load the sepolicy from the booted ostree deployment so the imgstorage can be
             // properly labeled with /var/lib/container/storage labels
             tracing::trace!("loading sepolicy from booted ostree deployment");
             let dep = self.sysroot.booted_deployment().unwrap();
             let dep_fs = deployment_fd(&self.sysroot, &dep)?;
-            &ostree::SePolicy::new_at(dep_fs.as_raw_fd(), gio::Cancellable::NONE)?
-        };
-
-        let sepolicy = if sepolicy.csum().is_none() {
-            None
-        } else {
-            Some(sepolicy)
+            lsm::new_sepolicy_at(&dep_fs)?
         };
 
         tracing::trace!("sepolicy in get_ensure_imgstore: {sepolicy:?}");
 
-        let imgstore = crate::imgstorage::Storage::create(&sysroot_dir, &self.run, sepolicy)?;
+        let imgstore =
+            crate::imgstorage::Storage::create(&sysroot_dir, &self.run, sepolicy.as_ref())?;
         Ok(self.imgstore.get_or_init(|| imgstore))
     }