Skip to content

Commit 4a392b3

Browse files
dustymabedustymabe
committed
osbuild: use SELinux policy when setting labels on mountpoints
This allows us to use the policy rather than hardcoding labels to set on the mountpoints. The unfortunate thing here is that in order to pick up a policy easily we have to use the `build` pipeline where the files are written out plainly and we don't have to find where the OSTree deployment is. I say unfortunate because right now for FCOS the `build` pipeline was getting skipped because we weren't using it for anything else, but now we'll be forced to build it. That's OK I think, because we really want to start using a non-host (i.e. non-COSA) buildroot for FCOS too if we can ever convince the team/community to get python into it. This commit also adds a comment to explain the "why" for the mkdir and two selinux stages.
1 parent f4e691d commit 4a392b3

File tree

4 files changed

+356
-48
lines changed

4 files changed

+356
-48
lines changed

‎src/osbuild-manifests/coreos.osbuild.aarch64.mpp.yaml‎

Lines changed: 89 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,9 @@ pipelines:
110110
else:
111111
type: org.osbuild.noop
112112
# Construct a buildroot here from the input container reference (either
113-
# ociarchive or registry/tag). Note that it won't actually be built
113+
# ociarchive or registry/tag). Note that this is only used as a buildroot
114+
# on RHCOS (FCOS doesn't ship python), but it is used everywhere as
115+
# file_context input to the org.osbuild.selinux stages.
114116
# unless used somewhere later in the manifest.
115117
- name: build
116118
stages:
@@ -143,8 +145,14 @@ pipelines:
143145
# https://github.com/coreos/fedora-coreos-tracker/issues/1772
144146
- type: org.osbuild.selinux
145147
options:
146-
labels:
147-
/: system_u:object_r:root_t:s0
148+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
149+
target: tree:///
150+
inputs:
151+
tree:
152+
type: org.osbuild.tree
153+
origin: org.osbuild.pipeline
154+
references:
155+
- name:build
148156
- type: org.osbuild.ostree.init-fs
149157
- type: org.osbuild.ostree.os-init
150158
options:
@@ -317,6 +325,12 @@ pipelines:
317325
mpp-format-string: '{root_fs_uuid}'
318326
label:
319327
mpp-format-string: '{root_fs_label}'
328+
# We've created the filesystems. Now let's create the mountpoints (directories)
329+
# on the filesystems and label them with appropriate SELinux labels. This also
330+
# covers things like filesystem autogenerated files like 'lost+found'. The labeling
331+
# will happen once with just the root filesystem mounted and once with the boot
332+
# filesystem mounted too (to make sure we get all potentially hidden mountpoints).
333+
# https://github.com/coreos/fedora-coreos-tracker/issues/1771
320334
- type: org.osbuild.mkdir
321335
options:
322336
paths:
@@ -345,10 +359,37 @@ pipelines:
345359
target: /boot-mount-point
346360
- type: org.osbuild.selinux
347361
options:
348-
labels:
349-
mount://root/boot: system_u:object_r:boot_t:s0
350-
mount://boot/efi: system_u:object_r:boot_t:s0
351-
mount://boot/lost+found: system_u:object_r:lost_found_t:s0
362+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
363+
target: mount://root/
364+
inputs:
365+
tree:
366+
type: org.osbuild.tree
367+
origin: org.osbuild.pipeline
368+
references:
369+
- name:build
370+
devices:
371+
disk:
372+
type: org.osbuild.loopback
373+
options:
374+
filename: disk.img
375+
partscan: true
376+
mounts:
377+
- name: root
378+
type: org.osbuild.xfs
379+
source: disk
380+
partition:
381+
mpp-format-int: '{image.layout[''root''].partnum}'
382+
target: /
383+
- type: org.osbuild.selinux
384+
options:
385+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
386+
target: mount://root/boot/
387+
inputs:
388+
tree:
389+
type: org.osbuild.tree
390+
origin: org.osbuild.pipeline
391+
references:
392+
- name:build
352393
devices:
353394
disk:
354395
type: org.osbuild.loopback
@@ -361,7 +402,7 @@ pipelines:
361402
source: disk
362403
partition:
363404
mpp-format-int: '{image.layout[''root''].partnum}'
364-
target: /sysroot
405+
target: /
365406
- name: boot
366407
type: org.osbuild.ext4
367408
source: disk
@@ -534,6 +575,12 @@ pipelines:
534575
mpp-format-string: '{root_fs_uuid}'
535576
label:
536577
mpp-format-string: '{root_fs_label}'
578+
# We've created the filesystems. Now let's create the mountpoints (directories)
579+
# on the filesystems and label them with appropriate SELinux labels. This also
580+
# covers things like filesystem autogenerated files like 'lost+found'. The labeling
581+
# will happen once with just the root filesystem mounted and once with the boot
582+
# filesystem mounted too (to make sure we get all potentially hidden mountpoints).
583+
# https://github.com/coreos/fedora-coreos-tracker/issues/1771
537584
- type: org.osbuild.mkdir
538585
options:
539586
paths:
@@ -564,10 +611,14 @@ pipelines:
564611
target: /boot-mount-point
565612
- type: org.osbuild.selinux
566613
options:
567-
labels:
568-
mount://root/boot: system_u:object_r:boot_t:s0
569-
mount://boot/efi: system_u:object_r:boot_t:s0
570-
mount://boot/lost+found: system_u:object_r:lost_found_t:s0
614+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
615+
target: mount://root/
616+
inputs:
617+
tree:
618+
type: org.osbuild.tree
619+
origin: org.osbuild.pipeline
620+
references:
621+
- name:build
571622
devices:
572623
disk:
573624
type: org.osbuild.loopback
@@ -582,7 +633,32 @@ pipelines:
582633
source: disk
583634
partition:
584635
mpp-format-int: '{image4k.layout[''root''].partnum}'
585-
target: /sysroot
636+
target: /
637+
- type: org.osbuild.selinux
638+
options:
639+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
640+
target: mount://root/boot/
641+
inputs:
642+
tree:
643+
type: org.osbuild.tree
644+
origin: org.osbuild.pipeline
645+
references:
646+
- name:build
647+
devices:
648+
disk:
649+
type: org.osbuild.loopback
650+
options:
651+
filename: disk.img
652+
partscan: true
653+
sector-size:
654+
mpp-format-int: "{four_k_sector_size}"
655+
mounts:
656+
- name: root
657+
type: org.osbuild.xfs
658+
source: disk
659+
partition:
660+
mpp-format-int: '{image4k.layout[''root''].partnum}'
661+
target: /
586662
- name: boot
587663
type: org.osbuild.ext4
588664
source: disk

‎src/osbuild-manifests/coreos.osbuild.ppc64le.mpp.yaml‎

Lines changed: 89 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,9 @@ pipelines:
112112
else:
113113
type: org.osbuild.noop
114114
# Construct a buildroot here from the input container reference (either
115-
# ociarchive or registry/tag). Note that it won't actually be built
115+
# ociarchive or registry/tag). Note that this is only used as a buildroot
116+
# on RHCOS (FCOS doesn't ship python), but it is used everywhere as
117+
# file_context input to the org.osbuild.selinux stages.
116118
# unless used somewhere later in the manifest.
117119
- name: build
118120
stages:
@@ -145,8 +147,14 @@ pipelines:
145147
# https://github.com/coreos/fedora-coreos-tracker/issues/1772
146148
- type: org.osbuild.selinux
147149
options:
148-
labels:
149-
/: system_u:object_r:root_t:s0
150+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
151+
target: tree:///
152+
inputs:
153+
tree:
154+
type: org.osbuild.tree
155+
origin: org.osbuild.pipeline
156+
references:
157+
- name:build
150158
- type: org.osbuild.ostree.init-fs
151159
- type: org.osbuild.ostree.os-init
152160
options:
@@ -310,6 +318,12 @@ pipelines:
310318
mpp-format-string: '{root_fs_uuid}'
311319
label:
312320
mpp-format-string: '{root_fs_label}'
321+
# We've created the filesystems. Now let's create the mountpoints (directories)
322+
# on the filesystems and label them with appropriate SELinux labels. This also
323+
# covers things like filesystem autogenerated files like 'lost+found'. The labeling
324+
# will happen once with just the root filesystem mounted and once with the boot
325+
# filesystem mounted too (to make sure we get all potentially hidden mountpoints).
326+
# https://github.com/coreos/fedora-coreos-tracker/issues/1771
313327
- type: org.osbuild.mkdir
314328
options:
315329
paths:
@@ -330,9 +344,37 @@ pipelines:
330344
target: /root-mount-point
331345
- type: org.osbuild.selinux
332346
options:
333-
labels:
334-
mount://root/boot: system_u:object_r:boot_t:s0
335-
mount://boot/lost+found: system_u:object_r:lost_found_t:s0
347+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
348+
target: mount://root/
349+
inputs:
350+
tree:
351+
type: org.osbuild.tree
352+
origin: org.osbuild.pipeline
353+
references:
354+
- name:build
355+
devices:
356+
disk:
357+
type: org.osbuild.loopback
358+
options:
359+
filename: disk.img
360+
partscan: true
361+
mounts:
362+
- name: root
363+
type: org.osbuild.xfs
364+
source: disk
365+
partition:
366+
mpp-format-int: '{image.layout[''root''].partnum}'
367+
target: /
368+
- type: org.osbuild.selinux
369+
options:
370+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
371+
target: mount://root/boot/
372+
inputs:
373+
tree:
374+
type: org.osbuild.tree
375+
origin: org.osbuild.pipeline
376+
references:
377+
- name:build
336378
devices:
337379
disk:
338380
type: org.osbuild.loopback
@@ -345,7 +387,7 @@ pipelines:
345387
source: disk
346388
partition:
347389
mpp-format-int: '{image.layout[''root''].partnum}'
348-
target: /sysroot
390+
target: /
349391
- name: boot
350392
type: org.osbuild.ext4
351393
source: disk
@@ -495,6 +537,12 @@ pipelines:
495537
mpp-format-string: '{root_fs_uuid}'
496538
label:
497539
mpp-format-string: '{root_fs_label}'
540+
# We've created the filesystems. Now let's create the mountpoints (directories)
541+
# on the filesystems and label them with appropriate SELinux labels. This also
542+
# covers things like filesystem autogenerated files like 'lost+found'. The labeling
543+
# will happen once with just the root filesystem mounted and once with the boot
544+
# filesystem mounted too (to make sure we get all potentially hidden mountpoints).
545+
# https://github.com/coreos/fedora-coreos-tracker/issues/1771
498546
- type: org.osbuild.mkdir
499547
options:
500548
paths:
@@ -517,9 +565,14 @@ pipelines:
517565
target: /root-mount-point
518566
- type: org.osbuild.selinux
519567
options:
520-
labels:
521-
mount://root/boot: system_u:object_r:boot_t:s0
522-
mount://boot/lost+found: system_u:object_r:lost_found_t:s0
568+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
569+
target: mount://root/
570+
inputs:
571+
tree:
572+
type: org.osbuild.tree
573+
origin: org.osbuild.pipeline
574+
references:
575+
- name:build
523576
devices:
524577
disk:
525578
type: org.osbuild.loopback
@@ -534,7 +587,32 @@ pipelines:
534587
source: disk
535588
partition:
536589
mpp-format-int: '{image4k.layout[''root''].partnum}'
537-
target: /sysroot
590+
target: /
591+
- type: org.osbuild.selinux
592+
options:
593+
file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
594+
target: mount://root/boot/
595+
inputs:
596+
tree:
597+
type: org.osbuild.tree
598+
origin: org.osbuild.pipeline
599+
references:
600+
- name:build
601+
devices:
602+
disk:
603+
type: org.osbuild.loopback
604+
options:
605+
filename: disk.img
606+
partscan: true
607+
sector-size:
608+
mpp-format-int: "{four_k_sector_size}"
609+
mounts:
610+
- name: root
611+
type: org.osbuild.xfs
612+
source: disk
613+
partition:
614+
mpp-format-int: '{image4k.layout[''root''].partnum}'
615+
target: /
538616
- name: boot
539617
type: org.osbuild.ext4
540618
source: disk

0 commit comments

Comments
 (0)