lsm: Use libselinux for process availability - #2445
Conversation
Closes: bootc-dev#2444 Basically us trying to use libselinux more to lookup the unlabeled type breaks in the osbuild scenario where it mounts /sys/fs/selinux readonly, which libselinux treats the same as not existing. Assisted-by: https://github.com/cgwalters/cgwalters#llms Signed-off-by: Colin Walters <[email protected]>
| /// libselinux caches this state process-wide, so mounting selinuxfs requires a | ||
| /// re-exec before this result can change. | ||
| pub(crate) fn selinux_enabled() -> bool { | ||
| selinux::kernel_support() != selinux::KernelSupport::Unsupported |
There was a problem hiding this comment.
I think we want to do similar operation here as we do in host_selinux_enabled. I was just testing around on how the selinux module checks for support and it just stats
statfs(
"/sys/fs/selinux",
{f_type=SELINUX_MAGIC, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={val=[0x16, 0]},
f_namelen=255, f_frsize=4096, f_flags=ST_VALID| ST_NOSUID|ST_NOEXEC|ST_RELATIME}
) = 0This wouldn't really check if selinux is "enabled" or not right as this directory would still exist even if selinux is disabled?
There was a problem hiding this comment.
No, if SELinux is e.g. compiled into the Linux kernel but the system is booted with selinux=0, then /sys/fs/selinux which is an instance of selinuxfs doesn't exist at all. You can see this in e.g. bcvk ephemeral run-ssh quay.io/centos-bootc/centos-bootc:stream10
[root@localhost ~]# cat /proc/cmdline
systemd.journald.storage=volatile selinux=0
[root@localhost ~]# stat /sys/fs/selinux
stat: cannot statx '/sys/fs/selinux': No such file or directory
There was a problem hiding this comment.
Okay, yeah, that's correct. I had updated /etc/selinux/config to disable but didn't read the note
# NOTE: In earlier Fedora kernel builds, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
2 participants
Closes: #2444
Basically us trying to use libselinux more to lookup the unlabeled type breaks in the osbuild scenario where it mounts /sys/fs/selinux readonly, which libselinux treats the same as not existing.
Assisted-by: https://github.com/cgwalters/cgwalters#llms