This repository was archived by the owner on May 30, 2023. It is now read-only.
[WIP] update libselinux and security policies#347
Closed
dongsupark wants to merge 62 commits into
Closed
Conversation
dongsupark
changed the title
dongsupark
force-pushed
the
dongsu/selinux-container-alpha
branch
from
907a985 to
4751551
Compare
dongsupark
changed the title
Contributor
Author
|
Rewrote the PR so it is based on a previous attempt to update libselinux, coreos/coreos-overlay#3155. It should be also merged together with flatcar/scripts#66, so SELinux relabeling can take place. |
dongsupark
force-pushed
the
dongsu/selinux-container-alpha
branch
2 times, most recently
from
8f648ad to
889a684
Compare
Contributor
Author
|
Rebased |
dongsupark
force-pushed
the
dongsu/selinux-container-alpha
branch
from
889a684 to
802a431
Compare
dongsupark
force-pushed
the
dongsu/selinux-container-alpha
branch
from
802a431 to
8d4fe99
Compare
dongsupark
force-pushed
the
dongsu/selinux-container-alpha
branch
from
8d4fe99 to
6820053
Compare
dongsupark
changed the title
dongsupark
force-pushed
the
dongsu/selinux-container-alpha
branch
from
6820053 to
676a79f
Compare
[rebased to latest SELinux ebuilds] Signed-off-by: Geoff Levand <geoff@infradead.org>
[rebased to latest SELinux ebuilds] Signed-off-by: Geoff Levand <geoff@infradead.org>
Container Linux only uses the mcs policy type. Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Geoff Levand <geoff@infradead.org>
We're using a stripped down policy, so we don't care that certain tasks may refer to policy objects that don't exist. Permit acts that reference them. From: Matthew Garrett <mjg59@coreos.com> [Rebase to latest] Signed-off-by: Geoff Levand <geoff@infradead.org>
Install selinux to /usr/lib/selinux/ rather than /etc/selinux/ and /var/lib/selinux in order for Container Linux update to work properly. From: Matthew Garrett <mjg59@coreos.com> [Rebase to latest] Signed-off-by: Geoff Levand <geoff@infradead.org>
[Rebase to latest] Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Geoff Levand <geoff@infradead.org>
[Rebase to latest] Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Geoff Levand <geoff@infradead.org>
[Rebase to latest] Signed-off-by: Geoff Levand <geoff@infradead.org>
Signed-off-by: Geoff Levand <geoff@infradead.org>
Leave only setools 4.1.1, and remove all other unnecessary versions.
To build policycoreutils with semodule tools, we need to enable USE flag `semodule`.
Give users logged in via sshd unconfined_t.
Since semodule_package 3.0 does not work with libsepol 2.4 outside /build/amd64-usr, we need to set LD_LIBRARY_PATH to `/build/amd64-usr/usr/lib64`. Otherwise we would get the error: ``` /build/amd64-usr//usr/bin/semodule_package: /lib64/libsepol.so.1: no version information available (required by /build/amd64-usr//usr/bin/semodule_package) ```
Since semodule_package 3.0 does not work with libsepol 2.4 outside /build/amd64-usr, we need to set LD_LIBRARY_PATH to `/build/amd64-usr/usr/lib64`. Otherwise we would get the error: ``` /build/amd64-usr//usr/bin/semodule_package: /lib64/libsepol.so.1: no version information available (required by /build/amd64-usr//usr/bin/semodule_package) ```
`/usr/bin/semodule_package` exists under `/build/amd64-usr`, so we need to find correct path to that, by setting `BINDIR` correctly.
`/usr/bin/semodule_package` exists under `/build/amd64-usr`, so we need to find correct path to that, by setting `BINDIR` correctly.
Since libselinux is installed under `/build/amd64-usr`, we need to specify abspath to the binary `sefcontext_compile`, as well as abspath to the policy files.
dongsupark
force-pushed
the
dongsu/selinux-container-alpha
branch
from
676a79f to
c4d9206
Compare
Contributor
Author
|
Please see #1048 instead |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
work-in-progress: please do not merge
Goal of this PR is basically to update the following packages to the latest versions.
How to use
This PR should be merged together with flatcar-archive/portage-stable#66 , flatcar/scripts#66.
This PR is based on a previous attempt to update libselinux, coreos/coreos-overlay#3155.
Many thanks to @glevand & @dm0- & others!