From 049b456d9adc4af1290feb15cc8224526fe0dcec Mon Sep 17 00:00:00 2001 From: Richard Maw Date: Tue, 30 Apr 2024 18:02:51 +0100 Subject: [PATCH 1/4] test: Skip TEST-06-SELINUX early if not on fedora/centos Other distributions may be able to install selinux but they are not expected to use it. The distribution is tested rather than whether selinux is enabled because it is expected to work on CentOS and Fedora and we want it to fail noisily. --- test/units/testsuite-06.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/test/units/testsuite-06.sh b/test/units/testsuite-06.sh index 7fc3c379e5..937a04005a 100755 --- a/test/units/testsuite-06.sh +++ b/test/units/testsuite-06.sh @@ -3,6 +3,12 @@ set -eux set -o pipefail +. /etc/os-release +if ! [[ "$ID" =~ centos|fedora ]]; then + echo "Skipping because only CentOS and Fedora support SELinux tests" >>/skipped + exit 77 +fi + # Note: ATTOW the following checks should work with both Fedora and upstream reference policy # (with or without MCS/MLS) From a2a734e737a78256c02d8b2ed0134465fa7d8cc0 Mon Sep 17 00:00:00 2001 From: Richard Maw Date: Fri, 5 Apr 2024 17:47:17 +0100 Subject: [PATCH 2/4] test: Integrate custom selinux relabelling unit with firstboot --- test/units/autorelabel.service | 11 ++++++++--- test/units/firstboot-autorelabel.service | 20 ++++++++++++++++++++ 2 files changed, 28 insertions(+), 3 deletions(-) create mode 100644 test/units/firstboot-autorelabel.service diff --git a/test/units/autorelabel.service b/test/units/autorelabel.service index 7e5f9a2b89..fd652225d9 100644 --- a/test/units/autorelabel.service +++ b/test/units/autorelabel.service @@ -3,9 +3,14 @@ Description=Relabel all filesystems DefaultDependencies=no Requires=local-fs.target -Conflicts=shutdown.target After=local-fs.target -Before=sysinit.target shutdown.target +Conflicts=shutdown.target +Before=shutdown.target +Before=multi-user.target +# Needs to access /var, which may not have been populated yet +After=systemd-tmpfiles-setup.service +# Must wait for systemd-machine-id-commit or firstboot-autorelabel will reactivate autorelabel +After=systemd-machine-id-commit.service ConditionSecurity=selinux ConditionPathExists=|/.autorelabel @@ -16,4 +21,4 @@ TimeoutSec=infinity RemainAfterExit=yes [Install] -WantedBy=basic.target +WantedBy=multi-user.target diff --git a/test/units/firstboot-autorelabel.service b/test/units/firstboot-autorelabel.service new file mode 100644 index 0000000000..b69dcf72a3 --- /dev/null +++ b/test/units/firstboot-autorelabel.service @@ -0,0 +1,20 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later +[Unit] +Description=Activate relabelling on firstboot only +DefaultDependencies=no +Wants=first-boot-complete.target +Requires=local-fs.target +After=local-fs.target +Conflicts=shutdown.target +Before=shutdown.target +Before=first-boot-complete.target sysinit.target autorelabel.service +ConditionPathIsReadWrite=/etc +ConditionFirstBoot=yes + +[Service] +ExecStart=touch /.autorelabel +Type=oneshot +RemainAfterExit=yes + +[Install] +WantedBy=sysinit.target From e26efe09f3dd70b88e4feec75f314dd16d954491 Mon Sep 17 00:00:00 2001 From: Richard Maw Date: Tue, 30 Apr 2024 17:23:02 +0100 Subject: [PATCH 3/4] mkosi: Disable selinux labelling and install policy in initramfs It is necessary to install the selinux policy in the initramfs so that userland is entered with the correct label. SELinuxRelabel defaults to auto, which will skip if the relabelling command is not installed and will treat failure to relabel as non-fatal. We can't force it on because root privileges are required if the labels don't exist on the host system and we would like to be able to cross-build from other distributions. Since we are already committed to relabelling on first boot there is no value in even trying to label. --- .../10-centos-fedora/mkosi.conf.d/10-selinux.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf index 3dc1143fc8..9fe5509695 100644 --- a/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf +++ b/mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf @@ -10,3 +10,11 @@ Packages= selinux-policy selinux-policy-targeted setools-console + +# We relabel on first boot instead of at build time because it is only possible to label without root +# if the labels exist in the host system, and we want to be able to cross-build to other distributions. +SELinuxRelabel=no + +InitrdPackages= + selinux-policy + selinux-policy-targeted From ab9d60250e0349a267902a8d7d5f5403491ab2a7 Mon Sep 17 00:00:00 2001 From: Richard Maw Date: Tue, 30 Apr 2024 17:39:52 +0100 Subject: [PATCH 4/4] test: Enable TEST-06-SELINUX testing with mkosi --- test/TEST-06-SELINUX/meson.build | 5 +++++ test/meson.build | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 test/TEST-06-SELINUX/meson.build diff --git a/test/TEST-06-SELINUX/meson.build b/test/TEST-06-SELINUX/meson.build new file mode 100644 index 0000000000..50247d3e47 --- /dev/null +++ b/test/TEST-06-SELINUX/meson.build @@ -0,0 +1,5 @@ +# SPDX-License-Identifier: LGPL-2.1-or-later + +test_params += { + 'mkosi_args' : ['--kernel-command-line-extra=apparmor=0 selinux=1 enforcing=0 lsm=selinux systemd.wants=autorelabel.service systemd.wants=firstboot-autorelabel.service'], +} diff --git a/test/meson.build b/test/meson.build index 705762d533..95136c7e02 100644 --- a/test/meson.build +++ b/test/meson.build @@ -341,7 +341,7 @@ integration_tests = { '03': 'TEST-03-JOBS', # '04': 'TEST-04-JOURNAL', # Extremely flaky '05': 'TEST-05-RLIMITS', - # '06': 'TEST-06-SELINUX', + '06': 'TEST-06-SELINUX', # '07': 'TEST-07-PID1', # '08': 'TEST-08-INITRD', '09': 'TEST-09-REBOOT',