Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Leaked selinux policy store files to the image root directory #596

Closed
pothos opened this issue Jan 13, 2022 · 2 comments · Fixed by flatcar-archive/coreos-overlay#1565
Closed

Leaked selinux policy store files to the image root directory #596

pothos opened this issue Jan 13, 2022 · 2 comments · Fixed by flatcar-archive/coreos-overlay#1565
Labels
kind/bug Something isn't working

Comments

@pothos
Copy link
Member

pothos commented Jan 13, 2022 •
edited
Loading

Description

These files/directories got added to the images compared to the 3066 Alpha:

+/final
+/mcs
+/mcs/active
+/mcs/active/modules
+/mcs/semanage.read.LOCK
+/mcs/semanage.trans.LOCK
+/mls
+/mls/active
+/mls/active/modules
+/mls/semanage.read.LOCK
+/mls/semanage.trans.LOCK
+/targeted
+/targeted/active
+/targeted/active/modules
+/targeted/semanage.read.LOCK
+/targeted/semanage.trans.LOCK

Impact

Possibly people are confused/concerned

Environment and steps to reproduce

FILE=flatcar_production_image_contents.txt FILESONLY=1 CUTKERNEL=1 CHANNEL_A=alpha CHANNEL_B=alpha ./package-diff 3066.0.0 3115.0.0

Expected behavior

These files should not leak to the rootfs

Additional information

Probably related to the recent selinux policy store fix
@pothos pothos added the kind/bug Something isn't working label Jan 13, 2022
@pothos pothos mentioned this issue Jan 13, 2022
Closed
27 tasks
@tormath1
Copy link
Contributor

Issue is fixed in this upstream commit: gentoo/gentoo@54a8322

tormath1 added a commit to flatcar-archive/coreos-overlay that referenced this issue Jan 13, 2022
@tormath1
sys-apps/policycoreutils: fix policy root path
c2a5543 
root needs to be specified with -p instead of -S.
The policy dir (-S) defaults to (-p) + /var/lib/selinux/ + (-s).

Picked from upstream: gentoo/gentoo@54a8322

Closes: flatcar/Flatcar#596
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
tormath1 added a commit to flatcar-archive/coreos-overlay that referenced this issue Jan 13, 2022
@tormath1
sys-apps/policycoreutils: fix policy root path
6416690 
root needs to be specified with -p instead of -S.
The policy dir (-S) defaults to (-p) + /var/lib/selinux/ + (-s).

Picked from upstream: gentoo/gentoo@54a8322

Closes: flatcar/Flatcar#596
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
@tormath1 tormath1 mentioned this issue Jan 13, 2022
Merged
1 task
tormath1 added a commit to flatcar-archive/coreos-overlay that referenced this issue Jan 14, 2022
@tormath1
sys-apps/policycoreutils: fix policy root path
b82fe0a 
root needs to be specified with -p instead of -S.
The policy dir (-S) defaults to (-p) + /var/lib/selinux/ + (-s).

Picked from upstream: gentoo/gentoo@54a8322

Closes: flatcar/Flatcar#596
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
tormath1 added a commit to flatcar-archive/coreos-overlay that referenced this issue Jan 14, 2022
@tormath1
sys-apps/policycoreutils: fix policy root path
8177112 
root needs to be specified with -p instead of -S.
The policy dir (-S) defaults to (-p) + /var/lib/selinux/ + (-s).

Picked from upstream: gentoo/gentoo@54a8322

Closes: flatcar/Flatcar#596
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
pothos pushed a commit to flatcar-archive/coreos-overlay that referenced this issue Jan 25, 2022
@tormath1 @pothos
sys-apps/policycoreutils: fix policy root path
5c8fabc 
root needs to be specified with -p instead of -S.
The policy dir (-S) defaults to (-p) + /var/lib/selinux/ + (-s).

Picked from upstream: gentoo/gentoo@54a8322

Closes: flatcar/Flatcar#596
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
pothos pushed a commit to flatcar-archive/coreos-overlay that referenced this issue Jan 25, 2022
@tormath1 @pothos
sys-apps/policycoreutils: fix policy root path
29b6bdb 
root needs to be specified with -p instead of -S.
The policy dir (-S) defaults to (-p) + /var/lib/selinux/ + (-s).

Picked from upstream: gentoo/gentoo@54a8322

Closes: flatcar/Flatcar#596
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
@pothos pothos changed the title Alpha 3115: leaks selinux policy store files to the image root directory Leaked selinux policy store files to the image root directory Jan 25, 2022
@pothos
Copy link
Member Author

pothos commented Jan 25, 2022

Also newest Stable and Beta got affected but the fix is merged already and will be part of the following releases

t-lo pushed a commit to flatcar/scripts that referenced this issue Apr 13, 2023
@tormath1 @pothos
sys-apps/policycoreutils: fix policy root path
2ec3399 
root needs to be specified with -p instead of -S.
The policy dir (-S) defaults to (-p) + /var/lib/selinux/ + (-s).

Picked from upstream: gentoo/gentoo@54a8322

Closes: flatcar/Flatcar#596
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

sys-apps/policycoreutils: fix policy root path flatcar-archive/coreos-overlay
2 participants
@pothos @tormath1