Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support SELinux labels for built packages #3448

Closed
wants to merge 6 commits into from

Conversation

aparcar
Copy link
Member

@aparcar aparcar commented Sep 22, 2020

This PR touches various bits, ultimately allowing to have SELinux file contexts in packages if CONFIG_ROOTFS_SECURITY_LABELS is enabled.

@aparcar
Copy link
Member Author

aparcar commented Sep 22, 2020

@flyn-org @tpetazzoni please test this PR if you have the time.

@aparcar aparcar marked this pull request as ready for review Sep 22, 2020
@dhewg
Copy link
Contributor

dhewg commented Sep 22, 2020

tar needs a PKG_CONFIG_DEPENDS:=CONFIG_TARGET_ROOTFS_SECURITY_LABELS, so that it gets rebuild if one flips the switch

@flyn-org
Copy link
Contributor

flyn-org commented Sep 22, 2020

My initial attempt to build caused the following. Perhaps something is building out-of-order?

install -d -m0755 /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/bin/targets/x86/64/packages
/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/host/bin/fakeroot -l /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/host/lib/libfakeroot.so -f /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/host/bin/faked /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/scripts/ipkg-build -m "" -c "/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/hostpkg/etc/selinux/targeted/contexts/files/file_contexts" /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/build_dir/target-x86_64_musl/toolchain/ipkg-x86_64/libgcc /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/bin/targets/x86/64/packages
/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/hostpkg/etc/selinux/targeted/contexts/files/file_contexts: No such file or directory
make[3]: *** [Makefile:764: /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/bin/targets/x86/64/packages/libgcc1_8.4.0-2_x86_64.ipk] Error 255
make[3]: Leaving directory '/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/package/libs/toolchain'
time: package/libs/toolchain/compile#0.13#0.16#0.28
make[2]: *** [package/Makefile:113: package/libs/toolchain/compile] Error 2
make[2]: Leaving directory '/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux'
make[1]: *** [package/Makefile:107: /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/target-x86_64_musl/stamp/.package_compile] Error 2
make[1]: Leaving directory '/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux'
make: *** [/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/include/toplevel.mk:232: world] Error 2

@aparcar
Copy link
Member Author

aparcar commented Sep 22, 2020

@flyn-org thanks for testing! Please rebuild package/system/opkg, it should have a dependency on refpolicy/host.

@flyn-org
Copy link
Contributor

flyn-org commented Sep 22, 2020

@aparcar, sure. I am doing a from-scratch build now.

@flyn-org
Copy link
Contributor

flyn-org commented Sep 22, 2020

I received the same error when trying a from-scratch build. I have the following enabled:

CONFIG_DEFAULT_opkg=y
CONFIG_TARGET_ROOTFS_SECURITY_LABELS=y
CONFIG_PACKAGE_refpolicy=y

Is "CONFIG_ROOTFS_SECURITY_LABELS" in package/system/opkg/Makefile a typo? Should it be "CONFIG_TARGET_ROOTFS_SECURITY_LABELS?" At any rate, removing "ifdef CONFIG_TARGET_ROOTFS_SECURITY_LABELS" and its companion "endif" seems to allow things to proceed.

Later, the compile fails with

WARNING: Policy version mismatch!  Is your OUTPUT_POLICY set correctly?

env LD_LIBRARY_PATH="/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/hostpkg/lib:/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/hostpkg/usr/lib" /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/hostpkg/bin/checkpolicy -U deny policy.conf -o policy.
env: '/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/hostpkg/bin/checkpolicy': No such file or directory
make[4]: *** [Rules.monolithic:71: policy.] Error 127
make[4]: Leaving directory '/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/build_dir/hostpkg/refpolicy-2.20200229'
make[3]: *** [Makefile:97: /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/build_dir/hostpkg/refpolicy-2.20200229/.built] Error 2
make[3]: Leaving directory '/home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/package/system/refpolicy'

I manually selected the checkpolicy package, but running make V=99 package/checkpolicy/compile failed with the /home/mike/Source/aq/aquinas/aquinas-projects/selinux/openwrt-selinux/staging_dir/hostpkg/etc/selinux/targeted/contexts/files/file_contexts: No such file or directory error.

Is there some kind of circular dependency here?

@aparcar
Copy link
Member Author

aparcar commented Sep 22, 2020

Good catch, that's a typo! I'll look into the error you're facing.

@aparcar
Copy link
Member Author

aparcar commented Sep 24, 2020

@nbd168 Hey could you please help me out with some build system insights? I'm having a bit of a bootstrapping problem here: By giving ipkg-build the ability to set SELinux labels the file_contexts, generated by the refpolicy packge needs to exists. Now how can I disable the context setting (8c9839b) if it's a host package, but enable it for all regular packages?

aparcar added 6 commits Sep 24, 2020
The refpolicy is required to set SELinux file contexts. It has to be
build before any target packet is created.

Signed-off-by: Paul Spooren <mail@aparcar.org>
To support SELinux file contexts the host package refpolicy is required
before building `opkg` packages. This dependency is only added if
`CONFIG_ROOTFS_SECURITY_LABELS` is enabled.

Signed-off-by: Paul Spooren <mail@aparcar.org>
To support SELinux labels for built packages `tar` requires support for
both SELinux labels and xattrs. This commit enables both in case
`CONFIG_TARGET_ROOTFS_SECURITY_LABELS` is set, which also adds SELinux
labeling to the created squashfs.

Signed-off-by: Paul Spooren <mail@aparcar.org>
The new option `-c` allows to set the path to a SELinux file contexts
list, which is then applied to the contests of the package directory.

Signed-off-by: Paul Spooren <mail@aparcar.org>
When the option `CONFIG_ROOTFS_SECURITY_LABELS` is active the new option
`-c` is passed to the `ipkg-build` script to set SELinux file contexts.

Signed-off-by: Paul Spooren <mail@aparcar.org>
Signed-off-by: Paul Spooren <mail@aparcar.org>
@adschm adschm added build/scripts/tools pull request/issues for build, scripts and tools related changes core packages pull request/issue for core (in-tree) packages labels Sep 25, 2020
@aparcar
Copy link
Member Author

aparcar commented Sep 29, 2020

The policy must be available on the device and can not be freely extended via externally installed packages, for that reason we decided against package labelling. Instead the initially filesystem will be labelled during creation and packages are labelled via a post-install package manager step, based on the policy available at runtime.

@flyn-org
Copy link
Contributor

flyn-org commented Oct 8, 2020

See also #3472 (comment).

@aparcar aparcar deleted the selinux-refpolicy branch Oct 8, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
build/scripts/tools pull request/issues for build, scripts and tools related changes core packages pull request/issue for core (in-tree) packages
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants