Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Packages to support the SELinux security mechanism #10664

Merged
merged 7 commits into from Sep 12, 2020

Conversation

tpetazzoni
Copy link
Contributor

@tpetazzoni tpetazzoni commented Nov 28, 2019

This patch series integrates a number of additional user-space packages for the various components that are needed to have SELinux support in OpenWrt. It has been sent on the OpenWrt mailing list already, together with another patch series for the core OpenWrt, with other related SELinux changes. But those packages are what is needed first to bring SELinux support in OpenWrt.

@jefferyto
Copy link
Member

@jefferyto jefferyto commented Nov 28, 2019

I haven't reviewed these in detail, but we're not accepting Python 2 packages anymore (please see the Python packages readme). I suggest compiling/packaging for Python 3.

@neheb
Copy link
Contributor

@neheb neheb commented Nov 28, 2019

That audit package is emitting the sync instruction for some reason. Needs to be disabled for MIPS16.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Jul 12, 2020

The conflict with libs/libcap-ng/Makefile resulted from Lucian Cristian independently packaging libcap-ng after Thomas Petazzoni published his work. I have since resolved this at https://github.com/flyn-org/packages/tree/selinux. I am very interested in seeing SELinux in OpenWrt, and I plan to experiment with Thomas' work this week.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Jul 12, 2020

@tpetazzoni, could you take a look at the work I pushed to https://github.com/flyn-org/packages/tree/selinux? I bumped some versions, and I modified things to use Python 3. See also http://lists.openwrt.org/pipermail/openwrt-devel/2020-July/030084.html.

I presently have two problems:

  1. The build prompts me for some kernel options, because the kernel configuration is out of date.
  2. Busybox does not build with SELinux support:
make  -C /home/mike/Scratch/openwrt/build_dir/target-x86_64_musl/busybox-1.31.1/.
[...]
make[4]: Entering directory '/home/mike/Scratch/openwrt/build_dir/target-x86_64_musl/busybox-1.31.1'
  CC      applets/applets.o
In file included from /usr/include/bits/local_lim.h:38,
                 from /usr/include/bits/posix1_lim.h:161,
                 from /usr/include/limits.h:183,
                 from include/platform.h:153,
                 from include/libbb.h:13,
                 from include/busybox.h:8,
                 from applets/applets.c:9:
/usr/include/linux/limits.h:7: warning: "NGROUPS_MAX" redefined
 #define NGROUPS_MAX    65536 /* supplemental group IDs are available */
[...]
make[5]: *** [scripts/Makefile.build:198: applets/applets.o] Error 1
make[4]: *** [Makefile:372: applets_dir] Error 2
make[4]: Leaving directory '/home/mike/Scratch/openwrt/build_dir/target-x86_64_musl/busybox-1.31.1'
make[3]: *** [Makefile:134: /home/mike/Scratch/openwrt/build_dir/target-x86_64_musl/busybox-1.31.1/.built] Error 2
make[3]: Leaving directory '/home/mike/Scratch/openwrt/package/utils/busybox'
time: package/utils/busybox/compile#0.96#0.64#3.25
make[2]: *** [package/Makefile:113: package/utils/busybox/compile] Error 2
make[2]: Leaving directory '/home/mike/Scratch/openwrt'
make[1]: *** [package/Makefile:107: /home/mike/Scratch/openwrt/staging_dir/target-x86_64_musl/stamp/.package_compile] Error 2
make[1]: Leaving directory '/home/mike/Scratch/openwrt'
make: *** [/home/mike/Scratch/openwrt/include/toplevel.mk:235: world] Error 2

@tpetazzoni
Copy link
Contributor Author

@tpetazzoni tpetazzoni commented Jul 12, 2020

Gah, I was on the openwrt-devel, but somehow got unsubscribed on June 20, so I did not receive your e-mail. Could you Cc me in the future for SELinux related topics ?

Regarding the kernel configuration: I find OpenWRT kernel configuration logic to be very annoying to not run "make olddefconfig" to automatically accept default values of unspecified options. Due to this, any subtle change of the kernel configuration/version might make more options visible, and therefore will require their values to be specified in OpenWRT's kernel configuration file.

Regarding the Busybox build issue: there are includes of files in /usr/include from your build machine, this doesn't look good. So it seems like the fact of enabling SELinux support has made it pickup host headers.

In any case, I'm glad someone is picking this up. I tried to push dm-verity support (for secure boot) and SELinux in OpenWRT, and got very little feedback even though it's been almost a year. It was not very encouraging to push things further I must admit.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Jul 13, 2020

The busybox problem seems related to the following block in busybox-1.31.1/Makefile.flags:

ifeq ($(CONFIG_SELINUX),y)
SELINUX_PC_MODULES = libselinux libsepol
$(eval $(call pkg_check_modules,SELINUX,$(SELINUX_PC_MODULES)))
CPPFLAGS += $(SELINUX_CFLAGS)
LDLIBS += $(if $(SELINUX_LIBS),$(SELINUX_LIBS:-l%=%),$(SELINUX_PC_MODULES:lib%=%))
endif

Something sets SELINUX_CFLAGS to include -I/usr/include, but I do not yet know what. Removing the CPPFLAGS += $(SELINUX_CFLAGS) line after the fact allows the next build to proceed.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Jul 13, 2020

@jefferyto, is my branch at https://github.com/flyn-org/packages/tree/selinux okay with respect to Python 3? As far as I can tell, I have replaced the use of Python 2.

@neheb, is the build of audit still emitting the sync instruction?

I plan to clean the sequence of commits for merge once things settle down.

@neheb
Copy link
Contributor

@neheb neheb commented Jul 13, 2020

I believe so.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Jul 13, 2020

@tpetazzoni, would you be willing to add me as a "collaborator" to this repository? That would allow me to re-blend my work here in a clean way and thus avoid another merge request.

Also, did you ever establish a merge-request style proposal for your core OpenWrt changes through GitHub? My understanding is that you went solely with the mailing-list messages, as the core developers seem to rely on that more than GitHub. I have prepared to push the core stuff to GitHub, but I wanted to avoid duplicating work in the case you have already done that. This is taking a long time, so the record keeping of GitHub might serve us well, even if ultimately the proposal flows through the mailing list.

@tpetazzoni
Copy link
Contributor Author

@tpetazzoni tpetazzoni commented Jul 14, 2020

@flyn-org I've added you as a collaborator.

Regarding the core OpenWrt changes, I did not open a pull request in Github, and only submitted on the mailing list. The contribution process was not clear for me: it seemed like e-mails on the mailing list was preferred, which is what I did, but then just for the openwrt-packages part, I was asked to open a pull request, which I did.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Jul 14, 2020

I updated this repository to base itself on the latest upstream master, and I added my further work here.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Jul 15, 2020

Regarding the core OpenWrt changes, I did not open a pull request in Github, and only submitted on the mailing list. The contribution process was not clear for me: it seemed like e-mails on the mailing list was preferred, which is what I did, but then just for the openwrt-packages part, I was asked to open a pull request, which I did.

I started a merge request at openwrt/openwrt#3207. My hope is this will be a better basis for revisions, even if we ultimately submit patches using the mailing list.

@tpetazzoni, I added you as a collaborator on the source repository for the merge request, https://github.com/flyn-org/openwrt.

libs/pcre/Makefile Outdated Show resolved Hide resolved
@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Jul 17, 2020

@tpetazzoni, did you have a reason for the use of --with-match-limit-recursion?

@aparcar
Copy link
Member

@aparcar aparcar commented Jul 30, 2020

Currently refpolicy fails on me:

rm -f /home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229/.configured_*
rm -f /home/user/src/openwrt/openwrt/staging_dir/target-x86_64_musl/stamp/.refpolicy_installed
/home/user/src/openwrt/openwrt/staging_dir/host/bin/sed -i -e "/MONOLITHIC/c\MONOLITHIC = y" /home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229/build.conf
/home/user/src/openwrt/openwrt/staging_dir/host/bin/sed -i -e "/NAME/c\NAME = targeted" /home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229/build.conf
CFLAGS="-Os -pipe -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -ffile-prefix-map=/home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229=refpolicy-2.20200229 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro  -I/home/user/src/openwrt/openwrt/staging_dir/target-x86_64_musl/usr/include -I/home/user/src/openwrt/openwrt/staging_dir/toolchain-x86_64_gcc-9.3.0_musl/usr/include -I/home/user/src/openwrt/openwrt/staging_dir/toolchain-x86_64_gcc-9.3.0_musl/include/fortify -I/home/user/src/openwrt/openwrt/staging_dir/toolchain-x86_64_gcc-9.3.0_musl/include " CXXFLAGS="-Os -pipe -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -ffile-prefix-map=/home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229=refpolicy-2.20200229 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro  -I/home/user/src/openwrt/openwrt/staging_dir/target-x86_64_musl/usr/include -I/home/user/src/openwrt/openwrt/staging_dir/toolchain-x86_64_gcc-9.3.0_musl/usr/include -I/home/user/src/openwrt/openwrt/staging_dir/toolchain-x86_64_gcc-9.3.0_musl/include/fortify -I/home/user/src/openwrt/openwrt/staging_dir/toolchain-x86_64_gcc-9.3.0_musl/include " LDFLAGS="-L/home/user/src/openwrt/openwrt/staging_dir/target-x86_64_musl/usr/lib -L/home/user/src/openwrt/openwrt/staging_dir/target-x86_64_musl/lib -L/home/user/src/openwrt/openwrt/staging_dir/toolchain-x86_64_gcc-9.3.0_musl/usr/lib -L/home/user/src/openwrt/openwrt/staging_dir/toolchain-x86_64_gcc-9.3.0_musl/lib -znow -zrelro " make -j1 -C /home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229/. AR="x86_64-openwrt-linux-musl-gcc-ar" AS="ccache_cc -c -Os -pipe -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -ffile-prefix-map=/home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229=refpolicy-2.20200229 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro" LD=x86_64-openwrt-linux-musl-ld NM="x86_64-openwrt-linux-musl-gcc-nm" CC="ccache_cc" GCC="ccache_cc" CXX="ccache_cxx" RANLIB="x86_64-openwrt-linux-musl-gcc-ranlib" STRIP=x86_64-openwrt-linux-musl-strip OBJCOPY=x86_64-openwrt-linux-musl-objcopy OBJDUMP=x86_64-openwrt-linux-musl-objdump SIZE=x86_64-openwrt-linux-musl-size CROSS="x86_64-openwrt-linux-musl-" ARCH="x86_64" TEST_TOOLCHAIN=/home/user/src/openwrt/openwrt/staging_dir/hostpkg BINDIR=/bin SBINDIR=/sbin CC=ccache gcc CFLAGS=-O2 -I/home/user/src/openwrt/openwrt/staging_dir/host/include -I/home/user/src/openwrt/openwrt/staging_dir/hostpkg/include -I/home/user/src/openwrt/openwrt/staging_dir/target-x86_64_musl/host/include conf;
make[4]: Entering directory '/home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229'
make[4]: *** No rule to make target 'gcc'.  Stop.
make[4]: Leaving directory '/home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229'
make[3]: *** [Makefile:84: /home/user/src/openwrt/openwrt/build_dir/target-x86_64_musl/refpolicy-2.20200229/.configured_68b329da9893e34099c7d8ad5cb9c940] Error 2
make[3]: Leaving directory '/home/user/src/openwrt/packages/admin/refpolicy'
time: package/feeds/packages/refpolicy/compile#0.11#0.01#0.12
make[2]: *** [package/Makefile:113: package/feeds/packages/refpolicy/compile] Error 2
make[2]: Leaving directory '/home/user/src/openwrt/openwrt'
make[1]: *** [package/Makefile:107: /home/user/src/openwrt/openwrt/staging_dir/target-x86_64_musl/stamp/.package_compile] Error 2
make[1]: Leaving directory '/home/user/src/openwrt/openwrt'
make: *** [/home/user/src/openwrt/openwrt/include/toplevel.mk:235: world] Error 2

@aparcar
Copy link
Member

@aparcar aparcar commented Jul 30, 2020

Also I had to install gettext on the host system

admin/refpolicy/Makefile Outdated Show resolved Hide resolved
utils/audit/Makefile Show resolved Hide resolved
@aparcar
Copy link
Member

@aparcar aparcar commented Jul 31, 2020

Running semanage fails:

root@OpenWrt:~# semanage
Traceback (most recent call last):
  File "/usr/sbin/semanage", line 28, in <module>
    import seobject
  File "/usr/lib/python3.8/site-packages/seobject.py", line 31, in <module>
    from semanage import *
ModuleNotFoundError: No module named 'semanage'

@aparcar
Copy link
Member

@aparcar aparcar commented Aug 1, 2020

How do you plan to organize policies? Do you plan to add them as selectable packages?

utils/audit/Makefile Outdated Show resolved Hide resolved
@aparcar
Copy link
Member

@aparcar aparcar commented Aug 3, 2020

How do you plan to organize policies? Do you plan to add them as selectable packages?

@flyn-org @tpetazzoni Do you have an idea for this? Would we just add meta packages similar to LuCI translation which contain the policies? Which would be your first secured application?

@tpetazzoni
Copy link
Contributor Author

@tpetazzoni tpetazzoni commented Aug 3, 2020

How do you plan to organize policies? Do you plan to add them as selectable packages?

@flyn-org @tpetazzoni Do you have an idea for this? Would we just add meta packages similar to LuCI translation which contain the policies? Which would be your first secured application?

As a first step, I suggest to just support the refpolicy, and have it up to users of the SELinux support in OpenWrt to tweak the refpolicy to their needs. As a second step, one could image reducing the refpolicy to just its base modules, and have the additional modules enabled depending on the OpenWrt packages that are enabled. This is something that is now being implemented in the Buildroot project: https://patchwork.ozlabs.org/project/buildroot/list/?series=193483

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Aug 7, 2020

@aparcar, regarding the semanage failure, semanage requires setools, but setools requires cython to build. I do not think OpenWrt provides cython. I have an setools package patched to build without cython, but the cython portion is required by semanage.

Has anyone ever proposed a cython host package for OpenWrt?

I agree with @tpetazzoni on the policy work. I suspect early adopters would be happy to tweak the reference policy. I would do this myself in the beginning, and then I plan to slowly package my work for others to use. If it is okay, I would like to merge this and the work at openwrt/openwrt#3207 first, and then work on policy over a period of time.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Aug 7, 2020

Latest commits fix a few things and add a semodule-utils package.

Copy link
Member

@pprindeville pprindeville left a comment

Minor comments...


define Build/Configure
$(SED) "/MONOLITHIC/c\MONOLITHIC = y" $(PKG_BUILD_DIR)/build.conf
$(SED) "/NAME/c\NAME = targeted" $(PKG_BUILD_DIR)/build.conf
Copy link
Member

@pprindeville pprindeville Aug 10, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any reason we can't use multiple -e invocations on a single sed process?

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Sep 5, 2020

@aparcar and @jefferyto, things should be ready to look at again.

@aparcar
Copy link
Member

@aparcar aparcar commented Sep 5, 2020

@flyn-org please rebase this PR to make use of the newly added CI :)

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Sep 5, 2020

@aparcar, running CI now.

Copy link
Member

@jefferyto jefferyto left a comment

LGTM - thanks!

SECTION:=lang
CATEGORY:=Languages
SUBMENU:=Python
TITLE:=Python package for creating and manipulating graphs and networks
Copy link
Member

@jefferyto jefferyto Sep 7, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
TITLE:=Python package for creating and manipulating graphs and networks
TITLE:=Creating and manipulating graphs and networks

Not a big issue, but the title is probably a bit too long for menuconfig.

Copy link
Member

@aparcar aparcar Sep 7, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Time to switch to nconfig :)

Copy link
Contributor

@flyn-org flyn-org Sep 7, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed.

Copy link
Contributor

@flyn-org flyn-org Sep 7, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aparcar, CI is failing after this superficial change. Is the CI system okay?

@ghost
Copy link

@ghost ghost commented Sep 7, 2020

@aparcar
Copy link
Member

@aparcar aparcar commented Sep 7, 2020

It would be really nice if someome would write (or point to) detailed build
instructions on either a wiki page and/or blog post.

Sorry that's on my todo list, I'll try to write something useful up tomorrow!

tpetazzoni and others added 7 commits Sep 7, 2020
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[strip library after adding it to openwrt repository]
Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[strip C library after adding it to openwrt repository]]
Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[strip C library after adding it to openwrt repository]
Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[update to 3.1, make use of Python 3, and update dependencies]
Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: W. Michael Petullo <mike@flyn.org>
@aparcar
Copy link
Member

@aparcar aparcar commented Sep 11, 2020

I wrote a short blog post on how to enable SELinux in it's current state:
https://aparcar.gitlab.io/running-openwrt-with-selinux/

@aparcar
Copy link
Member

@aparcar aparcar commented Sep 12, 2020

I rebased the PR running the CI in my fork and everything compiles fine except powerpc_8540. I'd be okay with merging this and accept that it doesn't work on that single architecture.

ERROR: module '/home/build/openwrt/build_dir/target-powerpc_8540_musl/linux-mpc85xx_generic/linux-5.4.41/drivers/ptp/ptp_qoriq.o' is missing.

@aparcar
Copy link
Member

@aparcar aparcar commented Sep 12, 2020

So for powerpc_8540 fails which doesn't seem to be related to this PR. Merging.

2020-09-11T23:55:19.0288279Z make[1]: *** [package/Makefile:113: package/linux/compile] Error 2

@aparcar aparcar merged commit 5ac1baf into openwrt:master Sep 12, 2020
2 of 12 checks passed
@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Sep 12, 2020

@aparcar, @jefferyto, @tpetazzoni, @dangowrt, and everyone else: thank you for helping to see this through!

@aparcar
Copy link
Member

@aparcar aparcar commented Sep 12, 2020

The journey is not yet quite over, please stay tuned for further adventures on SELinux

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Sep 12, 2020

@neheb, I should be able to fix the build failure today. I will create a separate merge request.

@flyn-org
Copy link
Contributor

@flyn-org flyn-org commented Sep 12, 2020

@neheb, please see #13367.

@tpetazzoni
Copy link
Contributor Author

@tpetazzoni tpetazzoni commented Sep 23, 2020

@aparcar, @jefferyto, @tpetazzoni, @dangowrt, and everyone else: thank you for helping to see this through!

And thanks a lot to you for finishing the work and pushing it upstream! Really happy to see that this hasn't been just left aside forever.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

9 participants