TEST-06-SELINUX: Relabel in the initrd rather than at image build time

This gets rid of the requirement to run the image build as root.

diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 5fd1469ba3535d0a31112abb3a93cfb5b30ee0e7..859e50a34ccc8e8ee74e10a1522be4eca9a50f5a 100644 (file)
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -60,7 +60,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-O2 -D_FORTIFY_SOURCE=3"
-            relabel: no
             vm: 1
             no_qemu: 0
             no_kvm: 0
@@ -71,7 +70,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: no
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -82,7 +80,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: no
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -93,7 +90,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: no
             vm: 0
             no_qemu: 1
             no_kvm: 1
@@ -104,7 +100,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: no
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -115,7 +110,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: no
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -126,7 +120,6 @@ jobs:
             sanitizers: address,undefined
             llvm: 1
             cflags: "-Og"
-            relabel: yes
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -137,7 +130,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: yes
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -148,7 +140,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: yes
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -159,7 +150,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: yes
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -170,7 +160,6 @@ jobs:
             sanitizers: ""
             llvm: 0
             cflags: "-Og"
-            relabel: yes
             vm: 0
             no_qemu: 0
             no_kvm: 0
@@ -233,9 +222,6 @@ jobs:
                   LLVM=${{ matrix.llvm }}
                   SYSEXT=1
 
-          [Content]
-          SELinuxRelabel=${{ matrix.relabel }}
-
           [Runtime]
           RAM=4G
           EOF

diff --git a/mkosi/mkosi.conf b/mkosi/mkosi.conf
index 22547a5a1f948d479d59f274df89e0ceca5c8b27..2fc087cb73f4092011da32c76add90ae920d73d3 100644 (file)
--- a/mkosi/mkosi.conf
+++ b/mkosi/mkosi.conf
@@ -59,8 +59,7 @@ ExtraTrees=
 
 KernelInitrdModules=default
 
-# Disable relabeling by default as it only matters for TEST-06-SELINUX, takes a non-trivial amount of time
-# and results in lots of errors when building images as a regular user.
+# Disable relabeling by default as TEST-06-SELINUX handles relabeling itself at runtime.
 SELinuxRelabel=no
 
 # Adding more kernel command line arguments is likely to hit the kernel command line limit (512 bytes) in

diff --git a/mkosi/mkosi.extra.common/usr/lib/systemd/system-preset/00-mkosi.preset b/mkosi/mkosi.extra.common/usr/lib/systemd/system-preset/00-mkosi.preset
index d7774e03f64d5d6911754280ab91b7db987e1a28..4423c3dabd7c244720ab1589922cfe3a19361a7b 100644 (file)
--- a/mkosi/mkosi.extra.common/usr/lib/systemd/system-preset/00-mkosi.preset
+++ b/mkosi/mkosi.extra.common/usr/lib/systemd/system-preset/00-mkosi.preset
@@ -46,7 +46,7 @@ disable fstrim.timer
 disable raid-check.timer
 disable systemd-tmpfiles-clean.timer
 
-# mkosi relabels the image itself so no need to do it on boot.
+# TEST-06-SELINUX handles relabeling itself at runtime.
 disable selinux-autorelabel-mark.service
 
 enable coverage-forwarder.service

diff --git a/mkosi/mkosi.initrd.conf/mkosi.conf.d/centos-fedora.conf b/mkosi/mkosi.initrd.conf/mkosi.conf.d/centos-fedora.conf
index 2077f0662f899084f20e5d12eb8b9ab6ac7c377f..e753749dc443f31483d4975c583f8bc9661e4e52 100644 (file)
--- a/mkosi/mkosi.initrd.conf/mkosi.conf.d/centos-fedora.conf
+++ b/mkosi/mkosi.initrd.conf/mkosi.conf.d/centos-fedora.conf
@@ -8,6 +8,7 @@ Distribution=|fedora
 PrepareScripts=%D/mkosi/mkosi.conf.d/centos-fedora/systemd.prepare
 Packages=
         coreutils
+        policycoreutils
         swtpm-tools
         tpm2-tools
 

diff --git a/mkosi/mkosi.initrd.conf/mkosi.conf.d/opensuse.conf b/mkosi/mkosi.initrd.conf/mkosi.conf.d/opensuse.conf
index 92fc255670fa6554e8951302202b4972dc28d91b..c30d970c85a2bdb21dbb4a57ca8e9ab8423a15b8 100644 (file)
--- a/mkosi/mkosi.initrd.conf/mkosi.conf.d/opensuse.conf
+++ b/mkosi/mkosi.initrd.conf/mkosi.conf.d/opensuse.conf
@@ -9,6 +9,7 @@ Packages=
         btrfs-progs
         coreutils
         kmod
+        policycoreutils
         tpm2.0-tools
 
 VolatilePackages=

diff --git a/mkosi/mkosi.initrd.conf/mkosi.extra/usr/lib/systemd/system/initrd-selinux-relabel.service b/mkosi/mkosi.initrd.conf/mkosi.extra/usr/lib/systemd/system/initrd-selinux-relabel.service
new file mode 100644 (file)
index 0000000..077b369
--- /dev/null
+++ b/mkosi/mkosi.initrd.conf/mkosi.extra/usr/lib/systemd/system/initrd-selinux-relabel.service
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+[Unit]
+Description=Relabel /sysroot for SELinux
+
+DefaultDependencies=no
+ConditionPathExists=/sysroot/etc/selinux/config
+After=initrd-root-fs.target
+After=initrd.target initrd-parse-etc.service remote-fs.target
+Before=initrd-cleanup.service
+
+[Service]
+Type=oneshot
+ExecStart=sh -c '. /sysroot/etc/selinux/config && [ -n "$${SELINUXTYPE}" ] && setfiles -mFr /sysroot -T0 -c /sysroot/etc/selinux/$${SELINUXTYPE}/policy/policy.* /sysroot/etc/selinux/$${SELINUXTYPE}/contexts/files/file_contexts /sysroot'

diff --git a/test/integration-tests/TEST-06-SELINUX/meson.build b/test/integration-tests/TEST-06-SELINUX/meson.build
index 22f306260dbc23e49ac69945fb29f649a66638b9..8dca509b8296441e34e2092c4163699af51b2610 100644 (file)
--- a/test/integration-tests/TEST-06-SELINUX/meson.build
+++ b/test/integration-tests/TEST-06-SELINUX/meson.build
@@ -1,19 +1,20 @@
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
-id = find_program('id', required : true)
-uid = run_command(id, '-u', check : true).stdout().strip().to_int()
-
 integration_tests += [
         integration_test_template + {
                 'name' : fs.name(meson.current_source_dir()),
-                'cmdline' : integration_test_template['cmdline'] + ['selinux=1', 'enforcing=0', 'lsm=selinux'],
+                'cmdline' : integration_test_template['cmdline'] + [
+                        'selinux=1',
+                        'enforcing=0',
+                        'lsm=selinux',
+                        'rd.systemd.wants=initrd-selinux-relabel.service',
+                ],
                 # FIXME; Figure out why reboot sometimes hangs with 'linux' firmware.
                 # Use 'auto' to automatically fallback on non-uefi architectures.
                 'firmware' : 'auto',
                 'vm' : true,
-                # Make sure we don't mount anything with virtiofs as otherwise fixfiles will try to relabel
+                # Make sure we don't mount anything with virtiofs as otherwise setfiles will try to relabel
                 # it.
                 'mkosi-args' : integration_test_template['mkosi-args'] + ['--runtime-build-sources=no'],
-                'enabled' : uid == 0,
         },
 ]