Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

libpriv/postprocess: work around semanage bug #4122

Merged
merged 1 commit into from
Nov 2, 2022
Merged

libpriv/postprocess: work around semanage bug #4122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 15 additions & 5 deletions src/libpriv/rpmostree-postprocess.cxx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,11 +387,21 @@ postprocess_final (int rootfs_dfd, rpmostreecxx::Treefile &treefile, gboolean un
{
g_print ("Recompiling policy\n");

/* Now regenerate SELinux policy so that postprocess scripts from users and from us
* (e.g. the /etc/default/useradd incision) that affect it are baked in. */
rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-nB") };
ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
error);
{
/* Now regenerate SELinux policy so that postprocess scripts from users and from us
* (e.g. the /etc/default/useradd incision) that affect it are baked in. */
rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-nB") };
ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
error);
}

/* Temporary workaround for https://github.com/openshift/os/issues/1036. */
{
rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-n"),
rust::String ("--rebuild-if-modules-changed") };
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason I went with --rebuild-if-modules-changed here instead of the newer --refresh is that the latter is not in f36 and while f36 isn't affected by this bug, I'd like this patch in place ahead of time.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, I didn't add a feature check here for --rebuild-if-modules-changed. I think all the userspaces we care about for the main branch have that patch now.

@cgwalters I think we'll need to backport this to the rhel8 branch, right?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh blah. So we have newer semodule in rhel8 versus f36?? 😢

@cgwalters I think we'll need to backport this to the rhel8 branch, right?

Yeah

ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
error);
}
}

auto container = treefile.get_container ();
Expand Down
5 changes: 5 additions & 0 deletions tests/kolainst/nondestructive/misc.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@ cd $(mktemp -d)
libtest_prepare_offline
libtest_enable_repover 0

# Sanity-check the policy isn't marked as modified
if ostree admin config-diff | grep 'selinux/targeted/policy'; then
assert_not_reached "selinux policy is marked as modified"
fi

# Ensure multicall is correctly set up and working.
R_O_DIGEST=$(sha512sum $(which rpm-ostree) | cut -d' ' -f1)
O_C_DIGEST=$(sha512sum $(which /usr/libexec/libostree/ext/ostree-container) | cut -d' ' -f1)
Expand Down