From dc709b8dc749fc63640214d3907b4c4cce3641c9 Mon Sep 17 00:00:00 2001
From: Jonathan Lebon <jonathan@jlebon.com>
Date: Wed, 2 Nov 2022 12:19:09 -0400
Subject: [PATCH] libpriv/postprocess: work around semanage bug

There is a bug in the latest semanage code which causes an invocation of
`semodule --rebuild-if-modules-changed` to still write a policy even
though nothing changed since a full policy build. On FCOS and RHCOS,
this bug is triggered as early as `ostree admin deploy` in cosa when
creating the disk images. This results in shipping images with a policy
diff baked in.

Hack around this by immediately rerunning
`semodule --rebuild-if-modules-changed` after building the policy.

Fixes: https://github.com/openshift/os/issues/1036
(cherry picked from commit 479050e7540dc90de9ec6f49960b98e095537224)
---
 src/libpriv/rpmostree-postprocess.cxx | 20 +++++++++++++++-----
 tests/kolainst/nondestructive/misc.sh |  5 +++++
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/libpriv/rpmostree-postprocess.cxx b/src/libpriv/rpmostree-postprocess.cxx
index 89738509ef..f193915cc7 100644
--- a/src/libpriv/rpmostree-postprocess.cxx
+++ b/src/libpriv/rpmostree-postprocess.cxx
@@ -387,11 +387,21 @@ postprocess_final (int rootfs_dfd, rpmostreecxx::Treefile &treefile, gboolean un
     {
       g_print ("Recompiling policy\n");
 
-      /* Now regenerate SELinux policy so that postprocess scripts from users and from us
-       * (e.g. the /etc/default/useradd incision) that affect it are baked in. */
-      rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-nB") };
-      ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
-                  error);
+      {
+        /* Now regenerate SELinux policy so that postprocess scripts from users and from us
+         * (e.g. the /etc/default/useradd incision) that affect it are baked in. */
+        rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-nB") };
+        ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
+                    error);
+      }
+
+      /* Temporary workaround for https://github.com/openshift/os/issues/1036. */
+      {
+        rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-n"),
+                                 rust::String ("--rebuild-if-modules-changed") };
+        ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
+                    error);
+      }
     }
 
   auto container = treefile.get_container ();
diff --git a/tests/kolainst/nondestructive/misc.sh b/tests/kolainst/nondestructive/misc.sh
index 4b095d4496..d89912f12e 100755
--- a/tests/kolainst/nondestructive/misc.sh
+++ b/tests/kolainst/nondestructive/misc.sh
@@ -4,6 +4,11 @@ set -xeuo pipefail
 . ${KOLA_EXT_DATA}/libtest.sh
 cd $(mktemp -d)
 
+# Sanity-check the policy isn't marked as modified
+if ostree admin config-diff | grep 'selinux/targeted/policy'; then
+    assert_not_reached "selinux policy is marked as modified"
+fi
+
 # Ensure multicall is correctly set up and working.
 R_O_DIGEST=$(sha512sum $(which rpm-ostree) | cut -d' ' -f1)
 O_C_DIGEST=$(sha512sum $(which /usr/libexec/libostree/ext/ostree-container) | cut -d' ' -f1)