* [meta-selinux][PATCH] selinux-init: use systemd (re)labelling
@ 2019-08-23 18:19 Mark Asselstine
2019-09-05 17:55 ` Mark Asselstine
0 siblings, 1 reply; 4+ messages in thread
From: Mark Asselstine @ 2019-08-23 18:19 UTC (permalink / raw)
To: yocto, joe_macdonald
Boot loops were being seen when booting with selinux enabled, when the
init system in use is systemd. Once logs were retrieved from the
failing system the error was found to be
selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpuacct: Read-only file system
selinux-init.sh[284]: /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu: Read-only file system
Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code
used by selinux-init.sh is unable to handle this. On top of this the
system is basically presenting two methods of (re)labelling; using the
built in systemd approach via selinux-autorelabel.service *and* the
code we have in selinux-init.sh. This can get confusing especially
given that most online resources will speak to the systemd approach
using selinux-autorelabel.service and /.autorelabel.
These changes leave the current approach in place when sysvinit is the
init system used, but if systemd is being used we make use of it's
internal (re)labelling functionality. Overall the workflow remains the
same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw
during the (re)labelling procedure).
Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
---
.../selinux/selinux-init/selinux-init.sh | 14 +-------------
.../selinux/selinux-init/selinux-init.sh.sysvinit | 14 ++++++++++++++
recipes-security/selinux/selinux-init_0.1.bb | 8 +++++---
recipes-security/selinux/selinux-initsh.inc | 8 ++++++++
4 files changed, 28 insertions(+), 16 deletions(-)
create mode 100644 recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
diff --git a/recipes-security/selinux/selinux-init/selinux-init.sh b/recipes-security/selinux/selinux-init/selinux-init.sh
index ead4f00..f93d231 100644
--- a/recipes-security/selinux/selinux-init/selinux-init.sh
+++ b/recipes-security/selinux/selinux-init/selinux-init.sh
@@ -33,18 +33,6 @@ check_rootfs()
/sbin/shutdown -f -h now
}
-# If first booting, the security context type of init would be
-# "kernel_t", and the whole file system should be relabeled.
-if [ "`${SECON} -t --pid 1`" = "kernel_t" ]; then
- echo "Checking SELinux security contexts:"
- check_rootfs
- echo " * First booting, filesystem will be relabeled..."
- test -x /etc/init.d/auditd && /etc/init.d/auditd start
- ${SETENFORCE} 0
- ${RESTORECON} -RF /
- ${RESTORECON} -F /
- echo " * Relabel done, rebooting the system."
- /sbin/reboot
-fi
+# sysvinit firstboot relabel placeholder HERE
exit 0
diff --git a/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit b/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
new file mode 100644
index 0000000..d4f3f71
--- /dev/null
+++ b/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
@@ -0,0 +1,14 @@
+# Contents will be added to selinux-init.sh to support relabelling with sysvinit
+# If first booting, the security context type of init would be
+# "kernel_t", and the whole file system should be relabeled.
+if [ "`${SECON} -t --pid 1`" = "kernel_t" ]; then
+ echo "Checking SELinux security contexts:"
+ check_rootfs
+ echo " * First booting, filesystem will be relabeled..."
+ test -x /etc/init.d/auditd && /etc/init.d/auditd start
+ ${SETENFORCE} 0
+ ${RESTORECON} -RF /
+ ${RESTORECON} -F /
+ echo " * Relabel done, rebooting the system."
+ /sbin/reboot
+fi
diff --git a/recipes-security/selinux/selinux-init_0.1.bb b/recipes-security/selinux/selinux-init_0.1.bb
index 38b5900..78f571c 100644
--- a/recipes-security/selinux/selinux-init_0.1.bb
+++ b/recipes-security/selinux/selinux-init_0.1.bb
@@ -14,9 +14,11 @@ ${PN}_RDEPENDS = " \
policycoreutils-setfiles \
"
-SRC_URI = "file://${BPN}.sh \
- file://${BPN}.service \
- "
+SRC_URI = " \
+ file://${BPN}.sh \
+ file://${BPN}.sh.sysvinit \
+ file://${BPN}.service \
+"
INITSCRIPT_PARAMS = "start 01 S ."
diff --git a/recipes-security/selinux/selinux-initsh.inc b/recipes-security/selinux/selinux-initsh.inc
index bcdd449..8e31cda 100644
--- a/recipes-security/selinux/selinux-initsh.inc
+++ b/recipes-security/selinux/selinux-initsh.inc
@@ -17,9 +17,15 @@ inherit update-rc.d systemd
SYSTEMD_SERVICE_${PN} = "${SELINUX_SCRIPT_SRC}.service"
+FILES_${PN} += "/.autorelabel"
+
do_install () {
install -d ${D}${sysconfdir}/init.d/
install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
+ # Insert the relabelling code which is only needed with sysvinit
+ sed -i -e '/HERE/r ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh.sysvinit' \
+ -e '/.*HERE$/d' -e '/.*Contents.*sysvinit/d' \
+ ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
install -d ${D}${systemd_unitdir}/system
install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
@@ -27,6 +33,8 @@ do_install () {
if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
install -d ${D}${bindir}
install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
+ sed -i -e '/.*HERE$/d' ${D}${bindir}/${SELINUX_SCRIPT_SRC}.sh
+ echo "# first boot relabelling" > ${D}/.autorelabel
fi
}
--
2.21.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [meta-selinux][PATCH] selinux-init: use systemd (re)labelling
2019-08-23 18:19 [meta-selinux][PATCH] selinux-init: use systemd (re)labelling Mark Asselstine
@ 2019-09-05 17:55 ` Mark Asselstine
2019-09-05 20:02 ` Joe MacDonald
0 siblings, 1 reply; 4+ messages in thread
From: Mark Asselstine @ 2019-09-05 17:55 UTC (permalink / raw)
To: yocto
On Friday, August 23, 2019 2:19:53 P.M. EDT Mark Asselstine wrote:
> Boot loops were being seen when booting with selinux enabled, when the
> init system in use is systemd. Once logs were retrieved from the
> failing system the error was found to be
>
> selinux-init.sh[284]: /sbin/restorecon: Could not set context for
> /sys/fs/cgroup/cpuacct: Read-only file system selinux-init.sh[284]:
> /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu: Read-only
> file system
>
> Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code
> used by selinux-init.sh is unable to handle this. On top of this the
> system is basically presenting two methods of (re)labelling; using the
> built in systemd approach via selinux-autorelabel.service *and* the
> code we have in selinux-init.sh. This can get confusing especially
> given that most online resources will speak to the systemd approach
> using selinux-autorelabel.service and /.autorelabel.
>
> These changes leave the current approach in place when sysvinit is the
> init system used, but if systemd is being used we make use of it's
> internal (re)labelling functionality. Overall the workflow remains the
> same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw
> during the (re)labelling procedure).
>
> Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
> ---
Joe, any thoughts on this change?
MarkA
> .../selinux/selinux-init/selinux-init.sh | 14 +-------------
> .../selinux/selinux-init/selinux-init.sh.sysvinit | 14 ++++++++++++++
> recipes-security/selinux/selinux-init_0.1.bb | 8 +++++---
> recipes-security/selinux/selinux-initsh.inc | 8 ++++++++
> 4 files changed, 28 insertions(+), 16 deletions(-)
> create mode 100644
> recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
>
> diff --git a/recipes-security/selinux/selinux-init/selinux-init.sh
> b/recipes-security/selinux/selinux-init/selinux-init.sh index
> ead4f00..f93d231 100644
> --- a/recipes-security/selinux/selinux-init/selinux-init.sh
> +++ b/recipes-security/selinux/selinux-init/selinux-init.sh
> @@ -33,18 +33,6 @@ check_rootfs()
> /sbin/shutdown -f -h now
> }
>
> -# If first booting, the security context type of init would be
> -# "kernel_t", and the whole file system should be relabeled.
> -if [ "`${SECON} -t --pid 1`" = "kernel_t" ]; then
> - echo "Checking SELinux security contexts:"
> - check_rootfs
> - echo " * First booting, filesystem will be relabeled..."
> - test -x /etc/init.d/auditd && /etc/init.d/auditd start
> - ${SETENFORCE} 0
> - ${RESTORECON} -RF /
> - ${RESTORECON} -F /
> - echo " * Relabel done, rebooting the system."
> - /sbin/reboot
> -fi
> +# sysvinit firstboot relabel placeholder HERE
>
> exit 0
> diff --git a/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
> b/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit new file
> mode 100644
> index 0000000..d4f3f71
> --- /dev/null
> +++ b/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
> @@ -0,0 +1,14 @@
> +# Contents will be added to selinux-init.sh to support relabelling with
> sysvinit +# If first booting, the security context type of init would be
> +# "kernel_t", and the whole file system should be relabeled.
> +if [ "`${SECON} -t --pid 1`" = "kernel_t" ]; then
> + echo "Checking SELinux security contexts:"
> + check_rootfs
> + echo " * First booting, filesystem will be relabeled..."
> + test -x /etc/init.d/auditd && /etc/init.d/auditd start
> + ${SETENFORCE} 0
> + ${RESTORECON} -RF /
> + ${RESTORECON} -F /
> + echo " * Relabel done, rebooting the system."
> + /sbin/reboot
> +fi
> diff --git a/recipes-security/selinux/selinux-init_0.1.bb
> b/recipes-security/selinux/selinux-init_0.1.bb index 38b5900..78f571c
> 100644
> --- a/recipes-security/selinux/selinux-init_0.1.bb
> +++ b/recipes-security/selinux/selinux-init_0.1.bb
> @@ -14,9 +14,11 @@ ${PN}_RDEPENDS = " \
> policycoreutils-setfiles \
> "
>
> -SRC_URI = "file://${BPN}.sh \
> - file://${BPN}.service \
> - "
> +SRC_URI = " \
> + file://${BPN}.sh \
> + file://${BPN}.sh.sysvinit \
> + file://${BPN}.service \
> +"
>
> INITSCRIPT_PARAMS = "start 01 S ."
>
> diff --git a/recipes-security/selinux/selinux-initsh.inc
> b/recipes-security/selinux/selinux-initsh.inc index bcdd449..8e31cda 100644
> --- a/recipes-security/selinux/selinux-initsh.inc
> +++ b/recipes-security/selinux/selinux-initsh.inc
> @@ -17,9 +17,15 @@ inherit update-rc.d systemd
>
> SYSTEMD_SERVICE_${PN} = "${SELINUX_SCRIPT_SRC}.service"
>
> +FILES_${PN} += "/.autorelabel"
> +
> do_install () {
> install -d ${D}${sysconfdir}/init.d/
> install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh
> ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST} + # Insert the relabelling
> code which is only needed with sysvinit + sed -i -e '/HERE/r
> ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh.sysvinit' \ + -e '/.*HERE$/d' -e
> '/.*Contents.*sysvinit/d' \
> + ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
>
> install -d ${D}${systemd_unitdir}/system
> install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service
> ${D}${systemd_unitdir}/system @@ -27,6 +33,8 @@ do_install () {
> if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true',
'false',
> d)}; then install -d ${D}${bindir}
> install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}$
{bindir}
> + sed -i -e '/.*HERE$/d' ${D}${bindir}/$
{SELINUX_SCRIPT_SRC}.sh
> + echo "# first boot relabelling" > ${D}/.autorelabel
> fi
> }
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [meta-selinux][PATCH] selinux-init: use systemd (re)labelling
2019-09-05 17:55 ` Mark Asselstine
@ 2019-09-05 20:02 ` Joe MacDonald
2019-09-06 14:07 ` Mark Asselstine
0 siblings, 1 reply; 4+ messages in thread
From: Joe MacDonald @ 2019-09-05 20:02 UTC (permalink / raw)
To: Mark Asselstine; +Cc: yocto
[Re: [yocto] [meta-selinux][PATCH] selinux-init: use systemd (re)labelling] On 19.09.05 (Thu 13:55) Mark Asselstine wrote:
> On Friday, August 23, 2019 2:19:53 P.M. EDT Mark Asselstine wrote:
> > Boot loops were being seen when booting with selinux enabled, when the
> > init system in use is systemd. Once logs were retrieved from the
> > failing system the error was found to be
> >
> > selinux-init.sh[284]: /sbin/restorecon: Could not set context for
> > /sys/fs/cgroup/cpuacct: Read-only file system selinux-init.sh[284]:
> > /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu: Read-only
> > file system
> >
> > Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code
> > used by selinux-init.sh is unable to handle this. On top of this the
> > system is basically presenting two methods of (re)labelling; using the
> > built in systemd approach via selinux-autorelabel.service *and* the
> > code we have in selinux-init.sh. This can get confusing especially
> > given that most online resources will speak to the systemd approach
> > using selinux-autorelabel.service and /.autorelabel.
> >
> > These changes leave the current approach in place when sysvinit is the
> > init system used, but if systemd is being used we make use of it's
> > internal (re)labelling functionality. Overall the workflow remains the
> > same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw
> > during the (re)labelling procedure).
> >
> > Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
> > ---
>
> Joe, any thoughts on this change?
Not especially, it sounded good to me, seemed to work on a quick test
for my use-case, and I merged it:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/commit/?id=b0d31db104d9a4e94bc1409c2ffcc1d82f4a780f
Is there something else I should've considered? Or did you want it on a
different branch too?
-J.
>
> MarkA
>
> > .../selinux/selinux-init/selinux-init.sh | 14 +-------------
> > .../selinux/selinux-init/selinux-init.sh.sysvinit | 14 ++++++++++++++
> > recipes-security/selinux/selinux-init_0.1.bb | 8 +++++---
> > recipes-security/selinux/selinux-initsh.inc | 8 ++++++++
> > 4 files changed, 28 insertions(+), 16 deletions(-)
> > create mode 100644
> > recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
> >
> > diff --git a/recipes-security/selinux/selinux-init/selinux-init.sh
> > b/recipes-security/selinux/selinux-init/selinux-init.sh index
> > ead4f00..f93d231 100644
> > --- a/recipes-security/selinux/selinux-init/selinux-init.sh
> > +++ b/recipes-security/selinux/selinux-init/selinux-init.sh
> > @@ -33,18 +33,6 @@ check_rootfs()
> > /sbin/shutdown -f -h now
> > }
> >
> > -# If first booting, the security context type of init would be
> > -# "kernel_t", and the whole file system should be relabeled.
> > -if [ "`${SECON} -t --pid 1`" = "kernel_t" ]; then
> > - echo "Checking SELinux security contexts:"
> > - check_rootfs
> > - echo " * First booting, filesystem will be relabeled..."
> > - test -x /etc/init.d/auditd && /etc/init.d/auditd start
> > - ${SETENFORCE} 0
> > - ${RESTORECON} -RF /
> > - ${RESTORECON} -F /
> > - echo " * Relabel done, rebooting the system."
> > - /sbin/reboot
> > -fi
> > +# sysvinit firstboot relabel placeholder HERE
> >
> > exit 0
> > diff --git a/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
> > b/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit new file
> > mode 100644
> > index 0000000..d4f3f71
> > --- /dev/null
> > +++ b/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
> > @@ -0,0 +1,14 @@
> > +# Contents will be added to selinux-init.sh to support relabelling with
> > sysvinit +# If first booting, the security context type of init would be
> > +# "kernel_t", and the whole file system should be relabeled.
> > +if [ "`${SECON} -t --pid 1`" = "kernel_t" ]; then
> > + echo "Checking SELinux security contexts:"
> > + check_rootfs
> > + echo " * First booting, filesystem will be relabeled..."
> > + test -x /etc/init.d/auditd && /etc/init.d/auditd start
> > + ${SETENFORCE} 0
> > + ${RESTORECON} -RF /
> > + ${RESTORECON} -F /
> > + echo " * Relabel done, rebooting the system."
> > + /sbin/reboot
> > +fi
> > diff --git a/recipes-security/selinux/selinux-init_0.1.bb
> > b/recipes-security/selinux/selinux-init_0.1.bb index 38b5900..78f571c
> > 100644
> > --- a/recipes-security/selinux/selinux-init_0.1.bb
> > +++ b/recipes-security/selinux/selinux-init_0.1.bb
> > @@ -14,9 +14,11 @@ ${PN}_RDEPENDS = " \
> > policycoreutils-setfiles \
> > "
> >
> > -SRC_URI = "file://${BPN}.sh \
> > - file://${BPN}.service \
> > - "
> > +SRC_URI = " \
> > + file://${BPN}.sh \
> > + file://${BPN}.sh.sysvinit \
> > + file://${BPN}.service \
> > +"
> >
> > INITSCRIPT_PARAMS = "start 01 S ."
> >
> > diff --git a/recipes-security/selinux/selinux-initsh.inc
> > b/recipes-security/selinux/selinux-initsh.inc index bcdd449..8e31cda 100644
> > --- a/recipes-security/selinux/selinux-initsh.inc
> > +++ b/recipes-security/selinux/selinux-initsh.inc
> > @@ -17,9 +17,15 @@ inherit update-rc.d systemd
> >
> > SYSTEMD_SERVICE_${PN} = "${SELINUX_SCRIPT_SRC}.service"
> >
> > +FILES_${PN} += "/.autorelabel"
> > +
> > do_install () {
> > install -d ${D}${sysconfdir}/init.d/
> > install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh
> > ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST} + # Insert the relabelling
> > code which is only needed with sysvinit + sed -i -e '/HERE/r
> > ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh.sysvinit' \ + -e '/.*HERE$/d' -e
> > '/.*Contents.*sysvinit/d' \
> > + ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
> >
> > install -d ${D}${systemd_unitdir}/system
> > install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service
> > ${D}${systemd_unitdir}/system @@ -27,6 +33,8 @@ do_install () {
> > if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true',
> 'false',
> > d)}; then install -d ${D}${bindir}
> > install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}$
> {bindir}
> > + sed -i -e '/.*HERE$/d' ${D}${bindir}/$
> {SELINUX_SCRIPT_SRC}.sh
> > + echo "# first boot relabelling" > ${D}/.autorelabel
> > fi
> > }
>
>
>
>
--
-Joe MacDonald.
Linux Architect | Mentor® A Siemens Business
:wq
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [meta-selinux][PATCH] selinux-init: use systemd (re)labelling
2019-09-05 20:02 ` Joe MacDonald
@ 2019-09-06 14:07 ` Mark Asselstine
0 siblings, 0 replies; 4+ messages in thread
From: Mark Asselstine @ 2019-09-06 14:07 UTC (permalink / raw)
To: Joe MacDonald; +Cc: yocto
On Thursday, September 5, 2019 4:02:11 P.M. EDT Joe MacDonald wrote:
> [Re: [yocto] [meta-selinux][PATCH] selinux-init: use systemd (re)labelling]
On 19.09.05 (Thu 13:55) Mark Asselstine wrote:
> > On Friday, August 23, 2019 2:19:53 P.M. EDT Mark Asselstine wrote:
> > > Boot loops were being seen when booting with selinux enabled, when the
> > > init system in use is systemd. Once logs were retrieved from the
> > > failing system the error was found to be
> > >
> > > selinux-init.sh[284]: /sbin/restorecon: Could not set context for
> > > /sys/fs/cgroup/cpuacct: Read-only file system selinux-init.sh[284]:
> > > /sbin/restorecon: Could not set context for /sys/fs/cgroup/cpu:
> > > Read-only
> > > file system
> > >
> > > Systemd mounts /sys/fs/cgroup read-only and the (re)labelling code
> > > used by selinux-init.sh is unable to handle this. On top of this the
> > > system is basically presenting two methods of (re)labelling; using the
> > > built in systemd approach via selinux-autorelabel.service *and* the
> > > code we have in selinux-init.sh. This can get confusing especially
> > > given that most online resources will speak to the systemd approach
> > > using selinux-autorelabel.service and /.autorelabel.
> > >
> > > These changes leave the current approach in place when sysvinit is the
> > > init system used, but if systemd is being used we make use of it's
> > > internal (re)labelling functionality. Overall the workflow remains the
> > > same but we now avoid boot loops (systemd remounts /sys/fs/cgroup rw
> > > during the (re)labelling procedure).
> > >
> > > Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
> > > ---
> >
> > Joe, any thoughts on this change?
>
> Not especially, it sounded good to me, seemed to work on a quick test
> for my use-case, and I merged it:
>
> http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/commit/?id=b0d31db104
> d9a4e94bc1409c2ffcc1d82f4a780f
>
> Is there something else I should've considered? Or did you want it on a
> different branch too?
Nope, nope. I figure I should take git off my resume as I just screwed up and
so didn't see that it was merged. I see it now. Sorry for the churn, we'll
have to meetup for a beer for retribution.
MarkA
>
> -J.
>
> > MarkA
> >
> > > .../selinux/selinux-init/selinux-init.sh | 14 +-------------
> > > .../selinux/selinux-init/selinux-init.sh.sysvinit | 14 ++++++++++++++
> > > recipes-security/selinux/selinux-init_0.1.bb | 8 +++++---
> > > recipes-security/selinux/selinux-initsh.inc | 8 ++++++++
> > > 4 files changed, 28 insertions(+), 16 deletions(-)
> > > create mode 100644
> > >
> > > recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
> > >
> > > diff --git a/recipes-security/selinux/selinux-init/selinux-init.sh
> > > b/recipes-security/selinux/selinux-init/selinux-init.sh index
> > > ead4f00..f93d231 100644
> > > --- a/recipes-security/selinux/selinux-init/selinux-init.sh
> > > +++ b/recipes-security/selinux/selinux-init/selinux-init.sh
> > > @@ -33,18 +33,6 @@ check_rootfs()
> > >
> > > /sbin/shutdown -f -h now
> > >
> > > }
> > >
> > > -# If first booting, the security context type of init would be
> > > -# "kernel_t", and the whole file system should be relabeled.
> > > -if [ "`${SECON} -t --pid 1`" = "kernel_t" ]; then
> > > - echo "Checking SELinux security contexts:"
> > > - check_rootfs
> > > - echo " * First booting, filesystem will be relabeled..."
> > > - test -x /etc/init.d/auditd && /etc/init.d/auditd start
> > > - ${SETENFORCE} 0
> > > - ${RESTORECON} -RF /
> > > - ${RESTORECON} -F /
> > > - echo " * Relabel done, rebooting the system."
> > > - /sbin/reboot
> > > -fi
> > > +# sysvinit firstboot relabel placeholder HERE
> > >
> > > exit 0
> > >
> > > diff --git
> > > a/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
> > > b/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit new
> > > file
> > > mode 100644
> > > index 0000000..d4f3f71
> > > --- /dev/null
> > > +++ b/recipes-security/selinux/selinux-init/selinux-init.sh.sysvinit
> > > @@ -0,0 +1,14 @@
> > > +# Contents will be added to selinux-init.sh to support relabelling with
> > > sysvinit +# If first booting, the security context type of init would be
> > > +# "kernel_t", and the whole file system should be relabeled.
> > > +if [ "`${SECON} -t --pid 1`" = "kernel_t" ]; then
> > > + echo "Checking SELinux security contexts:"
> > > + check_rootfs
> > > + echo " * First booting, filesystem will be relabeled..."
> > > + test -x /etc/init.d/auditd && /etc/init.d/auditd start
> > > + ${SETENFORCE} 0
> > > + ${RESTORECON} -RF /
> > > + ${RESTORECON} -F /
> > > + echo " * Relabel done, rebooting the system."
> > > + /sbin/reboot
> > > +fi
> > > diff --git a/recipes-security/selinux/selinux-init_0.1.bb
> > > b/recipes-security/selinux/selinux-init_0.1.bb index 38b5900..78f571c
> > > 100644
> > > --- a/recipes-security/selinux/selinux-init_0.1.bb
> > > +++ b/recipes-security/selinux/selinux-init_0.1.bb
> > > @@ -14,9 +14,11 @@ ${PN}_RDEPENDS = " \
> > >
> > > policycoreutils-setfiles \
> > >
> > > "
> > >
> > > -SRC_URI = "file://${BPN}.sh \
> > > - file://${BPN}.service \
> > > - "
> > > +SRC_URI = " \
> > > + file://${BPN}.sh \
> > > + file://${BPN}.sh.sysvinit \
> > > + file://${BPN}.service \
> > > +"
> > >
> > > INITSCRIPT_PARAMS = "start 01 S ."
> > >
> > > diff --git a/recipes-security/selinux/selinux-initsh.inc
> > > b/recipes-security/selinux/selinux-initsh.inc index bcdd449..8e31cda
> > > 100644
> > > --- a/recipes-security/selinux/selinux-initsh.inc
> > > +++ b/recipes-security/selinux/selinux-initsh.inc
> > > @@ -17,9 +17,15 @@ inherit update-rc.d systemd
> > >
> > > SYSTEMD_SERVICE_${PN} = "${SELINUX_SCRIPT_SRC}.service"
> > >
> > > +FILES_${PN} += "/.autorelabel"
> > > +
> > >
> > > do_install () {
> > >
> > > install -d ${D}${sysconfdir}/init.d/
> > > install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh
> > >
> > > ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST} + # Insert the
> > > relabelling
> > > code which is only needed with sysvinit + sed -i -e '/HERE/r
> > > ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh.sysvinit' \ + -e
'/.*HERE$/d'
> > > -e
> > > '/.*Contents.*sysvinit/d' \
> > > + ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
> > >
> > > install -d ${D}${systemd_unitdir}/system
> > > install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service
> > >
> > > ${D}${systemd_unitdir}/system @@ -27,6 +33,8 @@ do_install () {
> > >
> > > if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true',
> >
> > 'false',
> >
> > > d)}; then install -d ${D}${bindir}
> > >
> > > install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}$
> >
> > {bindir}
> >
> > > + sed -i -e '/.*HERE$/d' ${D}${bindir}/$
> >
> > {SELINUX_SCRIPT_SRC}.sh
> >
> > > + echo "# first boot relabelling" > ${D}/.autorelabel
> > >
> > > fi
> > >
> > > }
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-09-06 14:08 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-08-23 18:19 [meta-selinux][PATCH] selinux-init: use systemd (re)labelling Mark Asselstine
2019-09-05 17:55 ` Mark Asselstine
2019-09-05 20:02 ` Joe MacDonald
2019-09-06 14:07 ` Mark Asselstine
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.