[Drbd-dev] [PATCH] containers: add commands to correct SELinux context

[Drbd-dev] [PATCH] containers: add commands to correct SELinux context

[Andrei Kvapil]

When running the entry.sh script with RAM-based module loading method, the
generated modules acquire the 'var_lib_t' context by default on certain systems.

This patch adds commands to correct the context to 'modules_object_t'
to allow seamless module loading on SELinux-enabled systems.

Co-developed-by: Vasily Oleynikov <vasily.oleynikov@flant.com>
---
 docker/entry.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docker/entry.sh b/docker/entry.sh
index 2c91734e6..978df6431 100644
--- a/docker/entry.sh
+++ b/docker/entry.sh
@@ -217,6 +217,10 @@ load_from_ram() {
 		find . -name "*.ko" -print0 | xargs -0 -n1 "/lib/modules/$(uname -r)/build/scripts/sign-file" "$CONFIG_MODULE_SIG_HASH" "${LB_SIGN}/signing_key.pem" "${LB_SIGN}/signing_key.x509" 
 	fi
 
+ 	chcon -t modules_object_t ./drbd.ko || true
+ 	chcon -t modules_object_t ./drbd_transport_tcp.ko || true
+ 	chcon -t modules_object_t ./drbd_transport_rdma.ko || true
+
 	insmod ./drbd.ko usermode_helper=disabled
 	insmod ./drbd_transport_tcp.ko
 	insmod ./drbd_transport_rdma.ko 2>/dev/null || true
-- 
2.32.0 (Apple Git-132)

Re: [Drbd-dev] [PATCH] containers: add commands to correct SELinux context

[Roland Kammerer]

On Thu, May 25, 2023 at 04:49:15PM +0200, Andrei Kvapil wrote:
> When running the entry.sh script with RAM-based module loading method, the
> generated modules acquire the 'var_lib_t' context by default on certain systems.
> 
> This patch adds commands to correct the context to 'modules_object_t'
> to allow seamless module loading on SELinux-enabled systems.
> 
> Co-developed-by: Vasily Oleynikov <vasily.oleynikov@flant.com>
> ---
>  docker/entry.sh | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/docker/entry.sh b/docker/entry.sh
> index 2c91734e6..978df6431 100644
> --- a/docker/entry.sh
> +++ b/docker/entry.sh
> @@ -217,6 +217,10 @@ load_from_ram() {
>  		find . -name "*.ko" -print0 | xargs -0 -n1 "/lib/modules/$(uname -r)/build/scripts/sign-file" "$CONFIG_MODULE_SIG_HASH" "${LB_SIGN}/signing_key.pem" "${LB_SIGN}/signing_key.x509" 
>  	fi
>  
> + 	chcon -t modules_object_t ./drbd.ko || true
> + 	chcon -t modules_object_t ./drbd_transport_tcp.ko || true
> + 	chcon -t modules_object_t ./drbd_transport_rdma.ko || true
> +
>  	insmod ./drbd.ko usermode_helper=disabled
>  	insmod ./drbd_transport_tcp.ko
>  	insmod ./drbd_transport_rdma.ko 2>/dev/null || true
> -- 
> 2.32.0 (Apple Git-132)

Thanks, I will queue that up for out of tree DRBD9.

Regards, rck