[Buildroot] [PATCH v2] package/libselinux: Add autorelabel for first boot
Yann E. MORIN
yann.morin.1998 at free.fr
Thu Aug 19 21:05:17 UTC 2021
José, All,
On 2021-08-19 12:29 +0300, José Pekkarinen spake thusly:
> Currently buildroot ship libselinux without triggering
> this option, which often shows inconsistencies between
> what the refpolicy defines as a label for a file and
> what the actual file has. Triggering an initial relabel
> would help activating enforcing state right away without
> requiring to enter it once in permissive and tweak the
> labels.
>
> Signed-off-by: José Pekkarinen <jose.pekkarinen at unikie.com>
> ---
> [ v1 -> v2 ] Fix if statement in libselinux recipe
>
> package/libselinux/Config.in | 7 +++++++
> package/libselinux/libselinux.mk | 3 +++
> 2 files changed, 10 insertions(+)
>
> diff --git a/package/libselinux/Config.in b/package/libselinux/Config.in
> index 62070c8d59..df8bd7ffd0 100644
> --- a/package/libselinux/Config.in
> +++ b/package/libselinux/Config.in
> @@ -18,3 +18,10 @@ config BR2_PACKAGE_LIBSELINUX
>
> comment "libselinux needs a toolchain w/ threads, dynamic library"
> depends on !BR2_TOOLCHAIN_HAS_THREADS || BR2_STATIC_LIBS
> +
> +config BR2_PACKAGE_LIBSELINUX_AUTORELABEL
> + bool
> + depends on BR2_PACKAGE_LIBSELINUX
> + depends on BR2_PACKAGE_FINDUTILS
> + depends on BR2_PACKAGE_GREP
> + default y
> diff --git a/package/libselinux/libselinux.mk b/package/libselinux/libselinux.mk
> index fdd13aa942..adf4b3d6f6 100644
> --- a/package/libselinux/libselinux.mk
> +++ b/package/libselinux/libselinux.mk
> @@ -71,6 +71,9 @@ define LIBSELINUX_INSTALL_TARGET_CMDS
> $(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
> $(LIBSELINUX_MAKE_OPTS) DESTDIR=$(TARGET_DIR) \
> $(LIBSELINUX_MAKE_INSTALL_TARGETS)
> + $(if $(BR2_PACKAGE_LIBSELINUX_AUTORELABEL),
> + echo "-F" > $(TARGET_DIR)/.autorelabel
> + mkdir $(TARGET_DIR)/var/lib/selinux)
Isn't this going to fail on read-only filesystems? Relabelling suposedly
requires that extended attributes be added/updated/removed, and that
requires a read-write filesystem...
Can't we do the re-labelling at the time we create the filesystem, i.e.
in fs/common.mk?
And it seems we already have that:
52 ifeq ($(BR2_PACKAGE_REFPOLICY),y)
53 define ROOTFS_SELINUX
54 $(HOST_DIR)/sbin/setfiles -m -r $(TARGET_DIR) \
55 -c $(TARGET_DIR)/etc/selinux/targeted/policy/policy.$(BR2_PACKAGE_LIBSEPOL_POLICY_VERSION) \
56 $(TARGET_DIR)/etc/selinux/targeted/contexts/files/file_contexts \
57 $(TARGET_DIR)
58 endef
59 ROOTFS_COMMON_DEPENDENCIES += host-policycoreutils
60 endif
So why is the labelling wrong? Can't we fix it right there rather than
at runtime?
Regards,
Yann E. MORIN.
> if ! grep -q "selinuxfs" $(TARGET_DIR)/etc/fstab; then \
> echo "none /sys/fs/selinux selinuxfs noauto 0 0" >> $(TARGET_DIR)/etc/fstab ; fi
> endef
> --
> 2.25.1
>
> _______________________________________________
> buildroot mailing list
> buildroot at busybox.net
> http://lists.busybox.net/mailman/listinfo/buildroot
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
More information about the buildroot
mailing list