lsm: treat unlabeled_t SELinux context as unlabeled for relabeling - #2368
Conversation
| // This can happen when files are created with SELinux in permissive mode, | ||
| // where the kernel doesn't apply type transitions and assigns unlabeled_t. |
There was a problem hiding this comment.
I don't think it's true that permissive mode doesn't do type transitions
| // Check if the label is unlabeled_t - treat it as unlabeled. | ||
| // This can happen when files are created with SELinux in permissive mode, | ||
| // where the kernel doesn't apply type transitions and assigns unlabeled_t. | ||
| let label = std::str::from_utf8(&buf[..len]).unwrap_or(""); |
There was a problem hiding this comment.
Silently discarding non-UTF8 security contexts feels odd, we can just scan bytes
|
Thank you Colin for the review. Unfortunately, I haven't had the time to amend it with your suggestions (RHCOS on Konflux is high prio) and will be on PTO starting tomorrow for 2 weeks. I'll work on that once back. |
|
To emphasize I think it is not correct to parse SELinux security contexts in userspace at all, and especially not to hardcode specific type names. The idea is access decisions are centralized, and there are APIs for interacting with policy. But digging in a bit...what we're doing here in bootc is somewhat unusual in that we're trying to special case "not labeled at all". It's quite tricky because on a system without SELinux enabled (say an Ubuntu host targeting a bootc SELinux-enabled host) when we call What we get if SELinux is enabled on the host though is this I think though we can get from the policy is this unlabeled type. I am having an agent dig at this. |
4b02238 to
b2dbf86
Compare
Files created in permissive mode can retain the policy initial `unlabeled_t` type. Treating any existing xattr as labeled caused relabeling passes to skip these files and leave policy mismatches in installed systems. Expose a quiet internal predicate so this classification can be verified directly in integration environments without duplicating the SELinux parsing logic. Assisted-by: AI Signed-off-by: Colin Walters <walters@verbum.org>
b2dbf86 to
54ca558
Compare
|
OK I pushed some changes to this. @joelcapitao want to look? @jmarrero can you approve? |
3 participants
Modify
has_security_selinux()to returnUnlabeledwhen a file has theunlabeled_tSELinux type. This ensures files created in permissive mode (where the kernel does not apply type transitions) get properly relabeled duringbootc install to-filesystem.Previously, files with
unlabeled_twere considered "already labeled" and skipped during relabeling passes, causing SELinux policy mismatches on the final disk image.Note that
/sysroot/bootcannot be relabeled when it is masked by a mounted filesystem (e.g., when osbuild pre-mounts the boot partition). This is acceptable because/sysroot/bootis primarily used as a potential mount point for the boot partition, created byostree admin init-fs. In the final booted system,/bootis mounted separately and its contents are properly labeled.Assisted-by: OpenCode (Claude Opus 4.5)