Skip to content

Commit 8184857

Browse files
rwmjonesrwmjones
committed
customize: Add module for doing SELinux relabel of filesystem (RHBZ#554829, RHBZ#983969, RHBZ#1089100).
This implements the --selinux-relabel option for virt-customize, virt-builder and virt-sysprep. There is no need to autorelabel functionality now. Thanks: Stephen Smalley
1 parent 6341d99 commit 8184857

File tree

7 files changed

+99
-23
lines changed

7 files changed

+99
-23
lines changed

‎builder/Makefile.am

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,7 @@ BOBJECTS = \
157157
$(top_builddir)/customize/perl_edit.cmo \
158158
$(top_builddir)/customize/crypt.cmo \
159159
$(top_builddir)/customize/password.cmo \
160+
$(top_builddir)/customize/SELinux_relabel.cmo \
160161
$(top_builddir)/customize/ssh_key.cmo \
161162
$(top_builddir)/customize/subscription_manager.cmo \
162163
$(top_builddir)/customize/customize_cmdline.cmo \

‎builder/virt-builder.pod

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1756,20 +1756,19 @@ two possible strategies it can use to ensure correct labelling:
17561756

17571757
=item Using I<--selinux-relabel>
17581758

1759-
This runs L<fixfiles(8)> just before finalizing the guest, which sets
1759+
This runs L<setfiles(8)> just before finalizing the guest, which sets
17601760
SELinux labels correctly in the disk image.
17611761

1762-
Sometimes fixfiles is not possible during installation, in which case
1763-
this option falls back on:
1762+
This is the recommended method.
17641763

1765-
=item Touching F</.autorelabel>
1764+
=item I<--touch> F</.autorelabel>
17661765

1767-
Guest templates may already contain a file called F</.autorelabel>, or
1768-
it is touched if I<--selinux-relabel> cannot run fixfiles.
1766+
Guest templates may already contain a file called F</.autorelabel> or
1767+
you may touch it.
17691768

1770-
For guests that use SELinux, this causes fixfiles to run at first
1771-
boot. Guests will reboot themselves once the first time you use them,
1772-
which is normal and harmless.
1769+
For guests that use SELinux, this causes L<restorecon(8)> to run at
1770+
first boot. Guests will reboot themselves once the first time you use
1771+
them, which is normal and harmless.
17731772

17741773
=back
17751774

@@ -1884,7 +1883,6 @@ L<gpg(1)>,
18841883
L<curl(1)>,
18851884
L<virt-make-fs(1)>,
18861885
L<genisoimage(1)>,
1887-
L<fixfiles(8)>,
18881886
L<http://libguestfs.org/>.
18891887

18901888
=head1 AUTHOR

‎customize/Makefile.am

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ SOURCES_MLI = \
4343
password.mli \
4444
perl_edit.mli \
4545
random_seed.mli \
46+
SELinux_relabel.mli \
4647
ssh_key.mli \
4748
subscription_manager.mli \
4849
timezone.mli \
@@ -58,6 +59,7 @@ SOURCES_ML = \
5859
password.ml \
5960
perl_edit.ml \
6061
random_seed.ml \
62+
SELinux_relabel.ml \
6163
ssh_key.ml \
6264
subscription_manager.ml \
6365
timezone.ml \

‎customize/SELinux_relabel.ml

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
(* virt-customize
2+
* Copyright (C) 2016 Red Hat Inc.
3+
*
4+
* This program is free software; you can redistribute it and/or modify
5+
* it under the terms of the GNU General Public License as published by
6+
* the Free Software Foundation; either version 2 of the License, or
7+
* (at your option) any later version.
8+
*
9+
* This program is distributed in the hope that it will be useful,
10+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
* GNU General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License along
15+
* with this program; if not, write to the Free Software Foundation, Inc.,
16+
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
17+
*)
18+
19+
open Common_gettext.Gettext
20+
open Common_utils
21+
22+
open Printf
23+
24+
module G = Guestfs
25+
26+
let relabel (g : G.guestfs) =
27+
(* Is the guest using SELinux? *)
28+
if g#is_file ~followsymlinks:true "/usr/sbin/load_policy" &&
29+
g#is_file ~followsymlinks:true "/etc/selinux/config" then (
30+
(* Is setfiles / SELinux relabelling functionality available? *)
31+
if g#feature_available [| "selinuxrelabel" |] then (
32+
(* Use Augeas to parse /etc/selinux/config. *)
33+
g#aug_init "/" (16+32) (* AUG_SAVE_NOOP | AUG_NO_LOAD *);
34+
(* See: https://bugzilla.redhat.com/show_bug.cgi?id=975412#c0 *)
35+
ignore (g#aug_rm "/augeas/load/*[\"/etc/selinux/config/\" !~ regexp('^') + glob(incl) + regexp('/.*')]");
36+
g#aug_load ();
37+
debug_augeas_errors g;
38+
39+
(* Get the SELinux policy name, eg. "targeted", "minimum". *)
40+
let policy = g#aug_get "/files/etc/selinux/config/SELINUXTYPE" in
41+
g#aug_close ();
42+
43+
(* Get the spec file name. *)
44+
let specfile =
45+
sprintf "/etc/selinux/%s/contexts/files/file_contexts" policy in
46+
47+
(* Relabel everything. *)
48+
g#selinux_relabel ~force:true specfile "/";
49+
50+
(* If that worked, we don't need to autorelabel. *)
51+
g#rm_f "/.autorelabel"
52+
)
53+
else (
54+
(* SELinux guest, but not SELinux host. Fallback to this. *)
55+
g#touch "/.autorelabel"
56+
)
57+
)

‎customize/SELinux_relabel.mli

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
(* virt-customize
2+
* Copyright (C) 2016 Red Hat Inc.
3+
*
4+
* This program is free software; you can redistribute it and/or modify
5+
* it under the terms of the GNU General Public License as published by
6+
* the Free Software Foundation; either version 2 of the License, or
7+
* (at your option) any later version.
8+
*
9+
* This program is distributed in the hope that it will be useful,
10+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
11+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12+
* GNU General Public License for more details.
13+
*
14+
* You should have received a copy of the GNU General Public License along
15+
* with this program; if not, write to the Free Software Foundation, Inc.,
16+
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
17+
*)
18+
19+
(** SELinux-relabel the filesystem. *)
20+
21+
val relabel : Guestfs.guestfs -> unit
22+
(** Relabel the mounted guestfs filesystem using the current SELinux
23+
policy that applies to the guest.
24+
25+
If the guest does not look like it uses SELinux, this does nothing.
26+
27+
In case relabelling is not possible (since it is an optional
28+
feature which requires the setfiles(8) program), instead we
29+
fall back to touching [/.autorelabel]. *)

‎customize/customize_run.ml

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -414,19 +414,7 @@ exec >>%s 2>&1
414414

415415
if ops.flags.selinux_relabel then (
416416
message (f_"SELinux relabelling");
417-
if guest_arch_compatible then (
418-
let cmd = sprintf "
419-
if load_policy && fixfiles restore; then
420-
rm -f /.autorelabel
421-
else
422-
touch /.autorelabel
423-
echo '%s: SELinux relabelling failed, will relabel at boot instead.'
424-
fi
425-
" prog in
426-
do_run ~display:"load_policy && fixfiles restore" cmd
427-
) else (
428-
g#touch "/.autorelabel"
429-
)
417+
SELinux_relabel.relabel g
430418
);
431419

432420
(* Clean up the log file:

‎sysprep/Makefile.am

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ BOBJECTS = \
125125
$(top_builddir)/customize/timezone.cmo \
126126
$(top_builddir)/customize/firstboot.cmo \
127127
$(top_builddir)/customize/perl_edit.cmo \
128+
$(top_builddir)/customize/SELinux_relabel.cmo \
128129
$(top_builddir)/customize/ssh_key.cmo \
129130
$(top_builddir)/customize/subscription_manager.cmo \
130131
$(top_builddir)/customize/customize_cmdline.cmo \

0 commit comments

Comments
 (0)