Dracut: Update Dracut overlay module to correctly locate 'chcon'

[gmileka]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• [n/a] The toolchain has been rebuilt successfully (or no changes were made to it)
• [n/a] The toolchain/worker package manifests are up-to-date
• [ok] Any updated packages successfully build (or no packages were changed)
• [n/a] Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• [ok] Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• [ok] All package sources are available
• [ok] cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• [ok] LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• [ok] All source files have up-to-date hashes in the *.signatures.json files
• [ok] sudo make go-tidy-all and sudo make go-test-coverage pass
• [n/a] Documentation has been updated to match any changes to the build system
• [ok] Ready to merge

---

Summary

LiveOS ISO utilizes an overlay file system that consists of a read-only full OS rootfs (lower dir) and an in-memory read-write file system (upper dir).

When selinux is enabled, the final root (/) must be labeled root_t. Given that the final root (/) is constructed from the lower dir and the upper dir, both should also be marked as such (i.e. with root_t). The read-only full OS rootfs is already labeled as such during build time. The in-memory file system is new, however, and still need to be labeled.

A fix was merged in December to achieve that by calling selinux chcon utility. At the time, the labeling was done correctly, and selinux did not report any violations in our private testing.

However, this bug report alerted us that chcon is not being found on the path as tested by Brian, and as a result, the labeling is not taking place, and the liveos iso does not boot when selinux is enabled.

This fix changes the dracut module responsible for the labeling to explicitly specify the full path of the chcon utility. This guarantees that regardless of the contents of the initrd, the command always succeeds.

When doing root cause analysis for the regression, the most likely reason it did not not show in the private testing is that the initrd had a copy of chcon, and it was on the path. This hid the problem that would arise if the contents of the initrd changed.

Change Log

• Unblock SELinux for ISO - Update Dracut module to correctly locate 'chcon'

Does this affect the toolchain?

• NO

Associated issues

• n/a

Links to CVEs

• n/a

Test Methodology

Validation

• Locally, on dev box:
  • New enlistment of Azure Linux.
  • Build the dracut package.
  • Build the baremela image.
  • Build Prism.
  • Use Prism to build a LiveOS ISO.
  • Create a VM with the generated ISO.
  • Boot the VM.
  • Log-in.
  • Verify that no selinux denials exist in the journal logs.

Automation

• Enabled the VM tests suite in the Prism build/test pipelines.
  • Download varius Azure Linux 2.0/3.0 images.
  • Customize using Prism.
  • Ensure they all boot, get an IP, and the test can ssh and inspect the contents.

Note While we've put in automation to catch this kind of failures in the future, the downloaded images in the test are the public one which do not have the fixed Dracut package. However, once the Dracut package is published, the test will automatically pick it up and verify it boots.

[pebenito]

var_t typically isn't used for files, since it is extremely generic, policy-wise. What dir(s)/file(s) are created?

[gmileka]

Looked into it further, it turns out we're moving the ssh key file location from /etc/ to /var/etc:

/var/etc/ssh/ssh_host_rsa_key.pub
/var/etc/ssh/ssh_host_rsa_key
/var/etc/ssh/ssh_host_ecdsa_key.pub
/var/etc/ssh/ssh_host_ecdsa_key
/var/etc/ssh/ssh_host_ed25519_key.pub
/var/etc/ssh/ssh_host_ed25519_key

This change is necessary for when verity is enabled and the etc location is read-only with a volatile overlay.

I'll drop the policy changes from the PR based on that. Thanks Chris.

[romoh]

LGTM