Skip to content

Add support for specifying an selinux policy in the build pipeline #1506

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
alexlarsson wants to merge 2 commits into from
Closed

Add support for specifying an selinux policy in the build pipeline #1506

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
de3b21e
manifest: Add SELinuxPolicy to BuildOptions
alexlarsson May 8, 2025
72ae85a
BootcDiskImage: Use the specified selinux policy in the build pipeline
alexlarsson May 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion pkg/image/bootc_disk.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,11 @@ func (img *BootcDiskImage) InstantiateManifestFromContainers(m *manifest.Manifes
runner runner.Runner,
rng *rand.Rand) error {

buildPipeline := manifest.NewBuildFromContainer(m, runner, containers, &manifest.BuildOptions{ContainerBuildable: true})
buildPipeline := manifest.NewBuildFromContainer(m, runner, containers,
&manifest.BuildOptions{
ContainerBuildable: true,
SELinuxPolicy: img.SELinux,
})
buildPipeline.Checkpoint()

// In the bootc flow, we reuse the host container context for tools;
Expand Down
33 changes: 28 additions & 5 deletions pkg/manifest/build.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,8 @@ type BuildrootFromPackages struct {
// buildroot itself when running setfiles. Once osbuild has
// this then this option would become "useChrootSetfiles"
disableSelinux bool

selinuxPolicy string
}

type BuildOptions struct {
Expand All @@ -54,6 +56,9 @@ type BuildOptions struct {
// currently needed when using (experimental) cross-arch building.
DisableSELinux bool

// The SELinux policy to use in the buildroot, defaults to 'targeted' if not specified
SELinuxPolicy string

// BootstrapPipeline add the given bootstrap pipeline to the
// build pipeline. This is only needed when doing cross-arch
// building
Expand All @@ -75,6 +80,7 @@ func NewBuild(m *Manifest, runner runner.Runner, repos []rpmmd.RepoConfig, opts
repos: filterRepos(repos, name),
containerBuildable: opts.ContainerBuildable,
disableSelinux: opts.DisableSELinux,
selinuxPolicy: opts.SELinuxPolicy,
}

m.addPipeline(pipeline)
Expand All @@ -93,10 +99,11 @@ func (p *BuildrootFromPackages) addDependent(dep Pipeline) {
func (p *BuildrootFromPackages) getPackageSetChain(distro Distro) []rpmmd.PackageSet {
// TODO: make the /usr/bin/cp dependency conditional
// TODO: make the /usr/bin/xz dependency conditional
policy_package := fmt.Sprintf("selinux-policy-%s", p.getSELinuxPolicy())
packages := []string{
"selinux-policy-targeted", // needed to build the build pipeline
"coreutils", // /usr/bin/cp - used all over
"xz", // usage unclear
policy_package, // needed to build the build pipeline
"coreutils", // /usr/bin/cp - used all over
"xz", // usage unclear
}

packages = append(packages, p.runner.GetBuildPackages()...)
Expand Down Expand Up @@ -143,7 +150,7 @@ func (p *BuildrootFromPackages) serialize() osbuild.Pipeline {
pipeline.AddStage(osbuild.NewRPMStage(osbuild.NewRPMStageOptions(p.repos), osbuild.NewRpmStageSourceFilesInputs(p.packageSpecs)))
if !p.disableSelinux {
pipeline.AddStage(osbuild.NewSELinuxStage(&osbuild.SELinuxStageOptions{
FileContexts: "etc/selinux/targeted/contexts/files/file_contexts",
FileContexts: fmt.Sprintf("etc/selinux/%s/contexts/files/file_contexts", p.getSELinuxPolicy()),
Labels: p.getSELinuxLabels(),
},
))
Expand All @@ -152,6 +159,13 @@ func (p *BuildrootFromPackages) serialize() osbuild.Pipeline {
return pipeline
}

func (p *BuildrootFromPackages) getSELinuxPolicy() string {
if p.selinuxPolicy != "" {
Copy link
Member

@supakeen supakeen May 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you using fully custom SELinux policy packages or could this validate against the set of 'usual suspects'?

Copy link
Contributor Author

@alexlarsson alexlarsson May 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're using the "automotive" policy.

return p.selinuxPolicy
}
return "targeted"
}

// Returns a map of paths to labels for the SELinux stage based on specific
// packages found in the pipeline.
func (p *BuildrootFromPackages) getSELinuxLabels() map[string]string {
Expand Down Expand Up @@ -182,6 +196,7 @@ type BuildrootFromContainer struct {

containerBuildable bool
disableSelinux bool
selinuxPolicy string
}

// NewBuildFromContainer creates a new build pipeline from the given
Expand All @@ -200,6 +215,7 @@ func NewBuildFromContainer(m *Manifest, runner runner.Runner, containerSources [

containerBuildable: opts.ContainerBuildable,
disableSelinux: opts.DisableSELinux,
selinuxPolicy: opts.SELinuxPolicy,
}
m.addPipeline(pipeline)
return pipeline
Expand Down Expand Up @@ -236,6 +252,13 @@ func (p *BuildrootFromContainer) serializeEnd() {
p.containerSpecs = nil
}

func (p *BuildrootFromContainer) getSELinuxPolicy() string {
if p.selinuxPolicy != "" {
return p.selinuxPolicy
}
return "targeted"
}

func (p *BuildrootFromContainer) getSELinuxLabels() map[string]string {
if p.disableSelinux {
return nil
Expand Down Expand Up @@ -273,7 +296,7 @@ func (p *BuildrootFromContainer) serialize() osbuild.Pipeline {
if !p.disableSelinux {
pipeline.AddStage(osbuild.NewSELinuxStage(
&osbuild.SELinuxStageOptions{
FileContexts: "etc/selinux/targeted/contexts/files/file_contexts",
FileContexts: fmt.Sprintf("etc/selinux/%s/contexts/files/file_contexts", p.getSELinuxPolicy()),
ExcludePaths: []string{"/sysroot"},
Labels: p.getSELinuxLabels(),
},
Expand Down
Loading