selinux: perform relabeling from initrd

[jlebon]

Now that we can relabel from the initrd, we should be able to
categorically resolve all SELinux and Ignition issues.

Here, we drop the hacky ignition-relabel.service and relabel all the
files we need to on the spot!

Requires: https://lore.kernel.org/selinux/20190819193032.848-1-jlebon@redhat.com/

Closes: #635

[jlebon]

Upstream patch was just merged: https://lore.kernel.org/selinux/20190912133007.27545-1-jlebon@redhat.com/T/#m5f950ca9fc3ed374cb793fc9aed0435602b1b6ad. 🎉

It should be in the 5.5 release.

[jlebon]

OK rebased this! Since the kernel in FCOS today already supports this, and we have the spec2x branch, I went more aggressive this time and nuked all the previous code we had around this.

Still chasing down some bugs and doing some more testing, but works pretty well overall!

[jlebon]

OK, so this is failing on:

+ docker run --rm -e TARGET=amd64 -v '/opt/jenkins/workspace/os/Ignition BB tests:/usr/src/myapp' -w /usr/src/myapp quay.io/slowrie/ignition-builder:latest ./build_blackbox_tests
Using version from git...
Building ignition...

# github.com/coreos/ignition/v2/internal/exec/util
selabeling.c:30:29: fatal error: selinux/selinux.h: No such file or directory
 #include <selinux/selinux.h>
                             ^

Where is slowrie/ignition-builder:latest defined? Is it built from images/Dockerfile?

[arithx]

@jlebon correct, it's built from images/Dockerfile, the latest build was built based on golang:1.12 in March.

[jlebon]

OK, reworked this now! The major improvement is that instead of having our own relabeling code, we just use setfiles. I had initially explored this, but I couldn't get around setfiles really wanting a loaded policy in order to validate the labels it writes. Adding -F fixes this (even though the man page doesn't make that obvious).

[jlebon]

Requires: coreos/ignition-dracut#138

[jlebon]

That said, there's a higher-level issue for FCOS/RHCOS here: there are other things created from the initramfs that also need to be relabeled.

The few things I can think of right now are:

• Files created by the systemd-tmpfiles invocation of coreos-populate-var.service. For example, right now /var/home mount points are failing. This used to work, so I think SELinux policy rules around systemd and unlabeled dirs might have changed with the move to f31.
• /etc/hostname created by Afterburn
• FIPS-related files

(And I'm sure there are others I'm forgetting.)

I think I'll add a tiny helper script to make it easier for those services to invoke setfiles. Then anything that should be distro-agnostic (like Ignition) can use setfiles directly, and all the more CoreOS-specific stuff can use the helper.

[jlebon]

coreos/fedora-coreos-config#245

[ajeddeloh]

LGTM, this will break relabeling on anyone using Ignition v2/spec3 that doesn't have the patch, but I don't think anyone is. Plus the patch will make it into their kernels eventually. Maybe add a note in the operator notes section on SELInux?

[jlebon]

Maybe add a note in the operator notes section on SELInux?

Good idea, done!

[ajeddeloh]

🚢 🇮🇹

[jlebon]

Green checkmarks = merging! (Though we should rework CI on this repo soon so it actually runs on FCOS.)