lsm: treat unlabeled_t SELinux context as unlabeled for relabeling - #2368
lsm: treat unlabeled_t SELinux context as unlabeled for relabeling#2368joelcapitao wants to merge 1 commit into
unlabeled_t SELinux context as unlabeled for relabeling#2368Conversation
Modify `has_security_selinux()` to return `Unlabeled` when a file has the `unlabeled_t` SELinux type. This ensures files created in permissive mode (where the kernel does not apply type transitions) get properly relabeled during `bootc install to-filesystem`. Previously, files with `unlabeled_t` were considered "already labeled" and skipped during relabeling passes, causing SELinux policy mismatches on the final disk image. Note that `/sysroot/boot` cannot be relabeled when it is masked by a mounted filesystem (e.g., when osbuild pre-mounts the boot partition). This is acceptable because `/sysroot/boot` is primarily used as a potential mount point for the boot partition, created by `ostree admin init-fs`. In the final booted system, `/boot` is mounted separately and its contents are properly labeled. Assisted-by: OpenCode (Claude Opus 4.5)
| // This can happen when files are created with SELinux in permissive mode, | ||
| // where the kernel doesn't apply type transitions and assigns unlabeled_t. |
There was a problem hiding this comment.
I don't think it's true that permissive mode doesn't do type transitions
| // This can happen when files are created with SELinux in permissive mode, | ||
| // where the kernel doesn't apply type transitions and assigns unlabeled_t. | ||
| let label = std::str::from_utf8(&buf[..len]).unwrap_or(""); | ||
| if label.contains(":unlabeled_t:") { |
There was a problem hiding this comment.
I'm not happy about parsing security contexts like this, there's official APIs for this
I also don't want to hardcode unlabeled_t ideally.
Hmmmmmm...I think what's giong on here is the kernel returns this type when the xattr is missing - maybe ideally we can figure out a way to query that state. I bet the stock selinux userspace tooling has code for this.
| // Check if the label is unlabeled_t - treat it as unlabeled. | ||
| // This can happen when files are created with SELinux in permissive mode, | ||
| // where the kernel doesn't apply type transitions and assigns unlabeled_t. | ||
| let label = std::str::from_utf8(&buf[..len]).unwrap_or(""); |
There was a problem hiding this comment.
Silently discarding non-UTF8 security contexts feels odd, we can just scan bytes
|
Thank you Colin for the review. Unfortunately, I haven't had the time to amend it with your suggestions (RHCOS on Konflux is high prio) and will be on PTO starting tomorrow for 2 weeks. I'll work on that once back. |
2 participants
Modify
has_security_selinux()to returnUnlabeledwhen a file has theunlabeled_tSELinux type. This ensures files created in permissive mode (where the kernel does not apply type transitions) get properly relabeled duringbootc install to-filesystem.Previously, files with
unlabeled_twere considered "already labeled" and skipped during relabeling passes, causing SELinux policy mismatches on the final disk image.Note that
/sysroot/bootcannot be relabeled when it is masked by a mounted filesystem (e.g., when osbuild pre-mounts the boot partition). This is acceptable because/sysroot/bootis primarily used as a potential mount point for the boot partition, created byostree admin init-fs. In the final booted system,/bootis mounted separately and its contents are properly labeled.Assisted-by: OpenCode (Claude Opus 4.5)