Set secontext for bind volumes in selinux enabled distros #1942

hasan4791 · 2023-10-24T07:22:14Z

Fixes #1882
Signed-off-by: T K Chandra Hasan [email protected]

The approach taken here is, once the mounts are created using the parameters in user-data, we would be unmounting the existing mounts and remounting with secontext options for selinux enabled distros. It would update the /etc/fstab file also. The context type we have taken here is container_file_t, as it would be easier to mount those directories inside the container.

hasan4791 · 2023-10-24T14:13:32Z

@AkihiroSuda Could you please help me with the tests.
Upgrade test seems to pass sometime also fails sometime.
I've added a new test, "test-vz-fedora" which seems to be skipped. Not sure whats going on.

AkihiroSuda · 2023-10-24T14:39:13Z

Upgrade test seems to pass sometime also fails sometime.

This one seems flaky.

I've added a new test, "test-vz-fedora" which seems to be skipped. Not sure whats going on.

macos-13 runner for vz is known to be flaky and does not produce error logs 😞

AkihiroSuda · 2023-10-24T14:40:30Z

.github/workflows/test.yml

+      matrix:
+        template:
+        - templates/experimental/vz.yaml
+        - hack/test-templates/test-vz-fedora.yaml


Can we just use templates/fedora.yaml ?

test-templates.sh can be modified to receive --vm-type=vz via arg or env

Didn't know we can use like this. I'll update.

AkihiroSuda · 2023-10-24T14:41:20Z

hack/test-mount-home.sh

@@ -24,3 +24,42 @@ if [ "$got" != "$expected" ]; then
 	ERROR "Home directory is not shared?"
 	exit 1
 fi
+
+if [ "${NAME}" == "test-vz-fedora" ]; then


Probably this should be split to hack/test-selinux.sh

hasan4791 · 2023-10-25T03:00:04Z

@AkihiroSuda PTAL

AkihiroSuda · 2023-10-25T04:31:52Z

vz (Fedora) CI seems failing in TEST| [INFO] Testing secontext is set for rosetta mounts
https://github.com/lima-vm/lima/actions/runs/6635170336/job/18026648710?pr=1942

AkihiroSuda · 2023-10-25T04:33:13Z

hack/test-templates.sh

+	WARNING "Relaxing systemd tests for vz-fedora (For avoiding CI failure)"
+	CHECKS["systemd-strict"]=
+	CHECKS["vz-selinux"]=1
+	LIMACTL_SUBCMDS=(--vm-type vz --mount-type virtiofs --rosetta --network vzNAT)


Can we provide this via env var?

hasan4791 · 2023-10-25T10:54:54Z

Uff, vz ci jobs are too much flaky.

hasan4791 · 2023-10-26T06:26:29Z

Finally 🥳

AkihiroSuda · 2023-10-26T06:39:50Z

.github/workflows/test.yml

    - name: Make
      run: make
    - name: Install
      run: make install
    - name: Install test dependencies
      run: brew install qemu bash coreutils
    - name: Test
-      run: ./hack/test-templates.sh templates/experimental/vz.yaml
+      env:
+        ARGS: "--vm-type vz --mount-type virtiofs --rosetta --network vzNAT"


Suggested change

ARGS: "--vm-type vz --mount-type virtiofs --rosetta --network vzNAT"

LIMACTL_CREATE_ARGS: "--vm-type vz --mount-type virtiofs --rosetta --network vzNAT"

(These args will no longer be needed after merging:

Use VZ by default for new instances on macOS >= 13.5 #1951
)

AkihiroSuda · 2023-10-26T06:40:15Z

.github/workflows/test.yml

+        - template: experimental/vz.yaml
+          name: default
+        - template: fedora.yaml
+          name: vz-fedora


"name" is not needed IIUC

AkihiroSuda · 2023-10-26T06:41:12Z

hack/test-templates.sh

@@ -389,6 +407,10 @@ if [[ -n ${CHECKS["snapshot-offline"]} ]]; then
 	limactl start "$NAME"
 fi

+if [[ -n ${CHECKS["vz-selinux"]} ]]; then


This should check limactl shell "$NAME" getenforce

We need to run this only for vz based VMs and so we filter the check based on the vm name.

Can we just check limactl ls --json "$NAME" | jq -r .vmType ?

AkihiroSuda · 2023-10-26T16:19:06Z

hack/test-selinux.sh

+NAME="$1"
+expected="context=system_u:object_r:container_file_t:s0"
+#Skip Rosetta checks for x86 GHA mac runners
+if [ "$(arch)" == "arm64" ]; then


Suggested change

if [ "$(arch)" == "arm64" ]; then

if [ "$(uname)" == "Darwin" ] && [ "$(arch)" == "arm64" ]; then

AkihiroSuda · 2023-10-26T16:19:49Z

hack/test-templates.sh

@@ -223,7 +230,7 @@ if [[ -n ${CHECKS["port-forwards"]} ]]; then
 	if [ "${NAME}" = "debian" ]; then
 		limactl shell "$NAME" sudo apt-get install -y netcat-openbsd
 	fi
-	if [ "${NAME}" = "fedora" ]; then
+	if [[ ${NAME} == *"fedora"* ]]; then


No longer needed

AkihiroSuda · 2023-10-26T16:20:08Z

hack/test-templates.sh

@@ -389,6 +396,10 @@ if [[ -n ${CHECKS["snapshot-offline"]} ]]; then
 	limactl start "$NAME"
 fi

+if [[ $NAME == "fedora" && "$(limactl ls --json "$NAME" | jq -r .vmType)" == "vz" ]]; then


This should check limactl shell "$NAME" getenforce, not the name

getenforce would be available on fedro based distros, hence the name is used. For other distros, we need to handle the command being not found error.

AkihiroSuda

Thanks

Fixes lima-vm#1882 Signed-off-by: T K Chandra Hasan <[email protected]>

AkihiroSuda

Thanks

hasan4791 force-pushed the issue-1882 branch 2 times, most recently from 8e4c047 to bbcf83f Compare October 24, 2023 10:58

hasan4791 changed the title ~~Set secontext for bind volumes in selinux enabled distros~~ WIP: Set secontext for bind volumes in selinux enabled distros Oct 24, 2023

hasan4791 force-pushed the issue-1882 branch 3 times, most recently from db6121a to 83ca1f3 Compare October 24, 2023 13:30

AkihiroSuda reviewed Oct 24, 2023

View reviewed changes

hasan4791 force-pushed the issue-1882 branch 3 times, most recently from 0ab4aef to f10c3aa Compare October 25, 2023 02:55

hasan4791 changed the title ~~WIP: Set secontext for bind volumes in selinux enabled distros~~ Set secontext for bind volumes in selinux enabled distros Oct 25, 2023

AkihiroSuda reviewed Oct 25, 2023

View reviewed changes

hasan4791 force-pushed the issue-1882 branch 3 times, most recently from 92e3c21 to 3936c02 Compare October 25, 2023 10:19

hasan4791 requested a review from AkihiroSuda October 26, 2023 04:57

AkihiroSuda reviewed Oct 26, 2023

View reviewed changes

AkihiroSuda added this to the v1.0 (tentative) milestone Oct 26, 2023

AkihiroSuda added guest/el8 Guest: CentOS 8 / Rocky Linux 8 / Alma Linux 8 guest/fedora Guest: Fedora guest/el9 labels Oct 26, 2023

AkihiroSuda added the component/vz label Oct 26, 2023

hasan4791 force-pushed the issue-1882 branch 2 times, most recently from d878580 to f8ff938 Compare October 26, 2023 13:45

AkihiroSuda reviewed Oct 26, 2023

View reviewed changes

AkihiroSuda previously approved these changes Oct 26, 2023

View reviewed changes

hasan4791 dismissed AkihiroSuda’s stale review via a0a5894 October 26, 2023 18:02

hasan4791 force-pushed the issue-1882 branch 3 times, most recently from bbe1351 to 2d73dcc Compare October 26, 2023 18:23

Set secontext for bind volumes in selinux enabled distros

a649815

Fixes lima-vm#1882 Signed-off-by: T K Chandra Hasan <[email protected]>

hasan4791 force-pushed the issue-1882 branch from 2d73dcc to a649815 Compare October 26, 2023 18:26

hasan4791 requested a review from AkihiroSuda October 27, 2023 08:40

AkihiroSuda approved these changes Oct 27, 2023

View reviewed changes

AkihiroSuda merged commit dddbb71 into lima-vm:master Oct 27, 2023
24 checks passed

AkihiroSuda modified the milestones: v1.0, v0.18.1 Oct 30, 2023

na0x2c6 mentioned this pull request Dec 24, 2023

Enable setting cgroup v2 mode in std edition lima-vm/alpine-lima#114

Closed

hasan4791 deleted the issue-1882 branch September 19, 2024 04:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Set secontext for bind volumes in selinux enabled distros #1942

Set secontext for bind volumes in selinux enabled distros #1942

hasan4791 commented Oct 24, 2023 •

edited

Loading

hasan4791 commented Oct 24, 2023

AkihiroSuda commented Oct 24, 2023

AkihiroSuda Oct 24, 2023

hasan4791 Oct 24, 2023

AkihiroSuda Oct 24, 2023

hasan4791 commented Oct 25, 2023

AkihiroSuda commented Oct 25, 2023

AkihiroSuda Oct 25, 2023

hasan4791 commented Oct 25, 2023

hasan4791 commented Oct 26, 2023

AkihiroSuda Oct 26, 2023

AkihiroSuda Oct 26, 2023

AkihiroSuda Oct 26, 2023

AkihiroSuda Oct 26, 2023

hasan4791 Oct 26, 2023

AkihiroSuda Oct 26, 2023

AkihiroSuda Oct 26, 2023

AkihiroSuda Oct 26, 2023

AkihiroSuda Oct 26, 2023

hasan4791 Oct 26, 2023

AkihiroSuda left a comment

AkihiroSuda left a comment

	ARGS: "--vm-type vz --mount-type virtiofs --rosetta --network vzNAT"
	LIMACTL_CREATE_ARGS: "--vm-type vz --mount-type virtiofs --rosetta --network vzNAT"

	if [ "$(arch)" == "arm64" ]; then
	if [ "$(uname)" == "Darwin" ] && [ "$(arch)" == "arm64" ]; then

Set secontext for bind volumes in selinux enabled distros #1942

Set secontext for bind volumes in selinux enabled distros #1942

Conversation

hasan4791 commented Oct 24, 2023 • edited Loading

hasan4791 commented Oct 24, 2023

AkihiroSuda commented Oct 24, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hasan4791 commented Oct 25, 2023

AkihiroSuda commented Oct 25, 2023

Choose a reason for hiding this comment

hasan4791 commented Oct 25, 2023

hasan4791 commented Oct 26, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AkihiroSuda left a comment

Choose a reason for hiding this comment

AkihiroSuda left a comment

Choose a reason for hiding this comment

hasan4791 commented Oct 24, 2023 •

edited

Loading