mirror of
https://github.com/SELinuxProject/selinux
synced 2024-12-24 06:52:12 +00:00
286a679fad
In Fedora/RHEL's selinux-policy package we ship a pre-built SELinux policy store in the RPMs. When updating the main policy RPM, care must be taken to rebuild the policy using `semodule -B` if there are any other SELinux modules installed (whether shipped via another RPM or manually installed locally). However, this way of shipping/managing the policy creates complications on systems, where system files are managed by rpm-ostree (such as Fedora CoreOS or Red Hat CoreOS), where the "package update" process is more sophisticated. (Disclaimer: The following is written according to my current limited understanding of rpm-ostree and may not be entirely accurate, but the gist of it should match the reality.) Basically, one can think of rpm-ostree as a kind of Git for system files. The package content is provided on a "branch", where each "commit" represents a set of package updates layered on top of the previous commit (i.e. it is a rolling release with some defined package content snapshots). The user can then maintain their own branch with additional package updates/installations/... and "rebase" it on top of the main branch as needed. On top of that, the user can also have additional configuration files (or modifications to existing files) in /etc, which represent an additional layer on top of the package content. When updating the system (i.e. rebasing on a new "commit" of the "main branch"), the files on the running system are not touched and the new system state is prepared under a new root directory, which is chrooted into on the next reboot. When an rpm-ostree system is updated, there are three moments when the SELinux module store needs to be rebuilt to ensure that all modules are included in the binary policy: 1. When the local RPM installations are applied on top of the base system snapshot. 2. When local user configuartion is applied on top of that. 3. On system shutdown, to ensure that any changes in local configuration performed since (2.) are reflected in the final new system image. Forcing a full rebuild at each step is not optimal and in many cases is not necessary, as the user may not have any custom modules installed. Thus, this patch extends libsemanage to compute a checksum of the content of all enabled modules, which is stored in the store, and adds a flag to the libsemanage handle that instructs it to check the module content checksum against the one from the last successful transaction and force a full policy rebuild if they don't match. This will allow rpm-ostree systems to potentially reduce delays when reconciling the module store when applying updates. I wasn't able to measure any noticeable overhead of the hash computation, which is now added for every transaction (both before and after this change a full policy rebuild took about 7 seconds on my test x86 VM). With the new option check_ext_changes enabled, rebuilding a policy store with unchanged modules took only about 0.96 seconds. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> |
||
|---|---|---|
| .. | ||
| boolean_record.h | ||
| booleans_active.h | ||
| booleans_local.h | ||
| booleans_policy.h | ||
| context_record.h | ||
| debug.h | ||
| fcontext_record.h | ||
| fcontexts_local.h | ||
| fcontexts_policy.h | ||
| handle.h | ||
| ibendport_record.h | ||
| ibendports_local.h | ||
| ibendports_policy.h | ||
| ibpkey_record.h | ||
| ibpkeys_local.h | ||
| ibpkeys_policy.h | ||
| iface_record.h | ||
| interfaces_local.h | ||
| interfaces_policy.h | ||
| modules.h | ||
| node_record.h | ||
| nodes_local.h | ||
| nodes_policy.h | ||
| port_record.h | ||
| ports_local.h | ||
| ports_policy.h | ||
| semanage.h | ||
| seuser_record.h | ||
| seusers_local.h | ||
| seusers_policy.h | ||
| user_record.h | ||
| users_local.h | ||
| users_policy.h | ||