From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id DCD395A0272; Wed, 16 Aug 2023 08:00:38 +0200 (CEST) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH 1/7] fedora: Install pasta as hard link to ensure SELinux file context match Date: Wed, 16 Aug 2023 08:00:32 +0200 Message-Id: <20230816060038.870746-2-sbrivio@redhat.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230816060038.870746-1-sbrivio@redhat.com> References: <20230816060038.870746-1-sbrivio@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: 3NDOZO4WEY2KFD456CPBEAL5PTGT3TWK X-Message-ID-Hash: 3NDOZO4WEY2KFD456CPBEAL5PTGT3TWK X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: "'Richard W . M . Jones'" , David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The Makefile installs symbolic links by default, which actually worked at some point (not by design) with SELinux, but at least on recent kernel versions it doesn't anymore: override pasta (and pasta.avx2) with hard links. Otherwise, even if the links are labeled as pasta_exec_t, SELinux will "resolve" them to passt_exec_t, and we'll have pasta running as passt_t instead of pasta_t. Signed-off-by: Stefano Brivio --- contrib/fedora/passt.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 8d28ef6..49b4860 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -55,9 +55,13 @@ This package adds SELinux enforcement to passt(1) and pasta(1). %install %make_install DESTDIR=%{buildroot} prefix=%{_prefix} bindir=%{_bindir} mandir=%{_mandir} docdir=%{_docdir}/%{name} +# The Makefile simply links pasta to passt, but we need to copy the binary for +# SELinux file contexts to work as intended. Same with pasta.avx2 if present. +install -p -m 755 %{buildroot}%{_bindir}/passt %{buildroot}%{_bindir}/pasta %ifarch x86_64 ln -sr %{buildroot}%{_mandir}/man1/passt.1 %{buildroot}%{_mandir}/man1/passt.avx2.1 ln -sr %{buildroot}%{_mandir}/man1/pasta.1 %{buildroot}%{_mandir}/man1/pasta.avx2.1 +install -p -m 755 %{buildroot}%{_bindir}/passt.avx2 %{buildroot}%{_bindir}/pasta.avx2 %endif pushd contrib/selinux -- 2.39.2