Re: [PATCH 1/7] fedora: Install pasta as hard link to ensure SELinux file context match

["Richard W.M. Jones" <rjones@redhat.com>]

On Wed, Aug 16, 2023 at 08:00:32AM +0200, Stefano Brivio wrote:
> The Makefile installs symbolic links by default, which actually
> worked at some point (not by design) with SELinux, but at least on
> recent kernel versions it doesn't anymore: override pasta (and
> pasta.avx2) with hard links.
> 
> Otherwise, even if the links are labeled as pasta_exec_t, SELinux
> will "resolve" them to passt_exec_t, and we'll have pasta running as
> passt_t instead of pasta_t.

The patch and this cover note don't seem to do the same thing.  It
appears to copy the binary, not make a hard link.  (The comment in the
spec file seems to be correct.)

It does appear to be possible to label symbolic links:

$ touch test1
$ chcon system_u:object_r:bin_t:s0 test1
$ ln -s test1 test2
$ chcon -h system_u:object_r:tmp_t:s0 test2
$ ll -Z test1 test2
-rw-r--r--. 1 rjones rjones system_u:object_r:bin_t:s0 0 Aug 16 10:00 test1
lrwxrwxrwx. 1 rjones rjones system_u:object_r:tmp_t:s0 5 Aug 16 10:00 test2 -> test1

(which surprised me).  But I don't know if SELinux does the right
thing or not in this case, or if something has changed in the kernel,
so I can't comment if copying is right or not.

Rich.

> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
> ---
>  contrib/fedora/passt.spec | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec
> index 8d28ef6..49b4860 100644
> --- a/contrib/fedora/passt.spec
> +++ b/contrib/fedora/passt.spec
> @@ -55,9 +55,13 @@ This package adds SELinux enforcement to passt(1) and pasta(1).
>  
>  %install
>  %make_install DESTDIR=%{buildroot} prefix=%{_prefix} bindir=%{_bindir} mandir=%{_mandir} docdir=%{_docdir}/%{name}
> +# The Makefile simply links pasta to passt, but we need to copy the binary for
> +# SELinux file contexts to work as intended. Same with pasta.avx2 if present.
> +install -p -m 755 %{buildroot}%{_bindir}/passt %{buildroot}%{_bindir}/pasta
>  %ifarch x86_64
>  ln -sr %{buildroot}%{_mandir}/man1/passt.1 %{buildroot}%{_mandir}/man1/passt.avx2.1
>  ln -sr %{buildroot}%{_mandir}/man1/pasta.1 %{buildroot}%{_mandir}/man1/pasta.avx2.1
> +install -p -m 755 %{buildroot}%{_bindir}/passt.avx2 %{buildroot}%{_bindir}/pasta.avx2
>  %endif
>  
>  pushd contrib/selinux
> -- 
> 2.39.2

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org