From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=danishpraka.sh Authentication-Results: passt.top; dkim=pass (2048-bit key; unprotected) header.d=danishpraka.sh header.i=@danishpraka.sh header.a=rsa-sha256 header.s=fm1 header.b=aREfUp2W; dkim=pass (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=hA8cYPKv; dkim-atps=neutral Received: from fhigh-a2-smtp.messagingengine.com (fhigh-a2-smtp.messagingengine.com [103.168.172.153]) by passt.top (Postfix) with ESMTPS id 7DF2B5A0619 for ; Thu, 30 Oct 2025 09:37:30 +0100 (CET) Received: from phl-compute-11.internal (phl-compute-11.internal [10.202.2.51]) by mailfhigh.phl.internal (Postfix) with ESMTP id 981E01400214; Thu, 30 Oct 2025 04:37:29 -0400 (EDT) Received: from phl-mailfrontend-02 ([10.202.2.163]) by phl-compute-11.internal (MEProxy); Thu, 30 Oct 2025 04:37:29 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=danishpraka.sh; h=cc:cc:content-transfer-encoding:content-type:content-type :date:date:from:from:in-reply-to:in-reply-to:message-id :mime-version:references:reply-to:subject:subject:to:to; s=fm1; t=1761813449; x=1761899849; bh=0Gaz62wEb0w7PoCU6rXtFzc9aJV2YYyW +N4286egam0=; b=aREfUp2WFHWz2OldJqZDeq4k+WqIXVdvQiQMgnb0dZT1SY2u UBtJgiViWZufmID9gmIsxlhjKaiI6+xU/PAM89y0XFPKgiYUrvrZ2V6h0kepb46Z W3vukr9w2E3DuDCprjtGSkTLVgIEXVM4r/1RIio2ijyeELrSAp+O972rzMfhUnJt W8RRlBOj0C9wsWibOKxk0sLyZ6ORiQvRQrCSGV1MhOJqfSTKhp8wJ8EMn5LiAgKU 6arbOX4ug2D77EtSG/uQeEPR91dOisLz77f6gDprQode9rUylsSc7esH+JbFAGQz S45ue/O6qtrURBd6VrAi6JHWzczt5kh+i/3R1w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1761813449; x= 1761899849; bh=0Gaz62wEb0w7PoCU6rXtFzc9aJV2YYyW+N4286egam0=; b=h A8cYPKvnWv39QydvSanKLHFhwPgetk1LTa9kzIyxh8oQyoSo0DygPyt81aeHrYY6 dMyRUVEnl9pp4H71UAk8GxZeNZ+ztzVj0cgLzattXWRqA3NoETiZuOIBPRWOWB3V XVqAjlmAwrI0M1UZNugHcY4KfBfeBIrAT/FyHWj00xmzPzegjghwZ3151T9oMpfn ZygTy+P/qvrKVyL9BkN/Qqn9FjsKNkKnxNk2BRdPCzIb10kqEuTarBE8L2dmWHW0 ZXWRPGqiiOq3UkWQ0h8loCovpgG7jL5mBY83CYePRm/5BaMzTtulvBB8SiZ/6pL2 oXu6vgVE6YFBk2mjy8XRA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdeggdduieeiudehucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfurfetoffkrfgpnffqhgenuceu rghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujf gurhepkfffgggfuffvvehfhfgjtgfgsehtjeertddtvdejnecuhfhrohhmpeffrghnihhs hhcurfhrrghkrghshhcuoegtohhnthgrtghtsegurghnihhshhhprhgrkhgrrdhshheqne cuggftrfgrthhtvghrnheptdehjeekhfdthfevleelheffuddvffdvveeihefhkeeuueeh tefgleevfeevieegnecuffhomhgrihhnpehgihhthhhusgdrtghomhdprhgvughhrghtrd gtohhmpdhprghsshhtrdhtohhppdhfvgguohhrrghinhhfrhgrtghlohhuugdrohhrghdp shhushgvrdgtohhmnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilh hfrhhomheptghonhhtrggtthesuggrnhhishhhphhrrghkrgdrshhhpdhnsggprhgtphht thhopeegpdhmohguvgepshhmthhpohhuthdprhgtphhtthhopehssghrihhvihhosehrvg guhhgrthdrtghomhdprhgtphhtthhopehgihhtsehmrgigtghhvghrnhhofhhfrdgtrgdp rhgtphhtthhopehprghsshhtqdguvghvsehprghsshhtrdhtohhppdhrtghpthhtohepph hhohhliihinhhgsehrvgguhhgrthdrtghomh X-ME-Proxy: Feedback-ID: i59a6483a:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 30 Oct 2025 04:37:27 -0400 (EDT) Message-ID: <3c6a267c-36e0-4925-b7af-cea641e3e6f0@danishpraka.sh> Date: Thu, 30 Oct 2025 14:07:16 +0530 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] contrib/selinux: use regex instead of non-standard bash macro To: Stefano Brivio References: <20251016074045.562352-1-contact@danishpraka.sh> <20251016102134.5e2edf04@elisabeth> <3aad50bb-aab8-423f-9730-21f9a3b3de78@danishpraka.sh> <20251027100721.46269f56@elisabeth> <20251029001704.43f73a42@elisabeth> Content-Language: en-US From: Danish Prakash In-Reply-To: <20251029001704.43f73a42@elisabeth> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-MailFrom: contact@danishpraka.sh X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: ZDWXDGZJCHLGXTQTTXT4EKEPOQFPZP7V X-Message-ID-Hash: ZDWXDGZJCHLGXTQTTXT4EKEPOQFPZP7V X-Mailman-Approved-At: Thu, 30 Oct 2025 09:41:55 +0100 CC: Max Chernoff , passt-dev@passt.top, Paul Holzinger X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 10/29/25 4:47 AM, Stefano Brivio wrote: > On Tue, 28 Oct 2025 11:58:18 +0530 > Danish Prakash wrote: > >> On 10/27/25 2:37 PM, Stefano Brivio wrote: >>> Hi Danish, >>> >>> On Mon, 27 Oct 2025 14:19:14 +0530 >>> Danish Prakash wrote: >>> >>>> On 10/16/25 4:26 PM, Max Chernoff wrote: >>>>> Hi Stefano, >>>>> >>>>> On Thu, 2025-10-16 at 10:21 +0200, Stefano Brivio wrote: >>>>>> On Thu, 16 Oct 2025 13:10:41 +0530 >>>>>> Danish Prakash wrote: >>>>>>> It might be possible to avoid using non-standard bash macro (%USERID), >>>>> >>>>> It's not a Bash macro, it's a SELinux template. This doesn't seem to be >>>>> documented anywhere (which isn't terribly surprising with SELinux), but >>>>> it's defined in this file: >>>>> >>>>> https://github.com/SELinuxProject/selinux/blob/ceb5b221/libsemanage/src/genhomedircon.c >>>> >>>> Thanks Max, I wasn't aware of it being an SELinux template. >>>> >>>>> >>>>>> I wonder if >>>>>> Max remembers any reason why we couldn't do this in the first place. >>>>> >>>>> The Fedora SELinux policy always uses %{USERID}, and so I copied it from >>>>> there: >>>>> >>>>> $ grep -RnF '%{USERID}' policy/ >>>>> policy/modules/contrib/dbus.fc:29:/run/user/%{USERID}/bus -s gen_context(system_u:object_r:session_dbusd_tmp_t,s0) >>>>> policy/modules/contrib/dbus.fc:30:/run/user/%{USERID}/dbus(/.*)? gen_context(system_u:object_r:session_dbusd_tmp_t,s0) >>>>> policy/modules/contrib/dbus.fc:31:/run/user/%{USERID}/dbus-1(/.*)? gen_context(system_u:object_r:session_dbusd_tmp_t,s0) >>>>> policy/modules/contrib/gnome.fc:25:/run/user/%{USERID}/\.orc(/.*)? gen_context(system_u:object_r:gstreamer_home_t,s0) >>>>> policy/modules/contrib/gnome.fc:26:/run/user/%{USERID}/dconf(/.*)? gen_context(system_u:object_r:config_home_t,s0) >>>>> policy/modules/contrib/gnome.fc:27:/run/user/%{USERID}/keyring.* gen_context(system_u:object_r:gkeyringd_tmp_t,s0) >>>>> policy/modules/kernel/filesystem.fc:17:/run/user/%{USERID}/gvfs -d gen_context(system_u:object_r:fusefs_t,s0) >>>>> policy/modules/kernel/filesystem.fc:18:/run/user/%{USERID}/gvfs/.* <> >>>>> policy/modules/system/userdomain.fc:38:/run/user/%{USERID} -d gen_context(system_u:object_r:user_tmp_t,s0) >>>>> policy/modules/system/userdomain.fc:39:/run/user/%{USERID}/.+ <> >>>>> >>>>> $ grep -RnF '[0-9]+' policy/ | grep -v /dev/ >>>>> policy/modules/contrib/rpm.fc:52:/usr/bin/rhn_check-[0-9]+\.[0-9]+ -- gen_context(system_u:object_r:rpm_exec_t,s0) >>>>> policy/modules/contrib/soundserver.fc:12:/run/yiff-[0-9]+\.pid -- gen_context(system_u:object_r:soundd_var_run_t,s0) >>>>> policy/modules/kernel/devices.if:6958:## Allow read the hfi1_[0-9]+ devices >>>>> >>>>>>> diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec >>>>>>> index 663289f53d97..d1bcf4a74338 100644 >>>>>>> --- a/contrib/fedora/passt.spec >>>>>>> +++ b/contrib/fedora/passt.spec >>>>>>> [...] >>>>>> >>>>>> At a glance, this looks like a better solution regardless of the >>>>>> reported issue. It sounds too good to be true, though >>>>> >>>>> I agree that it looks like a good solution, which makes me wonder why >>>>> the base SELinux policies don't do it that way. The containers SELinux >>>>> policy appears to do things this way >>>>> >>>>> $ grep -RnF '[0-9]+' >>>>> container_selinux.8:166: /run/user/[0-9]+/gvfs >>>>> $ grep -RnF '%{USERID}'; echo $? >>>>> 1 >>>>> >>>>> so it's probably (?) okay though. >>>> >>>> That's helpful, I guess we can go ahead with this. Stefano, Paul? >>> >>> Sure. But back to my question about the original problem... what was >>> the original problem? :) Could it be something similar to: >>> >>> https://bugzilla.redhat.com/show_bug.cgi?id=2401764 >>> >>> ? >> >> Ah, sorry about that. No, it's not a functionality issue or a bug. It >> was merely a few suggestions to improve the passt SUSE package from the >> SELinux team at SUSE. Here are the suggestions: > > Thanks for sharing those. > >> 1. building twice is quite a hack, setting a hardlink as in apparmor >> would probably work as well and is less confusing > > Details as to why it doesn't work: > > https://passt.top/passt/commit/?id=a405d0c026582375448fe87c6e440eb0fd428dd7 > >> 2. running restorecon would be unnecessary if the passt upstream >> selinux module would not use ${USERID} in pasta.fc (gets converted to >> [0-9]+ anyway) > > Would you be so kind as to re-post this patch (Cc'ing Max and Paul) with > a commit message reflecting this, and without private links? Sent updated patch, I wonder why it didn't show up in this thread, I did include the message-id of the original message. > >> 3. there is a %selinux_requires macro in selinux-policy-devel that >> likely could be used instead of listing the Requires:, but okay we dont >> enforce that atm >> >> For #1 I can see that building twice is required in this case, and >> unlike apparmor which can work with hardlinks, doing the same for >> SELinux isn't possible with inodes in the picture. > > Right, yeah, it's because labels are stored in extended attributes, and > those belong to inodes, not paths. > >> #2 is what this patch is about, and #3 is SUSE-exclusive which I'm >> fixing in parallel. > > If I recall correctly, that part of openSUSE spec file is roughly taken > from: > > https://passt.top/passt/tree/contrib/fedora/passt.spec > > and I build openSUSE packages in my Copr repository too > (https://copr.fedorainfracloud.org/coprs/sbrivio/passt/), based on the > Fedora spec file. > > I'm not sure if it's useful for many people (one can try out an > upstream release right away like that) but it's almost zero effort on > my side. In any case, if the change also applies to Fedora or openSUSE > packages from Copr I guess it would be nice to have a patch for that as > well. Yes, the spec is taken from fedora. And now that you mention it, I can see there's a similar %selinux_requires macro in fedora as well--taken by openSUSE presumably. So I guess, I can send that change across as well. > >>> In general, there are a bunch of current SELinux issues reported on >>> Fedora/RHEL (and I assume they would be exactly the same on >>> openSUSE/SLES): >>> >>> https://bugzilla.redhat.com/buglist.cgi?bug_status=__open__&columnlist=short_desc%2Cchangeddate%2Cbug_severity&component=passt&product=Fedora >>> >>> and I'm trying to find out if this change might fix some of them. Most >>> of those are stuff I didn't investigate yet. >>> >> >> Unfortunately no, I was notified of a few spec related errors from >> colleagues, but I'm sure the errors would overlap, as you said. If >> there's something I can help, please let me know, I'll be happy to >> contribute. > > Thanks. I still need to find a moment to go through all of them with a > bit more time and I'll let you know, in case. > > Well, of course, if you want to have a look meanwhile, that might help. > You would need an account at bugzilla.redhat.com to comment but, well, I > have an account on bugzilla.suse.com, so... :) > Happy to help, I'll create that coveted account :) -- danishpraka.sh