Skip to content

Increase selinux coverage of the host system #2849

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 65 commits into
base: main
Choose a base branch
from

Conversation

krnowak
Copy link
Member

@krnowak krnowak commented Apr 24, 2025

CI: http://jenkins.infra.kinvolk.io:8080/job/container/job/sdk/2052/cldsv/

  • switch to selinux profiles
  • add more sec-policy packages
  • do some cleanups in profiles wrt selinux, audit, python, perl and caps USE flags

TODO:

  • mask python files from sys-libs/libselinux for generic images
  • drop systemd patch that removes selinux checks

krnowak added 17 commits May 9, 2025 12:42
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
krnowak added 28 commits May 9, 2025 12:42
Not needed given that we have switched to selinux profile, which
enables selinux USE.
… packages

selinux profile enables the USE flags for all of them.
The USE=caps is only relevant for smartd, which we are not building
anyway.
It's from Gentoo commit 86b69b5955e3e452220825a0d3e8ab4224041b42.
It's from Gentoo commit b854c7e78dfbd4c9afcadf9d2beb92e9cd24424b.
It's from Gentoo commit dd8f1e13525265315752f252be7515f18e80334a.
It's from Gentoo commit 4d201521b008785972a1f31e1284ecb847dc3831.
It's from Gentoo commit 122ebce35d3db79069ed3cdf59247dffcb74d92a.
@krnowak krnowak force-pushed the krnowak/selinux-coverage branch from f53a575 to fc92672 Compare May 9, 2025 10:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant