Skip to content

Increase selinux coverage of the host system #2849

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 50 commits into
base: main
Choose a base branch
from

Conversation

krnowak
Copy link
Member

@krnowak krnowak commented Apr 24, 2025

CI: http://jenkins.infra.kinvolk.io:8080/job/container/job/sdk/2052/cldsv/

  • switch to selinux profiles
  • add more sec-policy packages
  • do some cleanups in profiles wrt selinux, audit, python, perl and caps USE flags

TODO:

  • mask python files from sys-libs/libselinux for generic images
  • drop systemd patch that removes selinux checks

krnowak added 29 commits April 29, 2025 13:29
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
krnowak added 21 commits April 29, 2025 13:29
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
It's from Gentoo commit 1d834aa9c6f8d981b720a18aa74907f84e9e27bf.
Not needed given that we have switched to selinux profile, which
enables selinux USE.
… packages

selinux profile enables the USE flags for all of them.
The USE=caps is only relevant for smartd, which we are not building
anyway.
It's from Gentoo commit 86b69b5955e3e452220825a0d3e8ab4224041b42.
It's from Gentoo commit b854c7e78dfbd4c9afcadf9d2beb92e9cd24424b.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant