Skip to content

Commit

Permalink
libostree: write selinux xattr when on non-selinux systems
Browse files Browse the repository at this point in the history
Currently when writing data for selinux systems on a non-selinux
system there will be no labels. This is because
`ostree_sepolicy_setfscreatecon()` just returns TRUE on non-selinux
systems and xattr writing for `security.seliux` is filtered out.

This patches uses the suggestion of Colin Walters (thanks!) from
#2804 and detects if
the host has selinux enabled and if not just skips filtering the
xattrs for selinux.
  • Loading branch information
mvo5 committed Jan 31, 2024
1 parent 0b0485c commit 0463b26
Show file tree
Hide file tree
Showing 3 changed files with 17 additions and 2 deletions.
4 changes: 2 additions & 2 deletions src/libostree/ostree-repo-checkout.c
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,7 @@ create_file_copy_from_input_at (OstreeRepo *repo, OstreeRepoCheckoutAtOptions *o
g_autoptr (GVariant) modified_xattrs = NULL;

/* If we're doing SELinux labeling, prepare it */
if (sepolicy_enabled)
if (sepolicy_enabled && ostree_sepolicy_host_enabled (options->sepolicy))
{
/* If doing sepolicy path-based labeling, we don't want to set the
* security.selinux attr via the generic xattr paths in either the symlink
Expand Down Expand Up @@ -1045,7 +1045,7 @@ checkout_tree_at_recurse (OstreeRepo *self, OstreeRepoCheckoutAtOptions *options
};

/* If we're doing SELinux labeling, prepare it */
if (sepolicy_enabled)
if (sepolicy_enabled && ostree_sepolicy_host_enabled (options->sepolicy))
{
/* We'll set the xattr via setfscreatecon(), so don't do it via generic xattrs below. */
modified_xattrs = _ostree_filter_selinux_xattr (xattrs);
Expand Down
12 changes: 12 additions & 0 deletions src/libostree/ostree-sepolicy.c
Original file line number Diff line number Diff line change
Expand Up @@ -753,3 +753,15 @@ _ostree_filter_selinux_xattr (GVariant *xattrs)
return NULL;
return g_variant_ref_sink (g_variant_builder_end (&builder));
}

/**
* ostree_sepolicy_host_enabled:
* @self: Policy
*
* Return if the host has selinux enabled
*/
gboolean
ostree_sepolicy_host_enabled (OstreeSePolicy *self)
{
return cached_is_selinux_enabled ();
}
3 changes: 3 additions & 0 deletions src/libostree/ostree-sepolicy.h
Original file line number Diff line number Diff line change
Expand Up @@ -77,4 +77,7 @@ void ostree_sepolicy_fscreatecon_cleanup (void **unused);
#define ostree_cleanup_sepolicy_fscreatecon \
__attribute__ ((cleanup (ostree_sepolicy_fscreatecon_cleanup)))

_OSTREE_PUBLIC
gboolean ostree_sepolicy_host_enabled (OstreeSePolicy *self);

G_END_DECLS

0 comments on commit 0463b26

Please sign in to comment.