From 2d95d34bb6715cd291eaeebc932ed4af9cb368ac Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Tue, 13 Feb 2024 09:50:37 -0500 Subject: [PATCH] Ensure root_t label for /store The way osbuild works is to synthesize a filesystem tree in the store, then copy it to the disk. This ensures the label for the store is `root_t` which ends up being the labeling for the "infrastructure" bits in the `/ostree` repository in the target root. This in turn is blocking a lot of things. Closes: https://github.com/osbuild/bootc-image-builder/issues/149 --- bib/internal/setup/setup.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/bib/internal/setup/setup.go b/bib/internal/setup/setup.go index d6d4d54..d29f72c 100644 --- a/bib/internal/setup/setup.go +++ b/bib/internal/setup/setup.go @@ -12,13 +12,21 @@ import ( // EnsureEnvironment mutates external filesystem state as necessary // to run in a container environment. This function is idempotent. -func EnsureEnvironment() error { +func EnsureEnvironment(storePath string) error { osbuildPath := "/usr/bin/osbuild" if util.IsMountpoint(osbuildPath) { return nil } - // A hardcoded security label from Fedora derivatives + // Forcibly label the store to ensure we're not grabbing container labels + rootType := "system_u:object_r:root_t:s0" + // This papers over the lack of ensuring correct labels for the /ostree root + // in the existing pipeline + if err := util.RunCmdSync("chcon", rootType, storePath); err != nil { + return err + } + + // A hardcoded security label from Fedora derivatives for osbuild // TODO: Avoid hardcoding this by using either host policy lookup // Or eventually depend on privileged containers just having this capability. //