3c556c3386
Allow osbuild_t to no_new_privs (nnp) and nosuid domain transition into setfiles_mac_t and install_t. nnp is a inheritable per-thread flag (PR_SET_NO_NEW_PRIVS, see prctl(2)), whereby a promise is made by execve(2) to not grant any new privileges that could not have been done without the execv call. This is on contrast to what can be done via SELinux rules, i.e. in our case `setfiles_mac_t` and `install_t` can set arbitrary SELinux labels, but `osbuild_t` itself can not; but `osbuild_t` enables the transitioning of `setfiles_mac_t` for the `setfiles` binary via execve(2) from a process with `osbuild_t`. Related, the nosuid mount flag, prevents the suid, sgid bits to be interpreted and thus are in the same spirit as nnp, i.e. no new privs during execve(2). Thus SELinux domain transitions stand in contrast with nnp and nosuid transitions, and have therefore been de-coupled. See also the corresponding kernel patch at [1] for more information. bubblewrap (bwrap) in contrast to `systemd-nspawn` always sets the nnp flag, as well as the nosuid option for all bind-mounts. Since we no use bwrap to contain processes we need to allow the nnp and nosuid transitions from `osbuild_t` to `setfiles_mac_t` and `install_t`. [1] https://patchwork.kernel.org/patch/9841441/ |
||
|---|---|---|
| .github/workflows | ||
| assemblers | ||
| docs | ||
| osbuild | ||
| runners | ||
| samples | ||
| schemas | ||
| schutzbot | ||
| selinux | ||
| sources | ||
| stages | ||
| test | ||
| tools | ||
| .editorconfig | ||
| .gitignore | ||
| .pylintrc | ||
| .travis.yml | ||
| LICENSE | ||
| Makefile | ||
| NEWS.md | ||
| osbuild.spec | ||
| README.md | ||
| requirements.txt | ||
| setup.py | ||
OSBuild
Build-Pipelines for Operating System Artifacts
OSBuild is a pipeline-based build system for operating system artifacts. It defines a universal pipeline description and a build system to execute them, producing artifacts like operating system images, working towards an image build pipeline that is more comprehensible, reproducible, and extendable.
See the osbuild(1) man-page for details on how to run osbuild, the definition
of the pipeline description, and more.
Project
- Website: https://www.osbuild.org
- Bug Tracker: https://github.com/osbuild/osbuild/issues
Requirements
The requirements for this project are:
bubblewrap >= 0.4.0python >= 3.7
Additionally, the built-in stages require:
bash >= 5.0coreutils >= 8.31curl >= 7.68qemu-img >= 4.2.0rpm >= 4.15tar >= 1.32util-linux >= 235
At build-time, the following software is required:
python-docutils >= 0.13pkg-config >= 0.29
Build
The standard python package system is used. Consult upstream documentation for detailed help. In most situations the following commands are sufficient to build and install from source:
python setup.py build
python setup.py install --skip-build --root=/
The man-pages require python-docutils and can be built via:
rst2man docs/<input-file>.rst <output-file>
Repository:
- web: https://github.com/osbuild/osbuild
- https:
https://github.com/osbuild/osbuild.git - ssh:
git@github.com:osbuild/osbuild.git
License:
- Apache-2.0
- See LICENSE file for details.