|
Bugzilla – Full Text Bug Listing |
| Summary: | [SELinux] Installing container-selinux with the testing selinux policy causes SLES15SP4 to be unreachable | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE Tumbleweed | Reporter: | Maxwell Ross <mross> |
| Component: | Security | Assignee: | Johannes Segitz <jsegitz> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | jsegitz, mross |
| Version: | Current | ||
| Target Milestone: | --- | ||
| Hardware: | x86-64 | ||
| OS: | SLES 15 | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Maxwell Ross
2023-06-02 18:40:24 UTC
You say that you use the legacy policy, but that doesn't seem to be the case. Please try again and strictly follow https://documentation.suse.com/sles/15-SP4/html/SLES-all/cha-selinux.html I believe the problem is that the legacy selinux policy, obtained from https://documentation.suse.com/sles/15-SP4/html/SLES-all/cha-selinux.html#sec-selinux-getpolicy, is not configured properly for the latest container-selinux. Details BEFORE installing container-selinux: ec2-user@ip-172-31-29-63:~> hostnamectl | grep "Operating System" Operating System: SUSE Linux Enterprise Server 15 SP4 ec2-user@ip-172-31-29-63:~> sudo sestatus SELinux status: enabled SELinuxfs mount: /sys/fs/selinux SELinux root directory: /etc/selinux Loaded policy name: targeted Current mode: permissive Mode from config file: permissive Policy MLS status: enabled Policy deny_unknown status: allowed Memory protection checking: requested (insecure) Max kernel policy version: 33 ec2-user@ip-172-31-29-63:~> sudo zypper info selinux-policy Refreshing service 'Basesystem_Module_x86_64'. Refreshing service 'Containers_Module_x86_64'. Refreshing service 'Desktop_Applications_Module_x86_64'. Refreshing service 'Development_Tools_Module_x86_64'. Refreshing service 'Legacy_Module_x86_64'. Refreshing service 'Public_Cloud_Module_x86_64'. Refreshing service 'Python_3_Module_x86_64'. Refreshing service 'SUSE_Linux_Enterprise_Server_x86_64'. Refreshing service 'Server_Applications_Module_x86_64'. Refreshing service 'Web_and_Scripting_Module_x86_64'. Loading repository data... Reading installed packages... Information for package selinux-policy: --------------------------------------- Repository : SELinux-Legacy Name : selinux-policy Version : 20220428-150400.2.11 Arch : noarch Vendor : obs://build.opensuse.org/security Support Level : unknown Installed Size : 24.7 KiB Installed : Yes (automatically) Status : up-to-date Source package : selinux-policy-20220428-150400.2.11.src Upstream URL : https://github.com/fedora-selinux/selinux-policy.git Summary : SELinux policy configuration, legacy version for toolchain version < 3.4 Description : SELinux Reference Policy. A complete SELinux policy that can be used as the system policy for a variety of systems and used as the basis for creating other policies. ec2-user@ip-172-31-29-63:~> sudo ausearch -ts today -m avc ---- time->Fri Jun 16 19:00:35 2023 type=AVC msg=audit(1686942035.165:69): avc: denied { transition } for pid=1650 comm="(systemd)" path="/usr/lib/systemd/systemd" dev="nvme0n1p3" ino=25442166 scontext=system_u:system_r:kernel_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=process permissive=1 ---- time->Fri Jun 16 19:00:35 2023 type=AVC msg=audit(1686942035.165:70): avc: denied { entrypoint } for pid=1650 comm="(systemd)" path="/usr/lib/systemd/systemd" dev="nvme0n1p3" ino=25442166 scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=1 --- Attempting to install container-selinux gives the same error as mentioned originally: ec2-user@ip-172-31-29-63:~> sudo restorecon -R / ec2-user@ip-172-31-29-63:~> sudo zypper addrepo https://download.opensuse.org/repositories/security:SELinux/15.4/security:SELinux.repo Adding repository 'SELinux (15.4)' .....................................................................................................................................................................................................[done] Repository 'SELinux (15.4)' successfully added URI : https://download.opensuse.org/repositories/security:/SELinux/15.4/ Enabled : Yes GPG Check : Yes Autorefresh : No Priority : 99 (default priority) Repository priorities are without effect. All enabled repositories share the same priority. ec2-user@ip-172-31-29-63:~> sudo zypper refresh Repository 'SLE-Module-Basesystem15-SP4-Pool' is up to date. Repository 'SLE-Module-Basesystem15-SP4-Updates' is up to date. Repository 'SLE-Module-Containers15-SP4-Pool' is up to date. Repository 'SLE-Module-Containers15-SP4-Updates' is up to date. Repository 'SLE-Module-Desktop-Applications15-SP4-Pool' is up to date. Repository 'SLE-Module-Desktop-Applications15-SP4-Updates' is up to date. Repository 'SLE-Module-DevTools15-SP4-Pool' is up to date. Repository 'SLE-Module-DevTools15-SP4-Updates' is up to date. Repository 'SLE-Module-Legacy15-SP4-Pool' is up to date. Repository 'SLE-Module-Legacy15-SP4-Updates' is up to date. Repository 'SLE-Module-Public-Cloud15-SP4-Pool' is up to date. Repository 'SLE-Module-Public-Cloud15-SP4-Updates' is up to date. Repository 'SLE-Module-Python3-15-SP4-Pool' is up to date. Repository 'SLE-Module-Python3-15-SP4-Updates' is up to date. Repository 'SELinux-Legacy' is up to date. Repository 'SLE-Product-SLES15-SP4-Pool' is up to date. Repository 'SLE-Product-SLES15-SP4-Updates' is up to date. Repository 'SLE-Module-Server-Applications15-SP4-Pool' is up to date. Repository 'SLE-Module-Server-Applications15-SP4-Updates' is up to date. Repository 'SLE-Module-Web-Scripting15-SP4-Pool' is up to date. Repository 'SLE-Module-Web-Scripting15-SP4-Updates' is up to date. New repository or package signing key received: Repository: SELinux (15.4) Key Fingerprint: 06B5 B9E1 5212 34E9 52FE EB7F F692 2B09 93B8 32EE Key Name: security:SELinux OBS Project <security:SELinux@build.opensuse.org> Key Algorithm: DSA 1024 Key Created: Mon 27 Feb 2023 05:17:50 PM UTC Key Expires: Wed 07 May 2025 05:17:50 PM UTC Rpm Name: gpg-pubkey-93b832ee-63fce5be Note: Signing data enables the recipient to verify that no modifications occurred after the data were signed. Accepting data with no, wrong or unknown signature can lead to a corrupted system and in extreme cases even to a system compromise. Note: A GPG pubkey is clearly identified by its fingerprint. Do not rely on the key's name. If you are not sure whether the presented key is authentic, ask the repository provider or check their web site. Many providers maintain a web page showing the fingerprints of the GPG keys they are using. Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?] (r): a Retrieving repository 'SELinux (15.4)' metadata ........................................................................................................................................................................................[done] Building repository 'SELinux (15.4)' cache .............................................................................................................................................................................................[done] All repositories have been refreshed. ec2-user@ip-172-31-29-63:~> sudo zypper install container-selinux Refreshing service 'Basesystem_Module_x86_64'. Refreshing service 'Containers_Module_x86_64'. Refreshing service 'Desktop_Applications_Module_x86_64'. Refreshing service 'Development_Tools_Module_x86_64'. Refreshing service 'Legacy_Module_x86_64'. Refreshing service 'Public_Cloud_Module_x86_64'. Refreshing service 'Python_3_Module_x86_64'. Refreshing service 'SUSE_Linux_Enterprise_Server_x86_64'. Refreshing service 'Server_Applications_Module_x86_64'. Refreshing service 'Web_and_Scripting_Module_x86_64'. Loading repository data... Reading installed packages... Resolving package dependencies... Problem: the to be installed container-selinux-2.215.0-150400.1.4.noarch requires 'selinux-policy >= 20230425-150400.194.9', but this requirement cannot be provided not installable providers: selinux-policy-20230425-150400.194.9.noarch[security_SELinux] Solution 1: Following actions will be done: install selinux-policy-20230425-150400.194.9.noarch from vendor obs://build.opensuse.org/security:SELinux replacing selinux-policy-20220428-150400.2.11.noarch from vendor obs://build.opensuse.org/security install selinux-policy-targeted-20230425-150400.194.9.noarch from vendor obs://build.opensuse.org/security:SELinux replacing selinux-policy-targeted-20220428-150400.2.11.noarch from vendor obs://build.opensuse.org/security install policycoreutils-3.5-150400.183.5.x86_64 from vendor obs://build.opensuse.org/security:SELinux replacing policycoreutils-3.1-150400.1.5.x86_64 from vendor SUSE LLC <https://www.suse.com/> install policycoreutils-lang-3.5-150400.183.5.noarch from vendor obs://build.opensuse.org/security:SELinux replacing policycoreutils-lang-3.1-150400.1.5.noarch from vendor SUSE LLC <https://www.suse.com/> install python3-policycoreutils-3.5-150400.183.5.noarch from vendor obs://build.opensuse.org/security:SELinux replacing python3-policycoreutils-3.1-150400.1.5.noarch from vendor SUSE LLC <https://www.suse.com/> install libselinux1-3.5-150400.175.2.x86_64 from vendor obs://build.opensuse.org/security:SELinux replacing libselinux1-3.1-150400.1.69.x86_64 from vendor SUSE LLC <https://www.suse.com/> install python3-selinux-3.5-150400.175.1.x86_64 from vendor obs://build.opensuse.org/security:SELinux replacing python3-selinux-3.1-150400.1.5.x86_64 from vendor SUSE LLC <https://www.suse.com/> deinstallation of libsemanage1-3.1-150400.1.65.x86_64 install python3-semanage-3.5-150400.111.1.x86_64 from vendor obs://build.opensuse.org/security:SELinux replacing python3-semanage-3.1-150400.1.4.x86_64 from vendor SUSE LLC <https://www.suse.com/> install shadow-4.8.1-150400.10.8.9.x86_64 from vendor obs://build.opensuse.org/security:SELinux replacing shadow-4.8.1-150400.10.3.1.x86_64 from vendor SUSE LLC <https://www.suse.com/> Solution 2: do not install container-selinux-2.215.0-150400.1.4.noarch Solution 3: break container-selinux-2.215.0-150400.1.4.noarch by ignoring some of its dependencies Choose from above solutions by number or cancel [1/2/3/c/d/?] (c): c --- So from my analysis, the problem is here during the container-selinux install: Problem: the to be installed container-selinux-2.215.0-150400.1.4.noarch requires 'selinux-policy >= 20230425-150400.194.9', but this requirement cannot be provided not installable providers: selinux-policy-20230425-150400.194.9.noarch[security_SELinux] Solution 1: Following actions will be done: install selinux-policy-20230425-150400.194.9.noarch from vendor obs://build.opensuse.org/security:SELinux I think the legacy selinux policy may need to be updated to account for this? container-selinux relies on newer policies. I forked an older container-selinux package into security:SELinux_legacy. Please retry and only use the security:SELinux_legacy repository (so make sure security:SELinux is not enabled). Then it should work for you could you please test this? That worked! Thank you for pinning this older version of container-selinux! I am marking this as resolved. |