fix(-dx): Workaround swtpm SELinux issues #764
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
swtpm has the wrong SELinux labels. You This is a deficiency with the OCI build process for ostree. Libvirt is shipped with -dx image. This pulls in swtpm. On the discord there has been numerous callouts to issues with swtpm being broken. This should be a sufficient workaround for the time being. Compared to my original implementation, I've changed the binary location from /usr/local/bin to /tmp and using a tmpfile to create the required directory for the swtpm-rootca. swtpm is only 42K and we do not set noexec on tmp.
Instead of calling a script, we can do everything inside of the systemd oneshot service file. The semanage line appears to not be needed. Since the correct file context already exists.Working out of /tmp doesn't seem to always work and a symlink to /usr/local/bin doesn't resolve it. Instead, use /usr/local/bin directly. tmpfiles.d is used to copy swtpm into place and make sure that the swtpm-rootca directory exists. Instead of including a .mount unit for the bind mount, I'm using mount directly and cleaning up. This seemed to result in faster boots than using .mount unit and allows us to clean up the changes in /usr/local/bin.
Instead of calling a script, we can do everything inside of the systemd oneshot service file. The semanage line appears to not be needed. Since the correct file context already exists.Working out of /tmp doesn't seem to always work and a symlink to /usr/local/bin doesn't resolve it. Instead, use /usr/local/bin directly. tmpfiles.d is used to copy swtpm into place and make sure that the swtpm-localca directory exists and is owned by user tss. Instead of including a .mount unit for the bind mount, I'm using mount directly and cleaning up. This seemed to result in faster boots than using .mount unit and allows us to clean up the changes in /usr/local/bin.
|
Instead of calling a script, we can do everything just in the oneshot. We can also clean up after ourselves with ExecStop lines. Instead of using a .mount file, I call mount directly in the unit file. This "works" but a mount file would be better but seemed to slow down boot for some odd reason and makes it so we can't as easily clean up after ourselves. Additionally use tmpfiles.d to create a copy in the beginning and make sure that /var/lib/swtpm-localca exists and is owned by tss. Additionally, using /tmp doesn't seem to work consistently so placed back in /usr/local/bin. I prefixed the binary with a . to help avoid a name collision and clean it up when the service exits. |
bketelsen
approved these changes
Jan 1, 2024
KyleGospo
approved these changes
Jan 1, 2024
wizzywizard65
pushed a commit
to wizzywizard65/bluefin
that referenced
this pull request
Jan 2, 2024
Co-authored-by: Brian Ketelsen <[email protected]>
awesomekyle
pushed a commit
to awesomekyle/bluefin
that referenced
this pull request
Apr 24, 2024
Co-authored-by: Brian Ketelsen <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
swtpm has the wrong SELinux labels. You This is a deficiency with the OCI build process for ostree.
Libvirt is shipped with -dx image. This pulls in swtpm. On the discord there has been numerous callouts to issues with swtpm being broken. This should be a sufficient workaround for the time being. Compared to my original implementation, I've changed the binary location from /usr/local/bin to /tmp and using a tmpfile to create the required directory for the swtpm-rootca. swtpm is only 42K and we do not set noexec on tmp.