Enable SELinux

Author: joshwget

Dockerfile.dapper

@@ -2,7 +2,7 @@ FROM ubuntu:15.10
 
 RUN apt-get update && \
     apt-get -y install locales sudo vim less curl wget git rsync build-essential syslinux isolinux xorriso \
-        libblkid-dev libmount-dev libselinux1-dev cpio genisoimage qemu-kvm python-pip ca-certificates
+        libblkid-dev libmount-dev libselinux1-dev cpio genisoimage qemu-kvm python-pip ca-certificates pkg-config
 
 RUN locale-gen en_US.UTF-8
 ENV LANG en_US.UTF-8

Makefile

@@ -27,6 +27,9 @@ assets/docker:
 	curl -L "$(DOCKER_BINARY_URL)" > $@
 	chmod +x $@
 
+assets/selinux/policy.29:
+	mkdir -p $(dir $@)
+	curl -L "$(SELINUX_POLICY_URL)" > $@
 
 ifdef COMPILED_KERNEL_URL
 
@@ -43,7 +46,7 @@ $(BUILD)/kernel/:
 	curl -L "$(COMPILED_KERNEL_URL)" | tar -xzf - -C $@
 
 
-$(DIST)/artifacts/initrd: bin/ros assets/docker $(BUILD)/kernel/ $(BUILD)/images.tar
+$(DIST)/artifacts/initrd: bin/ros assets/docker assets/selinux/policy.29 $(BUILD)/kernel/ $(BUILD)/images.tar
 	mkdir -p $(dir $@)
 	ARCH=$(ARCH) DFS_IMAGE=$(DFS_IMAGE) DEV_BUILD=$(DEV_BUILD) ./scripts/mk-initrd.sh $@
 

assets/selinux/config

@@ -0,0 +1,2 @@
+SELINUX=permissive
+SELINUXTYPE=ros

assets/selinux/failsafe_context

@@ -0,0 +1 @@
+system_r:kernel_t:s0

assets/selinux/lxc_contexts

@@ -0,0 +1,3 @@
+process = "system_u:system_r:svirt_lxc_net_t:s0"
+content = "system_u:object_r:virt_var_lib_t:s0"
+file = "system_u:object_r:svirt_lxc_file_t:s0"

assets/selinux/seusers

@@ -0,0 +1 @@
+__default__:system_u:s0-s0

build.conf

@@ -1,3 +1,4 @@
 IMAGE_NAME=rancher/os
 VERSION=v0.4.4-dev
 DFS_IMAGE=rancher/docker:v1.10.1
+SELINUX_POLICY_URL=https://github.com/rancher/refpolicy/releases/download/v0.0.1/policy.29

init/init.go

@@ -220,6 +220,10 @@ func RunInit() error {
 			return config.LoadConfig()
 		},
 		loadModules,
+		func(c *config.CloudConfig) (*config.CloudConfig, error) {
+			return c, dockerlaunch.PrepareFs(&mountConfig)
+		},
+		initializeSelinux,
 		sysInit,
 	}
 
@@ -236,5 +240,6 @@ func RunInit() error {
 	if err != nil {
 		return err
 	}
+
 	return pidOne()
 }

init/selinux.go

@@ -0,0 +1,32 @@
+// +build linux
+
+package init
+
+import (
+	log "github.com/Sirupsen/logrus"
+	"github.com/rancher/os/config"
+	"github.com/rancher/os/selinux"
+	"io/ioutil"
+)
+
+func initializeSelinux(c *config.CloudConfig) (*config.CloudConfig, error) {
+	ret, _ := selinux.InitializeSelinux()
+
+	if ret != 0 {
+		log.Debug("Unable to initialize SELinux")
+		return c, nil
+	}
+
+	// Set allow_execstack boolean to true
+	if err := ioutil.WriteFile("/sys/fs/selinux/booleans/allow_execstack", []byte("1"), 0644); err != nil {
+		log.Debug(err)
+		return c, nil
+	}
+
+	if err := ioutil.WriteFile("/sys/fs/selinux/commit_pending_bools", []byte("1"), 0644); err != nil {
+		log.Debug(err)
+		return c, nil
+	}
+
+	return c, nil
+}

os-config.yml

@@ -262,6 +262,7 @@ rancher:
       - /etc/resolv.conf:/etc/resolv.conf
       - /etc/rkt:/etc/rkt
       - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt.rancher
+      - /etc/selinux:/etc/selinux
       - /lib/firmware:/lib/firmware
       - /lib/modules:/lib/modules
       - /run:/run