[OpenWrt-Devel,4/7] include/image.mk: implement SELinux squashfs image generation
diff mbox series

Message ID 20191122095541.688125-5-thomas.petazzoni@bootlin.com
State Changes Requested
Delegated to: Daniel Golle
Headers show
Series
  • SELinux support: core OpenWrt changes
Related show

Commit Message

Thomas Petazzoni Nov. 22, 2019, 9:55 a.m. UTC
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
---
 include/image.mk | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

Comments

Daniel Golle Nov. 28, 2019, 11:01 p.m. UTC | #1
Hi Thomas,

On Fri, Nov 22, 2019 at 10:55:38AM +0100, Thomas Petazzoni wrote:
> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
> ---
>  include/image.mk | 15 ++++++++++++++-
>  1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/include/image.mk b/include/image.mk
> index 8592c19b99..86b3edeb87 100644
> --- a/include/image.mk
> +++ b/include/image.mk
> @@ -239,13 +239,26 @@ endef
>  $(eval $(foreach S,$(JFFS2_BLOCKSIZE),$(call Image/mkfs/jffs2/template,$(S))))
>  $(eval $(foreach S,$(NAND_BLOCKSIZE),$(call Image/mkfs/jffs2-nand/template,$(S))))
>  
> -define Image/mkfs/squashfs
> +define Image/mkfs/squashfs-common
>  	$(STAGING_DIR_HOST)/bin/mksquashfs4 $(call mkfs_target_dir,$(1)) $@ \
>  		-nopad -noappend -root-owned \
>  		-comp $(SQUASHFSCOMP) $(SQUASHFSOPT) \
>  		-processors 1
>  endef
>  
> +ifeq ($(CONFIG_PACKAGE_refpolicy),y)
> +define Image/mkfs/squashfs
> +	echo "LD_LIBRARY_PATH=\$$LD_LIBRARY_PATH:$(STAGING_DIR_HOSTPKG)/lib $(STAGING_DIR_HOSTPKG)/sbin/setfiles -r $(call mkfs_target_dir,$(1)) $(call mkfs_target_dir,$(1))/etc/selinux/targeted/contexts/files/file_contexts $(call mkfs_target_dir,$(1))" > $@.fakeroot-script
> +	echo "$(Image/mkfs/squashfs-common)" >> $@.fakeroot-script
> +	chmod +x $@.fakeroot-script
> +	$(STAGING_DIR_HOST)/bin/fakeroot $@.fakeroot-script
> +endef
> +else
> +define Image/mkfs/squashfs
> +	$(call Image/mkfs/squashfs-common,$(1))
> +endef
> +endif
> +

I thought about introducing fakeroot in a similar way before, but for
different purposes such as having setuid binaries or files owned by
users other than root contained in the rootfs.
Hence I believe it'd be good to always use fakeroot instead of using
'-root-owned', but that's a bit more work...

+1 for your work to enable SELinux in OpenWrt, I'll try to find time
for some testing that.


Cheers


Daniel
Thomas Petazzoni Dec. 9, 2019, 4:02 p.m. UTC | #2
Hello Daniel,

On Fri, 29 Nov 2019 00:01:26 +0100
Daniel Golle <daniel@makrotopia.org> wrote:

> I thought about introducing fakeroot in a similar way before, but for
> different purposes such as having setuid binaries or files owned by
> users other than root contained in the rootfs.

Right, that would indeed allow that. Buildroot uses fakeroot in a
consistent way to build all filesystem images, which allows us to
create files with arbitrary permissions/owernship.

> +1 for your work to enable SELinux in OpenWrt, I'll try to find time
> for some testing that.

Thanks!

Best regards,

Thomas

Patch
diff mbox series

diff --git a/include/image.mk b/include/image.mk
index 8592c19b99..86b3edeb87 100644
--- a/include/image.mk
+++ b/include/image.mk
@@ -239,13 +239,26 @@  endef
 $(eval $(foreach S,$(JFFS2_BLOCKSIZE),$(call Image/mkfs/jffs2/template,$(S))))
 $(eval $(foreach S,$(NAND_BLOCKSIZE),$(call Image/mkfs/jffs2-nand/template,$(S))))
 
-define Image/mkfs/squashfs
+define Image/mkfs/squashfs-common
 	$(STAGING_DIR_HOST)/bin/mksquashfs4 $(call mkfs_target_dir,$(1)) $@ \
 		-nopad -noappend -root-owned \
 		-comp $(SQUASHFSCOMP) $(SQUASHFSOPT) \
 		-processors 1
 endef
 
+ifeq ($(CONFIG_PACKAGE_refpolicy),y)
+define Image/mkfs/squashfs
+	echo "LD_LIBRARY_PATH=\$$LD_LIBRARY_PATH:$(STAGING_DIR_HOSTPKG)/lib $(STAGING_DIR_HOSTPKG)/sbin/setfiles -r $(call mkfs_target_dir,$(1)) $(call mkfs_target_dir,$(1))/etc/selinux/targeted/contexts/files/file_contexts $(call mkfs_target_dir,$(1))" > $@.fakeroot-script
+	echo "$(Image/mkfs/squashfs-common)" >> $@.fakeroot-script
+	chmod +x $@.fakeroot-script
+	$(STAGING_DIR_HOST)/bin/fakeroot $@.fakeroot-script
+endef
+else
+define Image/mkfs/squashfs
+	$(call Image/mkfs/squashfs-common,$(1))
+endef
+endif
+
 # $(1): board name
 # $(2): rootfs type
 # $(3): kernel image