Do not remove SELinux from the runtime

[elkoniu]

• Do not remove SELinux packages when ISO is created
• Update kernel parameters for with selinux=1 enforcing=0

[coveralls]

Pull Request Test Coverage Report for Build 18475283503

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 39.556%

---

Totals
Change from base Build 18389515213:	0.0%
Covered Lines:	1643
Relevant Lines:	3907

---

💛 - Coveralls

[elkoniu]

This is a part of the effort to have bootc support: rhinstaller/anaconda#6298
Right now bootc requires SELinux compatible environment but at the same time we do not want to affect other elements of stack. selinux=1 enforcing=0 should satisfy both.

[bcl]

I don't like adding this to the grub cmdline, I think it should be possible to write /etc/selinux/config with the right settings so that it is the default.

[elkoniu]

@bcl Thanks for the review - to be honest I am not an SELinux expert so any suggestions how to do it right are welcome:) Bootc requires SELinux to be presented in runtime but at the same time we want to keep it turned off as we are not using it. Can you elaborate on this /etc/selinux/conf alternative?

[bcl]

I think the same affect could be achieved with:

SELINUX=disabled
SELINUXTYPE=targeted

ETA: I meant permissive here. No idea how I typoed that.

[elkoniu]

Without the kernel parameters I am getting this result:

[elkoniu]

Ok, now with updated code it works better.

[elkoniu]

@bcl please share you thoughts about the current version :)

[abadger]

Note: we want to keep it turned off as many, many things break when it's turned on. Too many things to diagnose in a release cycle. And it's also probably mostly pointless. The installer is expected to have complete control to modify the current system and use the network to do so. There's not a lot of limitation we could impose on the installer with SELinux that wouldn't cause problems.

[abadger]

I think the same affect could be achieved with:

SELINUX=disabled
SELINUXTYPE=targeted

I do not believe this is a good idea:

In RHEL 8, you can still use the deprecated method for disabling SELinux by using the SELINUX=disabled option in the /etc/selinux/config file. This results the kernel booting with SELinux enabled and switching to disabled mode later in the boot process. Consequently, memory leaks and race conditions might occur that cause kernel panics.

https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/using_selinux/changing-selinux-states-and-modes_using-selinux#Enabling_and_Disabling_SELinux-Disabling_SELinux_changing-selinux-states-and-modes

We experimented with selinux=1 enforcing=0 on the kernel commandline. That seemed to work. It's supposed to be roughly equivalent to SELINUX=permissive and I see that's what Lorax was setting in `/etc/selinux/config already, though....

I see another part of this PR adds installing the selinux config file. Was that not being installed before? So maybe we need to test with SELINUX=permissive and the config file installed?

[bcl]

I have no idea why I pasted 'disabled' there. I meant permissive. @abadger is correct, with it disabled the labels during a normal install won't get set at all.

I'd forgotten that config file existed. According to commit d6584e1 it wasn't working because it would get removed with the selinux-policy package removal -- but now that we are leaving the package in place it should be ok to install it.

[elkoniu]

@bcl so the right set of flags in the config it should be SELINUX=permissive SELINUXTYPE=targeted? For the labeling - if something extra need to be done - like I need to trigger system labeling somewhere in lorax or it will happen automatically due to presence of /etc/selinux/config and selinux specific packages I have added?

[elkoniu]

@bcl I think now it is working fine.

[bcl]

@bcl so the right set of flags in the config it should be SELINUX=permissive SELINUXTYPE=targeted?

Correct.

For the labeling - if something extra need to be done - like I need to trigger system labeling somewhere in lorax or it will happen automatically due to presence of /etc/selinux/config and selinux specific packages I have added?

Nothing extra should be needed, that's the point of putting it into permissive, it will do everything except enforce the restrictions so that the installed files should have the correct labels.

[bcl]

This looks good to me and I've tested it locally.

[jstodola]

It looks good to me.

[abadger]

Hey @bcl just checking if this will be headed to the rhel10 refresh as well?

[bcl]

Hey @bcl just checking if this will be headed to the rhel10 refresh as well?

not at this time. That depends on Anaconda requesting a backport and filing an issue for it.

[yselkowitz]

What about ELN lorax-templates-rhel for RHEL 11? ELN anaconda tracks rawhide.

[M4rtinK]

I think it should be added to the ELN templates as well ? Or are we waiting for it to potentially hit RHEL 10 first ?