Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

refact: linux, chcon, bin_t #10293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Dec 16, 2024
Merged

refact: linux, chcon, bin_t #10293

merged 1 commit into from
Dec 16, 2024

Conversation

fufesou
Copy link
Collaborator

@fufesou fufesou commented Dec 16, 2024 •
edited
Loading

Fix SELinux limits on Fedora.

#6116
#4267
#7107
#5458
#5098
#7164
#6301

Desc

Change the security context of /usr/lib/rustdesk/rustdesk from lib_t to bin_t.

Then the process security context will be system_u:system_r:unconfined_service_t:s0.

Although the service spec uses /usr/bin/rustdesk and the security context of the soft symlink is bin_t. The process actually uses the security context of /usr/lib/rustdesk/rustdesk.

All distros can apply the following changes. But we only do it for rpm packages for now.
Because the other distros dose not support chcon well (or maybe SELinux) for now.

# Change the security context of /usr/lib/rustdesk/rustdesk from `lib_t` to `bin_t`.
if command -v getenforce >/dev/null 2>&1; then
  if [ "$(getenforce)" == "Enforcing" ]; then
    file_security_context=$(ls -lZ /usr/lib/rustdesk/rustdesk 2>/dev/null | awk -F':' '{print $3}')
    if [ "${file_security_context}" == "lib_t" ]; then
      chcon -t bin_t /usr/lib/rustdesk/rustdesk || true
    fi
  fi
fi

The above code can also be applied to Ubuntu, openSUSE, Archlinux. But it takes no effect.

  1. SELinux is not enabled by default, even command getenforce is not included.
  2. ls -lZ /usr/lib/rustdesk/rustdesk results no security context
    -rwxr-xr-x 1 root root ? 19184 Sep 20 14:10 /usr/lib/rustdesk//rustdesk
  3. chcon -t bin_t /usr/lib/rustdesk/rustdesk results errors.
    chcon: can't apply partial context to unlabeled file '/usr/lib/rustdesk/rustdesk'
    chcon: failed to get security context of '/usr/lib/rustdesk/rustdesk': Operation not supported

This documentation may no longer be needed https://rustdesk.com/docs/en/client/linux/selinux/.

Tests

  1. debian 12.7.0, Ubuntu 24.04, openSUSE Leap 15.6.
# ps -eZ | grep rustdesk
unconfined                          587 ?        00:00:01 rustdesk
# ls -lZ | /usr/lib/rustdesk/rustdesk
-rwxr-xr-x 1 root root ? 26096 Nov 26 08:31 /usr/lib/rustdesk/rustdesk
# chcon -t bin_t /usr/lib/rustdesk/rustdesk
chcon: can't apply partial context to unlabeled file '/usr/lib/rustdesk/rustdesk'
  1. Fedora 37, Fedora 40, Fedora 41, CentOS-8-5-2111 (before)
# ps -eZ | grep rustdesk
system_u:system_r:init_t:s0         965 ?        00:00:00 rustdesk
# ls -lZ | /usr/lib/rustdesk/rustdesk
-rwxr-xr-x. 1 root root system_u:object_r:lib_t:s0 30608 Dec  5 19:01 /usr/lib/rustdesk/rustdesk
  1. Fedora 37, Fedora 40, Fedora 41, CentOS-8-5-2111 (after)
# ps -eZ | grep rustdesk
system_u:system_r:unconfined_service_t:s0 3442 ? 00:00:00 rustdesk
# ls -lZ | /usr/lib/rustdesk/rustdesk
-rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 30608 Dec 16 10:26 /usr/lib/rustdesk/rustdesk
  1. deb package with the adding code in postinst. Installation is done, nothing changes.

Refs

  1. https://documentation.suse.com/en-us/sle-micro/5.5/html/SLE-Micro-all/cha-selinux-slemicro.html#id-1.7.3.10.5:~:text=ls%20%2DZ,PATH
  2. https://www.dbi-services.com/blog/selinux-setup-and-configuration-for-linux/#:~:text=Here%20is%20a%20list%20of%20the%20most%20used%20SELinux%20security%20context%20types%3A

@fufesou
refact: linux, chcon, bin_t
9da8fb9 
Signed-off-by: fufesou <linlong1266@gmail.com>
@fufesou fufesou closed this Dec 16, 2024
@fufesou fufesou reopened this Dec 16, 2024
@rustdesk rustdesk merged commit d025ca1 into rustdesk:master Dec 16, 2024
42 checks passed
@xlionjuan
Copy link
Contributor

xlionjuan commented Dec 17, 2024 •
edited
Loading

Investigating because this script will do nothing in the Fedora Atomic based systems.

https://universal-blue.discourse.group/t/help-to-verify-this-selinux-related-scripts-on-atomic-systems-chcon-bin-t/5735/7
https://discussion.fedoraproject.org/t/will-semanage-fcontext-and-restorecon-safe-to-run-when-selinux-disabled-during-atomic-custom-image-build-and-others/139943

@rustdesk
Copy link
Owner

Update us if you get further results please.

@xlionjuan
Copy link
Contributor

Check out the Fedora Discussion one.

@fufesou fufesou mentioned this pull request Dec 19, 2024
Merged
4 tasks
@fufesou
Copy link
Collaborator Author

fufesou commented Dec 20, 2024 •
edited
Loading

@xlionjuan Thank you for your helpful investigation.

We've put another fix #10316

I would recommend giving this a try (moving everything to /usr/share/rustdeck + symlink to it in /usr/bin/) to see if this works.

/usr/share/rustdeck works fine. But we finally choose /usr/local/rustdesk instead.

@rustdesk
Copy link
Owner

@xlionjuan could you help test? the nightly is ready.

@xlionjuan
Copy link
Contributor

I think you still should put in /usr/share/rustdesk
Because no matter I using rpm-ostree layering, or custom image build, the folder /usr/local/rustdesk/ will never exists.

@fufesou
Copy link
Collaborator Author

fufesou commented Dec 20, 2024 •
edited
Loading

Because no matter I using rpm-ostree layering, or custom image build, the folder /usr/local/rustdesk/ will never exists.

I can not understand. /usr/local/rustdesk/ only relies on /usr/local.
/usr/local does not exist on your system?

Or could you locate rustdesk, is it put in another directory?

@xlionjuan
Copy link
Contributor

xlionjuan commented Dec 20, 2024 •
edited
Loading

/usr/local exists on my computer, but not in the container, it didn't pre-created in the container
so I add
https://github.com/xlionjuan/bluefin-dx/blob/07e1b40f54bb3b39395d832422f6550a5451d919/build.sh#L16-L20

mkdir -p "/var/opt" && ln -s "/var/opt"  "/opt"
+ mkdir -p "/var/usrlocal" && ln -s "/var/usrlocal" "/usr/local"

To my build, the /opt one is required for Cloudflare WARP, and it is working for a long times, the second line should works (in theory) according to Fedora docs.

For which directory should symlink to where: https://docs.fedoraproject.org/en-US/fedora-sericea/technical-information/

I'm not sure it is upstream bug or mkdir -p "/var/usrlocal" && ln -s "/var/usrlocal" "/usr/local" is wrong, I'm asking in Fedora Discussion.

@rustdesk
Copy link
Owner

We do not care about container.

@fufesou
Copy link
Collaborator Author

fufesou commented Dec 20, 2024

  • mkdir -p "/var/usrlocal" && ln -s "/var/usrlocal" "/usr/local"

So you have created the symlink, but rustdesk is failed to be moved into it.

It's strange.

Could you please also help confirm:

  1. Is /usr/share exists?
  2. Run ls -lZ /usr to see the security context of the sub directories.

@xlionjuan
Copy link
Contributor

We do not care about container.

I mean, my whole operating system is a container

Bootc
Universal Blue

@xlionjuan
Copy link
Contributor

This is my root filesystem looks like

ls -lZ /

.rw-r--r--  37 root system_u:object_r:etc_runtime_t:s0  1  1月  1970 40-rpmostree-pkg-usermod-qemu-kvm.conf
lrwxrwxrwx   - root system_u:object_r:bin_t:s0         23  8月 03:41 bin -> usr/bin
drwxr-xr-x   - root system_u:object_r:boot_t:s0        20 12月 17:02 boot
drwxr-xr-x   - root system_u:object_r:device_t:s0      20 12月 17:49 dev
drwxr-xr-x   - root system_u:object_r:etc_t:s0         20 12月 17:49 etc
lrwxrwxrwx   - root system_u:object_r:home_root_t:s0   23  8月 03:41 home -> var/home
lrwxrwxrwx   - root system_u:object_r:lib_t:s0         23  8月 03:41 lib -> usr/lib
lrwxrwxrwx   - root system_u:object_r:lib_t:s0         23  8月 03:41 lib64 -> usr/lib64
lrwxrwxrwx   - root system_u:object_r:mnt_t:s0         23  8月 03:41 media -> run/media
lrwxrwxrwx   - root system_u:object_r:mnt_t:s0         23  8月 03:41 mnt -> var/mnt
lrwxrwxrwx   - root system_u:object_r:usr_t:s0         23  8月 03:41 opt -> var/opt
lrwxrwxrwx   - root system_u:object_r:usr_t:s0         23  8月 03:41 ostree -> sysroot/ostree
dr-xr-xr-x   - root system_u:object_r:proc_t:s0        20 12月 17:49 proc
lrwxrwxrwx   - root system_u:object_r:admin_home_t:s0  23  8月 03:41 root -> var/roothome
drwxr-xr-x   - root system_u:object_r:var_run_t:s0     20 12月 17:49 run
lrwxrwxrwx   - root system_u:object_r:bin_t:s0         23  8月 03:41 sbin -> usr/sbin
lrwxrwxrwx   - root system_u:object_r:var_t:s0         23  8月 03:41 srv -> var/srv
dr-xr-xr-x   - root system_u:object_r:sysfs_t:s0       20 12月 17:49 sys
drwxr-xr-x   - root system_u:object_r:root_t:s0        23  8月 03:41 sysroot
drwxrwxrwt   - root system_u:object_r:tmp_t:s0         20 12月 17:51 tmp
drwxr-xr-x@  - root system_u:object_r:usr_t:s0          1  1月  1970 usr
drwxr-xr-x   - root system_u:object_r:var_t:s0         20 12月 17:49 var

ls -lZ /usr
drwxr-xr-x@ - root system_u:object_r:bin_t:s0  1  1月  1970 bin
drwxr-xr-x  - root system_u:object_r:etc_t:s0  1  1月  1970 etc
drwxr-xr-x  - root system_u:object_r:usr_t:s0  1  1月  1970 games
drwxr-xr-x  - root system_u:object_r:usr_t:s0  1  1月  1970 include
drwxr-xr-x  - root system_u:object_r:lib_t:s0  1  1月  1970 lib
drwxr-xr-x@ - root system_u:object_r:lib_t:s0  1  1月  1970 lib64
drwxr-xr-x  - root system_u:object_r:bin_t:s0  1  1月  1970 libexec
lrwxrwxrwx  - root system_u:object_r:usr_t:s0 23  8月 03:41 local -> ../var/usrlocal
drwxr-xr-x@ - root system_u:object_r:bin_t:s0  1  1月  1970 sbin
drwxr-xr-x@ - root system_u:object_r:usr_t:s0  1  1月  1970 share
drwxr-xr-x  - root system_u:object_r:usr_t:s0  1  1月  1970 src
lrwxrwxrwx  - root system_u:object_r:usr_t:s0 23  8月 03:41 tmp -> ../var/tmp

If you're willing to, I can explain how bootable container works and why it may be the future of the Linux Desktop, we can continue this topic is Discord.

@rustdesk
Copy link
Owner

rustdesk commented Dec 20, 2024 •
edited
Loading

But I agree not put in /usr/local because app directory should not put there. At least it should be /usr/local/lib/rustdesk.

@fufesou
Copy link
Collaborator Author

fufesou commented Dec 20, 2024 •
edited
Loading

@xlionjuan Hi, /usr/share/rustdesk or /opt/rustdesk which one is the better location?

@xlionjuan
Copy link
Contributor

Any difficulties that can't put in /usr/share ?

If you have no choices, I can sure /opt won't cause this problem on Fedora Atomic, but I can't sure the SELinux side.

@fufesou
Copy link
Collaborator Author

fufesou commented Dec 20, 2024 •
edited
Loading

Any difficulties that can't put in /usr/share ?

No. I'm just not sure which location is better.

I'll put another PR, then put rustdesk in /usr/share.

@xlionjuan
Copy link
Contributor

If you want to ask more technical problems, you can ask siosm in that Fedora Discussion, his title is "Packaging Team", and also working on Fedora Atomic project.

@xlionjuan
Copy link
Contributor

VSCodium and VSCode are in /usr/share, which is mentioned by siosm in Fedora Discussion.

@fufesou fufesou mentioned this pull request Dec 20, 2024
Merged
5 tasks
@rustdesk
Copy link
Owner

https://github.com/rustdesk/rustdesk/releases/nightly is /usr/share now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@fufesou @xlionjuan @rustdesk
Morty Proxy This is a proxified and sanitized view of the page, visit original site.