From 9dd7ac2dbdc66c64fcee1f89df91eef3c011ffe6 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 6 Oct 2021 11:52:30 -0400 Subject: [PATCH 1/5] layer.conf: Allow meta-selinux initscript bbappend Undo the masking of meta-selinux initscript bbappend. It was originally added in commit b318c939d52f because checkroot.sh didn't exist. But now the file does, so that is not a problem. commit c43cb3a613c0 "layer: Amend comment on BBMASK in layer.conf." expanded the comment to mention populate-volatiles.sh. The populate-volatiles.sh part we actually want so that /var/volatile is labeled properly. `touch /var/log/lastlog` is superfluous with the volatiles creating it, so that is fine. restorecon against the read-write /var/volatile and /run are fine. /var/lib is read only, but labels were set already during image creation. Since the label is correct, restorecon won't try to modify it. /etc/resolv.conf is a readonly symlink to volatile, so that is also okay. /etc/adjtime does not exist, but restorecon `-i` will skip non-existant files, so that is okay to leave. We want this so that monit will have properly labeled /var/lib/monit -> /var/volatile/monit access. Signed-off-by: Jason Andryuk --- conf/layer.conf | 5 ----- 1 file changed, 5 deletions(-) diff --git a/conf/layer.conf b/conf/layer.conf index 4e9fe63670..a6cbd84763 100644 --- a/conf/layer.conf +++ b/conf/layer.conf @@ -1,12 +1,7 @@ # We have a conf and classes directory, append to BBPATH BBPATH .= ":${LAYERDIR}" -# meta-selinux appends populate-volatiles.sh with commands that will not work -# under a read-only rootfs: -# - liberaly restorecon /var/lib -# - sed checkroot.sh BBMASK = " \ - meta-selinux/recipes-core/initscripts/ \ meta-virtualization/recipes-extended/images/xen-guest-image-minimal.bb \ meta-virtualization/recipes-devtools/go/go-build_git.bb \ meta-virtualization/recipes-core/runx/runx_git.bb \ From e82a3248bb332d8c1ae3d3380f4241f15b81a7bf Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Wed, 6 Oct 2021 14:56:43 -0400 Subject: [PATCH 2/5] refpolicy-mcs: Enable monit We want to run monit in dom0, but the refpolicy needs some tweaks. With monit using volatiles, we need to label /var/volatile/monit and allow following the symlink from /var/lib/monit to there. Monit will start and stop vglass, disman, & ivcdaemon via initscript, so that needs to be allowed. Trying to put init_domtrans_script(monit_t) inside the monit_startstop_services tunable_policy failed to build with: ERROR 'syntax error' at token 'range_transition' on line 7718: | range_transition monit_t initrc_exec_t:process s0; Moving it outside of the tunable_policy section let everything build. Signed-off-by: Jason Andryuk --- .../patches/monit-volatiles.patch | 37 +++++++++++++++++++ .../policy/modules-upstream.conf | 2 +- .../refpolicy/refpolicy-mcs_git.bbappend | 1 + 3 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 recipes-security/refpolicy/refpolicy-mcs/patches/monit-volatiles.patch diff --git a/recipes-security/refpolicy/refpolicy-mcs/patches/monit-volatiles.patch b/recipes-security/refpolicy/refpolicy-mcs/patches/monit-volatiles.patch new file mode 100644 index 0000000000..02821cf280 --- /dev/null +++ b/recipes-security/refpolicy/refpolicy-mcs/patches/monit-volatiles.patch @@ -0,0 +1,37 @@ +Monit openxt fixes + +/var/lib/monit is a volatiles symlink to /var/volatile/monit, so label it and +allow the symlink to be read. + +monit will start/stop vglass, disman and ivcdaemon, so allow monit to start +init scripts. + +--- a/policy/modules/services/monit.fc ++++ b/policy/modules/services/monit.fc +@@ -10,5 +10,6 @@ + /usr/lib/systemd/system/monit.* -- gen_context(system_u:object_r:monit_unit_t,s0) + + /var/lib/monit(/.*)? gen_context(system_u:object_r:monit_var_lib_t,s0) ++/var/volatile/monit(/.*)? gen_context(system_u:object_r:monit_var_lib_t,s0) + + /var/log/monit\.log.* -- gen_context(system_u:object_r:monit_log_t,s0) +--- a/policy/modules/services/monit.te ++++ b/policy/modules/services/monit.te +@@ -104,6 +104,7 @@ files_pid_filetrans(monit_t, monit_runti + + allow monit_t monit_var_lib_t:dir manage_dir_perms; + allow monit_t monit_var_lib_t:file manage_file_perms; ++allow monit_t monit_var_lib_t:lnk_file read_lnk_file_perms; + + # entropy + kernel_read_kernel_sysctls(monit_t) +@@ -141,6 +142,9 @@ tunable_policy(`monit_startstop_services + init_stop_all_units(monit_t) + ') + ++# Need to support classic sysvinit scripts ++init_domtrans_script(monit_t) ++ + optional_policy(` + dbus_system_bus_client(monit_t) + ') diff --git a/recipes-security/refpolicy/refpolicy-mcs/policy/modules-upstream.conf b/recipes-security/refpolicy/refpolicy-mcs/policy/modules-upstream.conf index 7ca11e4659..ed98134a9b 100644 --- a/recipes-security/refpolicy/refpolicy-mcs/policy/modules-upstream.conf +++ b/recipes-security/refpolicy/refpolicy-mcs/policy/modules-upstream.conf @@ -1906,7 +1906,7 @@ mongodb = off # # Monit - utility for monitoring services on a Unix system. # -monit = off +monit = module # Layer: services # Module: monop diff --git a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend index eca6b8a5ff..32ce2a4c8b 100644 --- a/recipes-security/refpolicy/refpolicy-mcs_git.bbappend +++ b/recipes-security/refpolicy/refpolicy-mcs_git.bbappend @@ -160,6 +160,7 @@ SRC_URI += " \ file://patches/add-missing-dbusd-permissions.patch \ file://patches/xl-sysadm-interfaces.patch \ file://patches/policy.modules.admin.bootloader.diff \ + file://patches/monit-volatiles.patch \ " DEPENDS_append += " \ From dacda71d2600839fd93bd1f552be77dbc569ef39 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Tue, 5 Oct 2021 11:03:49 -0400 Subject: [PATCH 3/5] monit: Run only in runlevel 5 for dom0 We want monit to run in dom0 to monitor vglass, disman and ivcdaemon. Those components only run in runlevel 5. If we don't do something, monit would start them in console mode (runlevel 3). Solve this by only running monit in runlevel 5. It works for now since monit is only watching vglass and friends. The benefit of this is to streamline monit's checks. Monit doesn't have an internal notion of the current runlevel, so it would have to check the current runlevel on each interval which adds up. Signed-off-by: Jason Andryuk --- recipes-extended/monit/monit_%.bbappend | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 recipes-extended/monit/monit_%.bbappend diff --git a/recipes-extended/monit/monit_%.bbappend b/recipes-extended/monit/monit_%.bbappend new file mode 100644 index 0000000000..7d827751b4 --- /dev/null +++ b/recipes-extended/monit/monit_%.bbappend @@ -0,0 +1,3 @@ +# In dom0, monit controls vglass, so we only want monit to run in +# runlevel 5, which matches vglass, disman & ivcdaemon. +INITSCRIPT_PARAMS_${PN}_xenclient-dom0 = "start 99 5 . stop 01 0 1 2 3 4 6 ." From 00cad665bba9fe93bc7bec6fc4322a899948cb7e Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Tue, 5 Oct 2021 11:30:55 -0400 Subject: [PATCH 4/5] monit: Install volatiles Monit used /var/lib/monit for writeable id and state files. Use volatiles to provide that. Signed-off-by: Jason Andryuk --- recipes-extended/monit/monit/volatiles | 2 ++ recipes-extended/monit/monit_%.bbappend | 12 ++++++++++++ 2 files changed, 14 insertions(+) create mode 100644 recipes-extended/monit/monit/volatiles diff --git a/recipes-extended/monit/monit/volatiles b/recipes-extended/monit/monit/volatiles new file mode 100644 index 0000000000..50361c70f8 --- /dev/null +++ b/recipes-extended/monit/monit/volatiles @@ -0,0 +1,2 @@ +l root root 0755 /var/lib/monit /var/volatile/monit +d root root 0755 /var/lib/monit none diff --git a/recipes-extended/monit/monit_%.bbappend b/recipes-extended/monit/monit_%.bbappend index 7d827751b4..8b05dd8f24 100644 --- a/recipes-extended/monit/monit_%.bbappend +++ b/recipes-extended/monit/monit_%.bbappend @@ -1,3 +1,15 @@ +FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" + # In dom0, monit controls vglass, so we only want monit to run in # runlevel 5, which matches vglass, disman & ivcdaemon. INITSCRIPT_PARAMS_${PN}_xenclient-dom0 = "start 99 5 . stop 01 0 1 2 3 4 6 ." + +SRC_URI += " \ + file://volatiles \ +" + +do_install_append() { + install -d -m 700 ${D}${sysconfdir}/default/volatiles + install -m 600 ${WORKDIR}/volatiles \ + ${D}${sysconfdir}/default/volatiles/50_monit +} From b6112e8e257912902f0fa72eb80acc9107b3bd79 Mon Sep 17 00:00:00 2001 From: Jason Andryuk Date: Tue, 5 Oct 2021 11:47:36 -0400 Subject: [PATCH 5/5] monit: Add dom0-cfg to configure Configure dom0 via a drop-in to /etc/monit.d to avoid having to import and overwrite monitrc. 30 seconds is a little too long to wait for monit to discover the UI has died. Decrease it to 2 seconds. Also use a delay of 12 seconds to give disman and vglass time to start before monit attempts to start them. Point monit paths to the volatile path /var/lib/monit, so it doesn't try to use the default of /root/.monit Signed-off-by: Jason Andryuk --- recipes-extended/monit/monit/dom0-cfg | 10 ++++++++++ recipes-extended/monit/monit_%.bbappend | 9 +++++++++ 2 files changed, 19 insertions(+) create mode 100644 recipes-extended/monit/monit/dom0-cfg diff --git a/recipes-extended/monit/monit/dom0-cfg b/recipes-extended/monit/monit/dom0-cfg new file mode 100644 index 0000000000..f9d943ea4e --- /dev/null +++ b/recipes-extended/monit/monit/dom0-cfg @@ -0,0 +1,10 @@ +# Override the defaults in monitrc +set daemon 2 # check services at 2 seconds intervals + with start delay 12 # Avoid racing with vglass start up + +# Move to volatile space +set idfile /var/lib/monit/id +set statefile /var/lib/monit/state +set eventqueue + basedir /var/lib/monit/events + slots 100 diff --git a/recipes-extended/monit/monit_%.bbappend b/recipes-extended/monit/monit_%.bbappend index 8b05dd8f24..76f10cdb5a 100644 --- a/recipes-extended/monit/monit_%.bbappend +++ b/recipes-extended/monit/monit_%.bbappend @@ -8,8 +8,17 @@ SRC_URI += " \ file://volatiles \ " +SRC_URI_append_xenclient-dom0 = " \ + file://dom0-cfg \ +" + do_install_append() { install -d -m 700 ${D}${sysconfdir}/default/volatiles install -m 600 ${WORKDIR}/volatiles \ ${D}${sysconfdir}/default/volatiles/50_monit } + +do_install_append_xenclient-dom0() { + install -d -m 700 ${D}${sysconfdir}/monit.d/ + install -m 600 ${WORKDIR}/dom0-cfg ${D}${sysconfdir}/monit.d/ +}