Eclipse BlueChi is a systemd service controller intended for multi-node environments with a predefined number of nodes and with a focus on highly regulated ecosystems such as those requiring functional safety.
Blocked systemd calls
When enforcing it prevents various essential calls for bluechi-agent (and probably bluechi-controller). For example starting a systemd service from the bluechi-agent is blocked:
Files can't be read
BlueChi reads its configuration files from /etc. However, it is possible to pass in paths to configuration files via the -c CLI option. The policy only allows reads from /etc, though. Using chcon it is possible to allow reads for files on other locations.
This needs to be changed in:
the documentation (readthedocs, man pages, etc.)
the integration tests to apply chcon on a common directory, e.g. /tmp/bluechi and then chcon -R -t etc_t /tmp/bluechi/, where all configuration files passed in via -c are located
Describe the bug
In https://github.com/eclipse-bluechi/bluechi/pull/850 we changed the
bluechi-selinux
policy from permissive to enforcing by default. This leads to various errors.Known issues
Blocked systemd calls When enforcing it prevents various essential calls for
bluechi-agent
(and probablybluechi-controller
). For example starting a systemd service from thebluechi-agent
is blocked:These need to be added to bluechi.te. For reference, please see https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/system/systemd.if
Files can't be read BlueChi reads its configuration files from
/etc
. However, it is possible to pass in paths to configuration files via the-c
CLI option. The policy only allows reads from/etc
, though. Using chcon it is possible to allow reads for files on other locations.This needs to be changed in:
/tmp/bluechi
and thenchcon -R -t etc_t /tmp/bluechi/
, where all configuration files passed in via-c
are locatedTo Reproduce
Installing the latest BlueChi from snapshot repo on copr: https://copr.fedorainfracloud.org/coprs/g/centos-automotive-sig/bluechi-snapshot
Starting
bluechi-controller
andbluechi-agent
. Then starting a unit viabluechictl
to trigger the denial for starting systemd units, for example.Expected behavior
All functionalities from BlueChi (in expected uses) aren't denied by the SELinux policy.