Security Extended Attributes are not preserved using buildah #2127
Comments
|
Thanks for the report @jeffh-id, looking into it. |
|
Any progress? |
|
Are you seeing this in rootless? Rootful? Both? |
|
we don't copy xattrs except |
|
@jeffh-id is there a reason you would want the IMA stuff recorded? |
|
It isn't so much a matter of having measurements (although those are impacted as well). If one enables IMA appraisal using a typical policy that enforces signatures of executables and shared libraries, then loads a container built with buildah, none of those executables in the container will be allowed to execute. Is there a reason the security attributes aren't preserved? |
|
I don't think so, I just don't think many people were using them. As far as SELinux labels, it makes little sense to preserve these. |
|
Sure, understand the SELinux bits. There is an increasing amount of IMA usage. Every application team can post-process their containers to add all the signatures back in, but I think we shouldn't need to do that. |
|
@giuseppe Is this something that needs to be fixed in Buildah or container storage? |
|
Is a fix planned or is the issue still being assessed? Would be helpful to know for planning purposes. Thx! |
|
The best way to get this fixed would be to open a PR against containers/storage to add the xattr support. |
|
Opened containers/storage#657 to save ima content into the container. |
|
With the patch in containers/storage#657 , I found that there is something wrong with EA. func ReadSecurityXattrToTarHeader(path string, hdr *tar.Header) error {
if hdr.Xattrs == nil {
hdr.Xattrs = make(map[string]string)
}
for _, xattr := range []string{"security.capability", "security.ima"} {
capability, err := system.Lgetxattr(path, xattr)
if err != nil && err != system.EOPNOTSUPP && err != system.ErrNotSupportedPlatform {
return errors.Wrapf(err, "failed to read %q attribute from %q", xattr, path)
}
if capability != nil {
hdr.Xattrs[xattr] = string(capability)
}
}
logrus.Debugf("********path %v and xattr %v",path,hdr.Xattrs)
return nil
}File [root@hghphisprb05903 t]# getfattr -d -m - b
# file: b
security.abc="www"
security.capability1="www"
security.ima="imaok"
security.selinux="unconfined_u:object_r:admin_home_t:s0"
security.www="122121"
trusted.wq="www"
user.ok="www"
user.ok2="www2"Debug info: /var/lib/containers/storage/overlay/5f27c9b971244fa0ea044fbb8187c3ecd262c986a1c56a7dfc7e4c5b755d3183/diff/home/b should have security. and user. but it not. getfattr gets the EA in the final path, security. and user. are not preserved. @rhatdan @TomSweeneyRedHat ,thanks. |
|
Is storage writing them as well as reading them? |
I use the build-using-dockerfile cmd, it reads them and then writes them. |
|
@TomSweeneyRedHat PTAL |
|
Are you sure Buildah is using the latest code from containers/storage? |
I have tried agagin, the problem also exists. |
|
@yangfeiyu20102011 Do we still have the issue? |
rhatdan
added
kind/bug
The PR will fix this.@rhatdan |
Fixes: containers#2127 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Fixes: containers#2127 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Fixes: containers#2127 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Fixes: containers#2127 Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
|
This should have been fixed in the current release. |
Description
Steps to reproduce the issue:
Describe the results you received:
Describe the results you expected:
Output of
rpm -q buildahorapt list buildah:Output of
buildah version:Output of
podman versionif reporting apodman buildissue:Output of
cat /etc/*release:Output of
uname -a:Output of
cat /etc/containers/storage.conf:The text was updated successfully, but these errors were encountered: