| -rw-r--r-- | .gitignore | 2 | ||||
| -rw-r--r-- | Jenkinsfile | 7 | ||||
| -rw-r--r-- | README.md | 15 | ||||
| -rw-r--r-- | selinux/kiwi-rpm-script.te | 39 |
4 files changed, 3 insertions, 60 deletions
@@ -1,4 +1,2 @@ outdir-build/ outdir/ -selinux/*.pp -selinux/*.mod diff --git a/Jenkinsfile b/Jenkinsfile index 4b18f35..1732307 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -3,8 +3,6 @@ pipeline { options { timestamps() - preserveStashes() - buildDiscarder(logRotator(daysToKeepStr: '7')) } environment { @@ -43,7 +41,7 @@ spec: kubernetes.io/arch: arm64 containers: - name: kiwi - image: fedora:45 + image: fedora:44 imagePullPolicy: Always command: [ 'sleep' ] args: [ 'infinity' ] @@ -152,9 +150,8 @@ spec: mv "${src}" "${dst}" ls -lh - /s5cmd --endpoint-url "${B2_ENDPOINT}" --log debug cp \\ + /s5cmd --endpoint-url "${B2_ENDPOINT}" cp \\ --content-type "application/x-iso9660-image" \\ - --show-progress \\ "${dst}" \\ "s3://${ISO_BUCKET}/fedora/${IMAGE_VERSION}/aarch64/${dst}" ''' @@ -17,7 +17,7 @@ I bought this device as I viewed it as a great Linux GNOME tablet, but after sev **The compiled ISOs can be downloaded [here](https://dist.sayag.it/fedora/45/aarch64).** -This KIWI project is built mainly on the base of Fedora Workstation 45 LiveCD ISO. +This KIWI project is built mainly on the base of Fedora Workstation 45 (Pre-release) LiveCD ISO. Trying a stable version (the latest is Fedora 44 at the time of writing this) is possible, but not tested for now. If you want to compile this image manually, **the build arch must be `aarch64`**. It means that if you are on an `amd64` machine, you would have to use aarch64 instructions emulation tools like `binfmt`. Unfortunately, such a tool will drastically increase the compilation time. @@ -34,19 +34,6 @@ To build this on Fedora Linux: []$ sudo ./kiwi-build --kiwi-file=Fedora.kiwi --image-type=iso --image-profile=Workstation-Live --output-dir ./outdir ``` -### SELinux issues - -In the combo of kiwi-ng 11.1.1 and rpm 6.1.0 (latest versions in Fedora 45 by November 5th 2026), rpm runs %sysusers scriptlets through an exec content of rpm_script_t, and with kiwi.te having no such grant, the host enforcement denies the domain transition, resulting in `setup` pkg, and many more, not getting installed inside the build environment. - -To fix the issue, reproduce rpm_transition_script for the kiwi domain. There is a script to do exactly this in `selinux/` domain. Do this to proceed with ISO build: - -```bash -cd selinux -checkmodule -M -m -o kiwi-rpm-script.mod kiwi-rpm-script.te -semodule_package -o kiwi-rpm-script.pp -m kiwi-rpm-script.mod -sudo semodule -i kiwi-rpm-script.pp -``` - ## Feature matrix | Hardware | State | Nuances | diff --git a/selinux/kiwi-rpm-script.te b/selinux/kiwi-rpm-script.te deleted file mode 100644 index af2444a..0000000 --- a/selinux/kiwi-rpm-script.te +++ /dev/null @@ -1,39 +0,0 @@ -# Host-side SELinux fix for building with kiwi-ng 11.1.1 on Fedora (kiwi-selinux). -# -# kiwi-selinux installs a policy that runs /usr/bin/kiwi-ng in the kiwi_t -# domain. rpm 6.1 runs %sysusers scriptlets with an rpm_script_t exec -# context (fedora-selinux rpm_transition_script()). kiwi.te never grants -# that transition, so every sysusers scriptlet dies with exit status 127 -# ("command not found" from the exec failure), which is what breaks the -# bootstrap transaction: setup-* fails, /etc/passwd and /etc/group are never -# created, and all later user/group lookups fail. -# -# This module reproduces fedora's rpm_transition_script(kiwi_t, unconfined_r) -# for the kiwi domain. Not part of the image build - install it on the host: -# -# checkmodule -M -m -o kiwi-rpm-script.mod kiwi-rpm-script.te -# semodule_package -o kiwi-rpm-script.pp -m kiwi-rpm-script.mod -# sudo semodule -i kiwi-rpm-script.pp - -module kiwi-rpm-script 1.0; - -require { - type kiwi_t; - type rpm_script_t; - attribute rpm_transition_domain; - attribute_role rpm_script_roles; - role unconfined_r; - class process { transition sigchld }; - class fd use; - class fifo_file { read write getattr ioctl }; -} - -# rpm_transition_script(), expanded for kiwi_t / unconfined_r -typeattribute kiwi_t rpm_transition_domain; -roleattribute unconfined_r rpm_script_roles; - -allow kiwi_t rpm_script_t:process transition; -allow kiwi_t rpm_script_t:fd use; -allow rpm_script_t kiwi_t:fd use; -allow rpm_script_t kiwi_t:fifo_file { read write getattr ioctl }; -allow rpm_script_t kiwi_t:process sigchld; |