manifests: add selinux-workaround.yaml for >= F41

[marmijo]

Recent changes in the SELinux policy have broken a lot of our code. Add a selinux-workaround.yaml file to revert the affected domains back to permissive mode until fedora-selinux/selinux-policy#2257 merges and the domains are reverted back to permissive mode upstream or the issue is resolved altogether. The selinux-workaround.yaml file is included only when releasever >= 41 since we are seeing these issues in branched and rawhide.

EDIT: Remove the kola-iso test entries for rawhide and branched from the kola-denylist file. These tests now longer fail with the coreos_installer_t domain reverted back to permissive.

EDIT 2: Add the workaround for afterburn_t as well.

---

bootupd_t: https://bugzilla.redhat.com/show_bug.cgi?id=2300306

---

coreos_installer_t:

• RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2305385
• FCOS Tracker: [rawhide][branched] SELinux AVC denials cause multiple installation methods to fail fedora-coreos-tracker#1779

---

afterburn_t

• RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=2306352
• FCOS Tracker: [rawhide][branched] SELinux AVC denials causes the afterburn write to fail in cloud platforms fedora-coreos-tracker#1784

[marmijo]

This was discussed in the community meeting today (2024-08-28):

...let's try to reach out to the selinux-policy maintainers first to try to do this the proper way (either fixing the bug, or merging [travier's] PR)

/hold
Let's wait until a decision can be made about that: fedora-selinux/selinux-policy#2257 (comment)

[dustymabe]

@marmijo let's convert this into it's own manifest yaml file, conditionally included on all F41 releases and then target this PR for testing-devel.

@jlebon do you know if there are downsides to running semodule like this during the compose? i.e. not shipping the policy exactly as delivered by Fedora?

[marmijo]

let's convert this into it's own manifest yaml file, conditionally included on all F41 releases and then target this PR for testing-devel.

Done!

[jlebon]

@jlebon do you know if there are downsides to running semodule like this during the compose? i.e. not shipping the policy exactly as delivered by Fedora?

Not sure if that's what you mean, but note that the binary policy file isn't shipped in Fedora. On package-mode systems, it's always built client-side. In image-mode systems, it's kinda silly because we recompile it multiple times (once from the scriptlets, and once by rpm-ostree at the end, and now this PR would add a third recompilation in between), but meh...

Probably worth linking the prior art in openshift/os I think this is based on.

The main downside I see is more the higher-level/more social issue of undoing what selinux-policy does, but hopefully that's temporary.

[dustymabe]

The main downside I see is more the higher-level/more social issue of undoing what selinux-policy does, but hopefully that's temporary.

agree. I think this is just us getting ourselves unblocked. It looks like we're going to be working with selinux on multiple issues related to the new confinements for some time and this will help reduce the time pressure there.

[dustymabe]

can we add a similar workaround here for afterburn (related to coreos/fedora-coreos-tracker#1784) ?

[marmijo]

can we add a similar workaround here for afterburn (related to coreos/fedora-coreos-tracker#1784) ?

Added!

[dustymabe]

This LGTM. Do we need to do any more testing before merging or should we be good to go?

[marmijo]

I think we should be good to go. I tested this locally and it resolved the kola-iso failures. I haven't done any testing to see if it also resolves the cloud failures for coreos/fedora-coreos-tracker#1784.

From last week's community meeting:

...let's try to reach out to the selinux-policy maintainers first to try to do this the proper way (either fixing the bug, or merging [travier's] PR)

I'm +1 for merging this now to work around all of these failures.
/unhold

[dustymabe]

fix conflict and set automerge

[dustymabe]

LGTM