From 3af2d3afaed76215a03d780c3b5e571a0b5a66d7 Mon Sep 17 00:00:00 2001 From: Jonathon Anderson Date: Thu, 26 Sep 2024 15:07:53 -0600 Subject: [PATCH] Update SELinux documentation to address rootfstype=ramfs Previous versions of Warewulf v4 required a kernel argument rootfstype=ramfs to be set, in addition to --root=tmpfs. This was fixed in #1401. - Closes #1001 Signed-off-by: Jonathon Anderson --- CHANGELOG.md | 1 + userdocs/contents/security.rst | 33 ++++++++++++++++----------------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0121f1c6..0f647043 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -55,6 +55,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). - Added `--syncuser` flag to `wwctl container shell`. #1358 - Added a troubleshooting guide. #1234 +- Added documentation about `rootfstype=ramfs` for SELinux support. #1001 ### Changed diff --git a/userdocs/contents/security.rst b/userdocs/contents/security.rst index 7b624f3a..cfeccd48 100644 --- a/userdocs/contents/security.rst +++ b/userdocs/contents/security.rst @@ -28,25 +28,24 @@ SELinux The Warewulf server itself was developed with SELinux enabled in "targeted" and "enforcing" mode and with the firewall active. -Additionally, the provisioning process fully supports SELinux by -default. In previous versions you had to enable a switch to support -SELinux, but in Warewulf v4 and above, it is always enabled, but you -do have to make some configuration changes. +The provisioning process also fully supports booting SELinux-enabled +containers, though nodes must be configured to use tmpfs for init. ("ramfs" +(often used by default) does not support extended file attributes.) -#. The first thing to do is to change the provision "Root" option. By - default this is ``initramfs`` which means, take whatever file - system the kernel hands us. By default this is a ``ramfs`` type - file system (however this may not always be the case) and this - format does not support extended file attributes which are required - for SELinux. Instead you must configure Warewulf to use ``tmpfs`` - for the provisioning file system. That change is made like: ``$ - sudo wwctl profile set --root tmpfs default``. +.. code-block:: bash -#. That is all you have to do to ensure that Warewulf will - support SELinux. Once that is done, you just need to enable SELinux - in ``/etc/sysconfig/selinux`` and install the appropriate profiles - into the container. `An example`_ of such a container is in the - warewulf-node-images repository. + wwctl profile set default --root tmpfs + +.. note:: + + Versions of Warewulf prior to v4.5.8 also required a kernel argument + "rootfstype=ramfs" in order for wwinit to copy the node image to tmpfs; but + this is no longer required. + +Once that is done, you just need to enable SELinux in +``/etc/sysconfig/selinux`` and install the appropriate profiles into the +container. `An example`_ of such a container is available in the +warewulf-node-images repository. .. _An example: https://github.com/warewulf/warewulf-node-images/tree/main/examples/rockylinux-9-selinux