I'm working in a company where we need to distribute our image running SE-Linux inside.

The product uses virtualization for additional security, thus we have got a setup with a linux host, running several qemu-kvm guests. The kvm guest's OS is Debian.

I could install selinux on the guest by hand, I was also able to activate SELinux (sestatus verified it was running and the files were correclty auto-labeled).

Next step would then be to make our own modules and roles, and set the correct contexts for each process and file in the guest image.

However, what I need is, to automate this installation + labeling + configuration process of selinux during the build. We cannot build a normal image without selinux, then install selinux by hand on every machine. We want to pre-configure a image which has everything up and running.

The build process runs inside a docker-image where the kvm-guest images will be created and configured.

When I try to install selinux in the docker-image, GitLab won't build that image due to errors. (I can install selinux manually on my local machine in the docker image however, yet, sestatus says SELinux is disabled, and thus, I am not able to let docker run fixfile relabel 100% successfully)

What I have found during my several-hour research so far, was only:

  • How to label files using already up and running SELinux
  • How to make own modules and use them
  • How the whole SELinux-concept works
  • How to install it by hand (always involving a reboot)
  • How to use sVirt to increase safety BETWEEN the host and the guest VMs

What I could NOT find anywhere:

  • How to install SE-Linux in a guest-vm image during the build of the image.

More Details:

I thought docker needed selinux-packages or an active selinux-installation running, in order to be able to correctly setup selinux inside the mounted filesystem, which contains all of the files of our software. I can try to visualize the setup like this:

Docker -> run build scripts using a mnt-directory inside docker -> Inside mnt-directory install selinux and label files and setup modules and contexts The mnt-directory will in this case represent the image of a guest kvm and not of the host.

If anyone has detailed information of how to do this, I would be thankful!

  • serverfault.com/a/906284/190208 details the steps for CentOS you probably just need to change it to use apt-get instead. Apr 25, 2018 at 15:05
  • 1
    Rather, you should get rid of Debian and run Docker on CentOS, Fedora, RHEL or something else that already includes SELinux and the appropriate policies. Apr 25, 2018 at 15:25
  • Thanks for your quick answers! Please let me clarify my question a bit: The docker image runs on Ubuntu, and my supervisor claimed, that we cannot run SELinux in the docker image, as we will not have the SELinux kernel-support on the GitLab-Server. This cannot be changed. We MUST find a way to install SELinux to the final product's image, without the need to have SELinux enabled inside docker. We also cannot change the GitLab OS from Ubuntu 16.04 nor the docker OS which is the same. We cannot installl SELinux on the GitLab OS. Can we somehow install SELinux to the built image? Apr 26, 2018 at 7:51


You must log in to answer this question.

Browse other questions tagged .