Request for Combined Distro Build with base distro, SELinux, KVM, and OSTree Support

[sasikuma-qti]

Currently, we maintain multiple distro flavors based on a common base distro, each enabling a specific feature set (e.g., SELinux, KVM, OSTree). This fragmented approach makes it difficult to validate SELinux behavior consistently across all features and services because each build isolates one feature.

Create a single combined distro configuration (or an equivalent approach) that includes all major features and any other relevant service. So that we can validate SELinux to the fullest extent in a unified environment.

Any feedback or alternative solutions to meet this need would be highly valued.

[ricardosalveti]

Create a single combined distro configuration (or an equivalent approach) that includes all major features and any other relevant service. So that we can validate SELinux to the fullest extent in a unified environment.

And which features would you like to include in this common distro configuration?

I would say that it should at least be validated with and without ostree.

[sasikuma-qti]

Create a single combined distro configuration (or an equivalent approach) that includes all major features and any other relevant service. So that we can validate SELinux to the fullest extent in a unified environment.

And which features would you like to include in this common distro configuration?

I would say that it should at least be validated with and without ostree.

We like to include all the feature which are impacted by SELinux. For now, we need to include KVM as well along with OStree.
Because KVM has policies in upstream refpolicy: https://github.com/SELinuxProject/refpolicy/blob/8032ed12cbae3f5e53c9663d78008541800f853c/policy/modules/kernel/devices.fc#L64

[vkraleti]

If the goal of this ask is to validate SELinux policies for various distro combinations, instead of a separate distro can the existing qcom-distro-selinux be extended to include these distro features by default?

[sasikuma-qti]

Hi @ricardosalveti

I tried building KVM, OStree, selinux together.

I copied selinux and kvm enablement code to sota distro conf file and triggered sota distro build. Seeing below build failure.

Error:

• cd /local/mnt/workspace/sasikuma/qcs9100_ostree_sel/build/tmp/work/armv8-2a-qcom-linux/systemd/257.8/image/var

+ rmdir -v --parents lib/systemd

rmdir: removing directory, 'lib/systemd'

rmdir: failed to remove 'lib/systemd': Directory not empty**

• bb_sh_exit_handler
• ret=1
• [ 1 != 0 ]
• echo WARNING: exit code 1 from a shell command.
• exit 1

WARNING: exit code 1 from a shell command.

Change causing the failure:
https://github.com/uptane/meta-updater/blob/master/recipes-extended/systemd/systemd_%25.bbappend

[anujm1]

+ rmdir -v --parents lib/systemd

rmdir: removing directory, 'lib/systemd'

rmdir: failed to remove 'lib/systemd': Directory not empty**

* bb_sh_exit_handler

* ret=1

* [ 1 != 0 ]

* echo WARNING: exit code 1 from a shell command.

* exit 1

WARNING: exit code 1 from a shell command.

Probably happening because of systemd bbappend in meta-selinux that creates a directory there.

[ricardosalveti]

Yeah, this just seems to be an issue with the meta-selinux and meta-updater integration, and due https://git.yoctoproject.org/meta-selinux/commit/?id=5d203f903979ba88b42dc141a795faadcb930873 (which I'm not really sure if really needed anymore, and for sure not the right fix, as if you erase /var and reboot - a valid scenario, it would cause the original issue again).

Can you remove that and verify if the original issue is still there?

[ricardosalveti]

We like to include all the feature which are impacted by SELinux. For now, we need to include KVM as well along with OStree.

Do you also need to validate gunyah?

[ricardosalveti]

If the goal of this ask is to validate SELinux policies for various distro combinations, instead of a separate distro can the existing qcom-distro-selinux be extended to include these distro features by default?

Yeah, we just need to understand all the combinations needed, but I agree that they should be aligned with the selinux specific fragment.

[sasikuma-qti]

Build error-2:

• do_image_ostreecommit
• ostree --repo=/local/mnt/workspace/sasikuma/qcs9100_ostree_sel/build/tmp/deploy/images/qcs9100-ride-sx/ostree_repo refs
• ostree --repo=/local/mnt/workspace/sasikuma/qcs9100_ostree_sel/build/tmp/deploy/images/qcs9100-ride-sx/ostree_repo commit --tree=dir=/local/mnt/workspace/sasikuma/qcs9100_ostree_sel/build/tmp/work/qcs9100_ride_sx-qcom-linux/qcom-multimedia-image/1.0/ostree-rootfs --skip-if-unchanged --branch=qcs9100-ride-sx --subject=Commit-id: qcom-multimedia-image-qcs9100-ride-sx.rootfs-20251208042203 --body= --add-metadata-string=version=2.0
  error: Duplicate xattr name, index=2
• ostree_target_hash=
• bb_sh_exit_handler
• ret=1
• [ 1 != 0 ]
• echo WARNING: exit code 1 from a shell command.
• exit 1
  WARNING: exit code 1 from a shell command.

Root cause:
• The above error is due to duplication of selinux extended attribute security.selinux in IMG_CMD_TAR. IMG_CMD_TAR is being appended mutiple times (in meta-updater and again in meta-selinux) with "--selinux" option.
https://git.yoctoproject.org/meta-selinux/tree/classes/selinux-image.bbclass#n29)
https://github.com/uptane/meta-updater/blob/a2f349d695c599718a501e02662d549038c0423b/classes/image_types_ostree.bbclass#L20

• Build passed after removing IMG_CMD_TAR change in meta-selinux along with below change in meta-updater.

-IMAGE_CMD_TAR = "tar ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '--selinux', '', d)} --xattrs --xattrs-include=*"
+IMAGE_CMD_TAR = "tar --xattrs"

[sasikuma-qti]

We like to include all the feature which are impacted by SELinux. For now, we need to include KVM as well along with OStree.

Do you also need to validate gunyah?

Yes, need to validate gunyah too. We will be labelling gunyah dev node.

[sasikuma-qti]

Yeah, this just seems to be an issue with the meta-selinux and meta-updater integration, and due https://git.yoctoproject.org/meta-selinux/commit/?id=5d203f903979ba88b42dc141a795faadcb930873 (which I'm not really sure if really needed anymore, and for sure not the right fix, as if you erase /var and reboot - a valid scenario, it would cause the original issue again).

Can you remove that and verify if the original issue is still there?

The build error got resolved after removing the change in meta-selinux.

[ricardosalveti]

Yes, need to validate gunyah too. We will be labelling gunyah dev node.

So you will have to validate the following combination:

• KVM + OStree + SELinux
• KVM + SELinux
• Gunyah + OStree + SELinux
• Gunyah + SELinux

Right?

[ricardosalveti]

The build error got resolved after removing the change in meta-selinux.

Can you validate if the original issue fixed by meta-selinux is still valid? From my perspective we should fix meta-selinux here.

[quaresmajose]

Build error-2:

• do_image_ostreecommit
• ostree --repo=/local/mnt/workspace/sasikuma/qcs9100_ostree_sel/build/tmp/deploy/images/qcs9100-ride-sx/ostree_repo refs
• ostree --repo=/local/mnt/workspace/sasikuma/qcs9100_ostree_sel/build/tmp/deploy/images/qcs9100-ride-sx/ostree_repo commit --tree=dir=/local/mnt/workspace/sasikuma/qcs9100_ostree_sel/build/tmp/work/qcs9100_ride_sx-qcom-linux/qcom-multimedia-image/1.0/ostree-rootfs --skip-if-unchanged --branch=qcs9100-ride-sx --subject=Commit-id: qcom-multimedia-image-qcs9100-ride-sx.rootfs-20251208042203 --body= --add-metadata-string=version=2.0
  error: Duplicate xattr name, index=2
• ostree_target_hash=
• bb_sh_exit_handler
• ret=1
• [ 1 != 0 ]
• echo WARNING: exit code 1 from a shell command.
• exit 1
  WARNING: exit code 1 from a shell command.

Root cause: • The above error is due to duplication of selinux extended attribute security.selinux in IMG_CMD_TAR. IMG_CMD_TAR is being appended mutiple times (in meta-updater and again in meta-selinux) with "--selinux" option. https://git.yoctoproject.org/meta-selinux/tree/classes/selinux-image.bbclass#n29) https://github.com/uptane/meta-updater/blob/a2f349d695c599718a501e02662d549038c0423b/classes/image_types_ostree.bbclass#L20

• Build passed after removing IMG_CMD_TAR change in meta-selinux along with below change in meta-updater.

-IMAGE_CMD_TAR = "tar ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '--selinux', '', d)} --xattrs --xattrs-include=*" +IMAGE_CMD_TAR = "tar --xattrs"

We should revert the meta-updater https://github.com/uptane/meta-updater/pull/113/changes to drop the ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', '--selinux', '', d)} given that the argument --selinux is already inserted by the meta-selinux layer

[sasikuma-qti]

The second build error "Duplication of attributes" fixed with the change "uptane/meta-updater#170"