[rhcos-4.17] workaround selinux issues with osbuild #3886
Conversation
These are extremely useful when dealing with a limited serial console to try to restore some order to the output.
We have a few issues right now where files in our images don't have any selinux context (i.e. end up unlabeled_t). Here we workaround the hidden mountpoints issue [1] with a patch to OSBuild to hardcode some chcon calls. We workaround the "bunch of files under /sysroot are unlabeled" issue [2] by backported a proposed upstream change to the org.osbuild.selinux stage [3] and then using it to explicitly set the context on the root of the tree to `root_t`. We also add a fix [4] for another issue where '/boot/coreos/platforms.json' would end up with the wrong label. [1] coreos/fedora-coreos-tracker#1771 [2] coreos/fedora-coreos-tracker#1772 [3] osbuild/osbuild#1889 [4] osbuild/osbuild#1888
|
Hi @openshift-cherrypick-robot. Thanks for your PR. I'm waiting for a coreos member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/ok-to-test |
|
/unhold There was one reason I was holding this PR because I thought the disk images still had one file in them that was unlabeled and I needed to thoroughly investigate it. It turns out it is a file that gets created on boot on systemd less than |
I'm writing a test that verifies files on the filesystem in CoreOS machinges match the SELinux policy. Placing kolet in `/var/home/core/kolet` with a `bin_t` context is a violation of this. Let's use /usr/local/bin/. This has the side effect of the file having the right `bin_t` context as soon as it is created. (cherry picked from commit b076a72)
|
added a cherry-pick of b076a72 here too. |
|
/retest |
|
CI is failing here with: is RHCOS CI on these older branches expected to pass? |
|
/retest-required |
|
I checked the mirror on prow and it looks fine and contains the kata-containers package. Lets re-run and see if it fails again. |
|
/retest-required |
This is an automated cherry-pick of #3885
/assign dustymabe