Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[rhel8] libpriv/postprocess: work around semanage bug #4124

Merged
merged 1 commit into from
Nov 2, 2022
Merged

[rhel8] libpriv/postprocess: work around semanage bug #4124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 15 additions & 5 deletions src/libpriv/rpmostree-postprocess.cxx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -387,11 +387,21 @@ postprocess_final (int rootfs_dfd, rpmostreecxx::Treefile &treefile, gboolean un
{
g_print ("Recompiling policy\n");

/* Now regenerate SELinux policy so that postprocess scripts from users and from us
* (e.g. the /etc/default/useradd incision) that affect it are baked in. */
rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-nB") };
ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
error);
{
/* Now regenerate SELinux policy so that postprocess scripts from users and from us
* (e.g. the /etc/default/useradd incision) that affect it are baked in. */
rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-nB") };
ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
error);
}

/* Temporary workaround for https://github.com/openshift/os/issues/1036. */
{
rust::Vec child_argv = { rust::String ("semodule"), rust::String ("-n"),
rust::String ("--rebuild-if-modules-changed") };
ROSCXX_TRY (bubblewrap_run_sync (rootfs_dfd, child_argv, false, (bool)unified_core_mode),
error);
}
}

auto container = treefile.get_container ();
Expand Down
5 changes: 5 additions & 0 deletions tests/kolainst/nondestructive/misc.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,11 @@ set -xeuo pipefail
. ${KOLA_EXT_DATA}/libtest.sh
cd $(mktemp -d)

# Sanity-check the policy isn't marked as modified
if ostree admin config-diff | grep 'selinux/targeted/policy'; then
assert_not_reached "selinux policy is marked as modified"
fi

# Ensure multicall is correctly set up and working.
R_O_DIGEST=$(sha512sum $(which rpm-ostree) | cut -d' ' -f1)
O_C_DIGEST=$(sha512sum $(which /usr/libexec/libostree/ext/ostree-container) | cut -d' ' -f1)
Expand Down