From: Colin Walters walters@verbum.org
Port of commit e4bbdaf4042672b13d3eaf0a05f1acf9b00517cd from master.
Related: rhbz#1113535
I originally developed this command for the custom disk image generation code in rpm-ostree-toolbox. That tool uses libguestfs, and we perform SELinux labeling using *host* tools. We may not even have a SELinux policy loaded on the host system. The guestfs appliance has no policy loaded, so we had to inject setxattr calls to ensure labels.
In contrast, Anaconda requires install ~= target, and boots with a loaded policy in permissive mode. Any stray files we create will at least be labeled in some form.
This matters for the new /ostree directory; it needs to at least have labels, and the loaded Anaconda policy accomplishes that.
This call was hence always a no-op because created files were always labeled.
The actual *reason* I am now dropping this call though is because it was traversing over the mounted /proc filesystem, which could cause an installation to error out if a process exited =(
So let's just not do that. --- pyanaconda/packaging/rpmostreepayload.py | 8 -------- 1 file changed, 8 deletions(-)
diff --git a/pyanaconda/packaging/rpmostreepayload.py b/pyanaconda/packaging/rpmostreepayload.py index d461558..d43b70f 100644 --- a/pyanaconda/packaging/rpmostreepayload.py +++ b/pyanaconda/packaging/rpmostreepayload.py @@ -252,11 +252,3 @@ class RPMOSTreePayload(ArchivePayload): set_kargs_args.extend(self.storage.bootloader.boot_args) set_kargs_args.append("root=" + self.storage.rootDevice.fstabSpec) self._safeExecWithRedirect("ostree", set_kargs_args) - - # This command iterates over all files we might have created - # and ensures they're labeled. It's like running - # chroot(iutil.getTargetPhysicalRoot()) + fixfiles, except - # with a better name and semantics. - self._safeExecWithRedirect("ostree", - ["admin", "--sysroot=" + iutil.getTargetPhysicalRoot(), - "instutil", "selinux-ensure-labeled", iutil.getTargetPhysicalRoot(), ""])
On Thu, Oct 16, 2014 at 03:13:43PM +0200, Radek Vykydal wrote:
From: Colin Walters walters@verbum.org
Port of commit e4bbdaf4042672b13d3eaf0a05f1acf9b00517cd from master.
Related: rhbz#1113535
I originally developed this command for the custom disk image generation code in rpm-ostree-toolbox. That tool uses libguestfs, and we perform SELinux labeling using *host* tools. We may not even have a SELinux policy loaded on the host system. The guestfs appliance has no policy loaded, so we had to inject setxattr calls to ensure labels.
In contrast, Anaconda requires install ~= target, and boots with a loaded policy in permissive mode. Any stray files we create will at least be labeled in some form.
This matters for the new /ostree directory; it needs to at least have labels, and the loaded Anaconda policy accomplishes that.
This call was hence always a no-op because created files were always labeled.
The actual *reason* I am now dropping this call though is because it was traversing over the mounted /proc filesystem, which could cause an installation to error out if a process exited =(
So let's just not do that.
pyanaconda/packaging/rpmostreepayload.py | 8 -------- 1 file changed, 8 deletions(-)
diff --git a/pyanaconda/packaging/rpmostreepayload.py b/pyanaconda/packaging/rpmostreepayload.py index d461558..d43b70f 100644 --- a/pyanaconda/packaging/rpmostreepayload.py +++ b/pyanaconda/packaging/rpmostreepayload.py @@ -252,11 +252,3 @@ class RPMOSTreePayload(ArchivePayload): set_kargs_args.extend(self.storage.bootloader.boot_args) set_kargs_args.append("root=" + self.storage.rootDevice.fstabSpec) self._safeExecWithRedirect("ostree", set_kargs_args)
# This command iterates over all files we might have created
# and ensures they're labeled. It's like running
# chroot(iutil.getTargetPhysicalRoot()) + fixfiles, except
# with a better name and semantics.
self._safeExecWithRedirect("ostree",
["admin", "--sysroot=" + iutil.getTargetPhysicalRoot(),
"instutil", "selinux-ensure-labeled", iutil.getTargetPhysicalRoot(), ""])
-- 1.9.3
Ack
anaconda-patches@lists.fedorahosted.org