Dan Kenigsberg has uploaded a new change for review.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
configNet: grant proper selinux context to ifcfg-*
Bug-Id: BZ#838347 Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Signed-off-by: Dan Kenigsberg danken@redhat.com --- M vdsm/configNetwork.py 1 file changed, 6 insertions(+), 0 deletions(-)
git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/78/7478/1
diff --git a/vdsm/configNetwork.py b/vdsm/configNetwork.py index 62a3ccc..ae8bedf 100755 --- a/vdsm/configNetwork.py +++ b/vdsm/configNetwork.py @@ -28,6 +28,7 @@ import shutil
import libvirt +import selinux
from vdsm import constants from vdsm import utils @@ -370,6 +371,11 @@ self._backup(fileName) open(fileName, 'w').write(configuration) os.chmod(fileName, 0664) + try: + selinux.restorecon(fileName) + except: + logging.debug('ignoring restorecon error in case SElinux is ' + 'disabled', exc_info=True)
def _createConfFile(self, conf, name, ipaddr=None, netmask=None, gateway=None, bootproto=None, mtu=None, onboot='yes', **kwargs):
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: newchange Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com
oVirt Jenkins CI Server has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 1:
Build Successful
http://jenkins.ovirt.info/job/patch_vdsm_unit_tests/674/ : SUCCESS
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: oVirt Jenkins CI Server
Mark Wu has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 1:
Dan, I can't reproduce this problem with a script client and latest code. Could you please give more details on how to reproduce it? Thanks!
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
Igor Lvovsky has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 1: I would prefer that you didn't submit this
(2 inline comments)
few minors questions
.................................................... File vdsm/configNetwork.py Line 372: open(fileName, 'w').write(configuration) Line 373: os.chmod(fileName, 0664) Line 374: try: Line 375: selinux.restorecon(fileName) Line 376: except: I know that's Edu's privilege to comment such things :), but maybe (not must) we can catch something more specific in this particular case Line 377: logging.debug('ignoring restorecon error in case SElinux is ' Line 378: 'disabled', exc_info=True) Line 379: Line 380: def _createConfFile(self, conf, name, ipaddr=None, netmask=None,
Line 374: try: Line 375: selinux.restorecon(fileName) Line 376: except: Line 377: logging.debug('ignoring restorecon error in case SElinux is ' Line 378: 'disabled', exc_info=True) Why do you need traceback here? Is fileName logging isn't enough?
do we need to care about selinux context during/after backup/restore ? Line 379: Line 380: def _createConfFile(self, conf, name, ipaddr=None, netmask=None, Line 381: gateway=None, bootproto=None, mtu=None, onboot='yes', **kwargs): Line 382: """ Create ifcfg-* file with proper fields per device """
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
Dan Kenigsberg has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 1: (2 inline comments)
.................................................... File vdsm/configNetwork.py Line 372: open(fileName, 'w').write(configuration) Line 373: os.chmod(fileName, 0664) Line 374: try: Line 375: selinux.restorecon(fileName) Line 376: except: frankly, I do not remember what is raise, or even why... I just copied the behavior from deployUtil.silentRestoreCon, see http://gerrit.ovirt.org/1022 Line 377: logging.debug('ignoring restorecon error in case SElinux is ' Line 378: 'disabled', exc_info=True) Line 379: Line 380: def _createConfFile(self, conf, name, ipaddr=None, netmask=None,
Line 374: try: Line 375: selinux.restorecon(fileName) Line 376: except: Line 377: logging.debug('ignoring restorecon error in case SElinux is ' Line 378: 'disabled', exc_info=True) if swallowing exceptions is bad, loosing the backtrace info is negligence.
we do care about the context after restore. Luckily, in your new implementation, this is done right here, too. Line 379: Line 380: def _createConfFile(self, conf, name, ipaddr=None, netmask=None, Line 381: gateway=None, bootproto=None, mtu=None, onboot='yes', **kwargs): Line 382: """ Create ifcfg-* file with proper fields per device """
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
Igor Lvovsky has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 1: Looks good to me, but someone else must approve
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
Douglas Schilling Landgraf has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 1: Looks good to me, but someone else must approve
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 1 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
Igor Lvovsky has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 2: Looks good to me, approved
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
oVirt Jenkins CI Server has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 2:
Build Successful
http://jenkins.ovirt.info/job/patch_vdsm_unit_tests/746/ : SUCCESS
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
Douglas Schilling Landgraf has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 2: Looks good to me, but someone else must approve
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
Dan Kenigsberg has posted comments on this change.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
Patch Set 2: Verified
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: comment Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
Dan Kenigsberg has submitted this change and it was merged.
Change subject: configNet: grant proper selinux context to ifcfg-* ......................................................................
configNet: grant proper selinux context to ifcfg-*
Currently, Vdsm-created ifcfg files receive the context unconfined_u:object_r:net_conf_t:s0 instead of the one mandated by selinux policy.
# restorecon -vF /etc/sysconfig/network-scripts/ifcfg-eth3.160 restorecon reset /etc/sysconfig/network-scripts/ifcfg-eth3.160 context unconfined_u:object_r:net_conf_t:s0->system_u:object_r:net_conf_t:s0
This may lead to unpleasant EPERMs down the road.
Bug-Id: https://bugzilla.redhat.com/838347 Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Signed-off-by: Dan Kenigsberg danken@redhat.com --- M vdsm/configNetwork.py 1 file changed, 6 insertions(+), 0 deletions(-)
Approvals: Douglas Schilling Landgraf: Looks good to me, but someone else must approve Dan Kenigsberg: Verified Igor Lvovsky: Looks good to me, approved
-- To view, visit http://gerrit.ovirt.org/7478 To unsubscribe, visit http://gerrit.ovirt.org/settings
Gerrit-MessageType: merged Gerrit-Change-Id: Ic3cb63872794367a7c6fa76cc753698c9402b449 Gerrit-PatchSet: 2 Gerrit-Project: vdsm Gerrit-Branch: master Gerrit-Owner: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Dan Kenigsberg danken@redhat.com Gerrit-Reviewer: Douglas Schilling Landgraf dougsland@redhat.com Gerrit-Reviewer: Igor Lvovsky ilvovsky@redhat.com Gerrit-Reviewer: Mark Wu wudxw@linux.vnet.ibm.com Gerrit-Reviewer: oVirt Jenkins CI Server
vdsm-patches@lists.fedorahosted.org