[PATCH] rpmostreepayload: Drop selinux-ensure-labeled call

Colin Walters walters at verbum.org
Tue Jul 8 19:00:43 UTC 2014


>From 38ba61b555bc26a0622a0879dbf1e5e77fe6e73a Mon Sep 17 00:00:00 2001
From: Colin Walters <walters at verbum.org>
Date: Mon, 7 Jul 2014 18:31:45 -0400
Subject: [PATCH] rpmostreepayload: Drop selinux-ensure-labeled call

I originally developed this command for the custom disk image
generation code in rpm-ostree-toolbox.  That tool uses libguestfs, and
we perform SELinux labeling using *host* tools.  We may not even have
a SELinux policy loaded on the host system.  The guestfs appliance has
no policy loaded, so we had to inject setxattr calls to ensure labels.

In contrast, Anaconda requires install ~= target, and boots with a
loaded policy in permissive mode.  Any stray files we create will at
least be labeled in some form.

This matters for the new /ostree directory; it needs to at least have
labels, and the loaded Anaconda policy accomplishes that.

This call was hence always a no-op because created files were always
labeled.

The actual *reason* I am now dropping this call though is because
it was traversing over the mounted /proc filesystem, which could
cause an installation to error out if a process exited =(

So let's just not do that.
---
 pyanaconda/packaging/rpmostreepayload.py | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/pyanaconda/packaging/rpmostreepayload.py
b/pyanaconda/packaging/rpmostreepayload.py
index 7bc4ad9..5c024f1 100644
--- a/pyanaconda/packaging/rpmostreepayload.py
+++ b/pyanaconda/packaging/rpmostreepayload.py
@@ -235,11 +235,3 @@ class RPMOSTreePayload(ArchivePayload):
         set_kargs_args.extend(self.storage.bootloader.boot_args)
         set_kargs_args.append("root=" +
         self.storage.rootDevice.fstabSpec)
         self._safeExecWithRedirect("ostree", set_kargs_args)
-
-        # This command iterates over all files we might have created
-        # and ensures they're labeled. It's like running
-        # chroot(iutil.getTargetPhysicalRoot()) + fixfiles, except
-        # with a better name and semantics.
-        self._safeExecWithRedirect("ostree",
-            ["admin", "--sysroot=" + iutil.getTargetPhysicalRoot(),
-             "instutil", "selinux-ensure-labeled",
iutil.getTargetPhysicalRoot(), ""])
-- 
1.8.3.1



More information about the anaconda-patches mailing list