[PATCH rhel7-branch] rpmostreepayload: Drop selinux-ensure-labeled call (#1113535)

Brian C. Lane bcl at redhat.com
Thu Oct 16 22:05:52 UTC 2014


On Thu, Oct 16, 2014 at 03:13:43PM +0200, Radek Vykydal wrote:
> From: Colin Walters <walters at verbum.org>
> 
> Port of commit e4bbdaf4042672b13d3eaf0a05f1acf9b00517cd from master.
> 
> Related: rhbz#1113535
> 
> I originally developed this command for the custom disk image
> generation code in rpm-ostree-toolbox.  That tool uses libguestfs, and
> we perform SELinux labeling using *host* tools.  We may not even have
> a SELinux policy loaded on the host system.  The guestfs appliance has
> no policy loaded, so we had to inject setxattr calls to ensure labels.
> 
> In contrast, Anaconda requires install ~= target, and boots with a
> loaded policy in permissive mode.  Any stray files we create will at
> least be labeled in some form.
> 
> This matters for the new /ostree directory; it needs to at least have
> labels, and the loaded Anaconda policy accomplishes that.
> 
> This call was hence always a no-op because created files were always
> labeled.
> 
> The actual *reason* I am now dropping this call though is because
> it was traversing over the mounted /proc filesystem, which could
> cause an installation to error out if a process exited =(
> 
> So let's just not do that.
> ---
>  pyanaconda/packaging/rpmostreepayload.py | 8 --------
>  1 file changed, 8 deletions(-)
> 
> diff --git a/pyanaconda/packaging/rpmostreepayload.py b/pyanaconda/packaging/rpmostreepayload.py
> index d461558..d43b70f 100644
> --- a/pyanaconda/packaging/rpmostreepayload.py
> +++ b/pyanaconda/packaging/rpmostreepayload.py
> @@ -252,11 +252,3 @@ class RPMOSTreePayload(ArchivePayload):
>          set_kargs_args.extend(self.storage.bootloader.boot_args)
>          set_kargs_args.append("root=" + self.storage.rootDevice.fstabSpec)
>          self._safeExecWithRedirect("ostree", set_kargs_args)
> -
> -        # This command iterates over all files we might have created
> -        # and ensures they're labeled. It's like running
> -        # chroot(iutil.getTargetPhysicalRoot()) + fixfiles, except
> -        # with a better name and semantics.
> -        self._safeExecWithRedirect("ostree",
> -            ["admin", "--sysroot=" + iutil.getTargetPhysicalRoot(),
> -             "instutil", "selinux-ensure-labeled", iutil.getTargetPhysicalRoot(), ""])
> -- 
> 1.9.3

Ack

-- 
Brian C. Lane | Anaconda Team | IRC: bcl #anaconda | Port Orchard, WA (PST8PDT)


More information about the anaconda-patches mailing list