Cannot set selinux file contexts when kernel does not have selinux support compiled in

Bug #1347845 reported by vlowther
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
tripleo
Expired
Undecided
Unassigned

Bug Description

tripleo-image-elemets recently merged changes Ibffa1b986b52a1dc28de8d3b8056eed92aae9ee7, I03c9ff95436bc603d9f4c442a20538252ab67c17, and I07da602db49b0f122a86a95b5dc5d294fc95ce5c, which set the proper selinux file contexts at image build time if you are building images that should run with selinux enabled and running in enforcing mode. However, if you are doing image builds on a system running a kernel that does not have selinux support compiled in, semanage, load_policy, and setfiles cannot function, which makes it impossible to finish the image build process.

A workaround would be to detect the situation by looking for the presence of /sys/fs/selinux at image build time and arrange for the relavent selinux context manipulation to happen when the built image is first booted instead of at build time.

Richard Su (rwsu)
Changed in tripleo:
assignee: nobody → Richard Su (rwsu)
Changed in tripleo:
status: New → Confirmed
Richard Su (rwsu)
Changed in tripleo:
importance: Undecided → High
importance: High → Medium
Revision history for this message
Emilien Macchi (emilienm) wrote : Cleanup EOL bug report

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (LIBERTY, MITAKA, NEWTON, OCATA, PIKE, PIKE).
  Valid example: CONFIRMED FOR: LIBERTY

Changed in tripleo:
assignee: Richard Su (rwsu) → nobody
importance: Medium → Undecided
status: Confirmed → Expired
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.