Make sure selinux policy is effectively applied #2406
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Does this effectively run after |
Good point, the fstab script execution is done differently than all others, this also needs to change. I will add that. |
|
@Vogtinator ok done, like with any other script hook the fstab script is called through the same method and runs setfiles after execution if there is a policy and the tooling |
|
I have to test the change to make sure no regressions are introduced |
Conan-Kudo
previously approved these changes
Dec 15, 2023
schaefi
force-pushed
the
run_setfiles_late
branch
from
f63878b to
658978e
Compare
setup_selinux_file_contexts is now called after the config.sh script. This makes sure that eventual policy related changes done in the optional config.sh are covered by a late setfiles call. In addition setup_selinux_file_contexts is called again at the end of any chroot based script hook. So we assume that any optional script target can change the system in a way that a new setfiles call might be required. It can happen that setfiles is called more often than required but as we cannot know what custom scripts does, it's better to call it more often compared to not often enough. This Fixes bsc#1210604
schaefi
force-pushed
the
run_setfiles_late
branch
from
658978e to
2a22901
Compare
|
Tested the code and works for me now |
schaefi
force-pushed
the
run_setfiles_late
branch
from
9d8b36d to
9628abd
Compare
Conan-Kudo
approved these changes
Dec 17, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
setup_selinux_file_contexts is now called after the config.sh script. This makes sure that eventual policy related changes done in the optional config.sh are covered by a late setfiles call. In addition setup_selinux_file_contexts is called again at the end of any chroot based script hook. So we assume that any optional script target can change the system in a way that a new setfiles call might be required. It can happen that setfiles is called more often than required but as we cannot know what custom scripts does, it's better to call it more often compared to not often enough. This Fixes bsc#1210604