Bug 1005307

Summary: oo-restorecon should accept path as argument and only restorecon that path
Product: OKD Reporter: Matt Woodson <mwoodson>
Component: ContainersAssignee: Marek Mahut <mmahut>
Status: CLOSED CURRENTRELEASE QA Contact: libra bugs <libra-bugs>
Severity: low Docs Contact:
Priority: unspecified    
Version: 2.xCC: mmahut, qiuzhang, xtian
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-10-17 13:26:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Matt Woodson 2013-09-06 15:53:25 UTC 
Description of problem:

This is a feature request of oo-restorecon

oo-accept-node will alert the problem of something being mislabled.  IT will look like this:

FAIL: invalid MCS labels on /var/lib/openshift/521eb87f5973ca00e4000081/app-root. run oo-restorecon to restore OpenShift SELinux categories
Version-Release number of selected component (if applicable):


To fix this issue, it suggest to run oo-restorecon.  On a machine that has 100GB's of data with 1000's of users, this takes FOREVER to run and complete.  Right now we are relabeling 100's of GB's and 1000's of files when all that is needed is one or two gears fixed.

It would be best if a path could be passed into oo-restorecon and only that path will have the selinux labels fixed.

How reproducible:

very, it's the normal behaviour.

Steps to Reproduce:
1. run oo-restorecon see how it traversing


Additional info:

This is a feature request.  Thanks.
Comment 1 Marek Mahut 2013-09-23 20:56:30 UTC 
Proposed pull request https://github.com/openshift/origin-server/pull/3687
Comment 2 Marek Mahut 2013-09-24 16:29:55 UTC 
Merged, moving to ON_QA, the commands are mentioned in the pull request.
Comment 4 Qiushui Zhang 2013-09-25 09:53:39 UTC 
Tested on devenv 3824
Now, if using "oo-restorecon -a", it will try to restore all the gears;
if using "oo-restorecon gear_uuid", it will restore the specific gear;
if no option is given, it will show the help information correctly.

[root@ip-10-179-37-67 52429b6da3a7280759000070]# chcon -h -t httpd_sys_content_t php
[root@ip-10-179-37-67 52429b6da3a7280759000070]# ls -Z
drwxr-xr-x. root                     52429b6da3a7280759000070 system_u:object_r:openshift_var_lib_t:s0:c0,c1017 app-root
drwxr-xr-x. root                     root                     unconfined_u:object_r:openshift_var_lib_t:s0:c0,c1017 git
drwxr-xr-x. 52429b6da3a7280759000070 52429b6da3a7280759000070 system_u:object_r:httpd_sys_content_t:s0:c0,c1017 php
[root@ip-10-179-37-67 52429b6da3a7280759000070]# cd ..
[root@ip-10-179-37-67 openshift]# oo-restorecon 52429b6da3a7280759000070
[root@ip-10-179-37-67 openshift]# cd -
/var/lib/openshift/52429b6da3a7280759000070
[root@ip-10-179-37-67 52429b6da3a7280759000070]# ls -Z
drwxr-xr-x. root                     52429b6da3a7280759000070 system_u:object_r:openshift_var_lib_t:s0:c0,c1017 app-root
drwxr-xr-x. root                     root                     unconfined_u:object_r:openshift_var_lib_t:s0:c0,c1017 git
drwxr-xr-x. 52429b6da3a7280759000070 52429b6da3a7280759000070 system_u:object_r:openshift_var_lib_t:s0:c0,c1017 php


Mark it as verified.
Comment 5 Qiushui Zhang 2013-09-26 02:22:30 UTC 
Although the function is working, there is no description about using gear_uuid in the help content:
[root@ip-10-145-231-30 ~]# oo-restorecon --help
Usage: /usr/sbin/oo-restorecon [options] [UUIDs]
    -v, --verbose                    Verbose output
    -a, --all                        Chcon all gears
    -h, --help                       Display help

It is suggested to add the corresponding help info.
Comment 6 Qiushui Zhang 2013-09-26 03:01:57 UTC 
To be more accurate, I think it would be better to add an option like "-g" in the help list. Current help info only shows [options] and [UUIDs] together. What should I expect if I use something like "oo-restorecon --all 52439f17be4a4f319500008"?

But after discussing with others, we get a conclusion that there is no need to so strict/accurate for this command help info. 

So move it to verified again.