Bug 1055753

Summary: RHEL7 /etc/rc.d/init.d/anamon /usr/local/sbin/anamon wrong selinux context
Product: [Retired] Beaker Reporter: MikeBoswell <mboswell>
Component: schedulerAssignee: Dan Callaghan <dcallagh>
Status: CLOSED CURRENTRELEASE QA Contact: tools-bugs <tools-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 0.14CC: aigao, asaha, dcallagh, jingwang, ksrot, llim, qwan, rmancy, xjia
Target Milestone: 0.15.3   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-02-03 04:52:07 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description MikeBoswell 2014-01-20 21:05:13 UTC 
Description of problem:
Beaker snippet is no longer valid for RHEL7 as the /selinux dir is no longer.  /usr/lib/python2.6/site-packages/bkr/server/snippets/post_anamon

Version-Release number of selected component (if applicable):
Beaker 0.14.4

How reproducible:
always when provision RHEL 7

Steps to Reproduce:
1.provision RHEL7 via beaker
2.
3.

Actual results:
As /selinux is no longer in RHEL7 we end up w/ the wrong selinux context for /etc/rc.d/init.d/anamon /usr/local/sbin/anamon

Expected results:
restorecon correctly applied to /etc/rc.d/init.d/anamon /usr/local/sbin/anamon

Additional info:
Maybe as simple as adding ( -o -d /sys/fs/selinux )
test -d /selinux -o -d /sys/fs/selinux && restorecon /etc/rc.d/init.d/anamon /usr/local/sbin/anamon
Comment 2 Dan Callaghan 2014-01-20 22:53:46 UTC 
(In reply to MikeBoswell from comment #0)
> Maybe as simple as adding ( -o -d /sys/fs/selinux )
> test -d /selinux -o -d /sys/fs/selinux && restorecon /etc/rc.d/init.d/anamon
> /usr/local/sbin/anamon

A better option might be selinuxenabled(8) although we will just need to check that that command exists on RHEL4.

selinuxenabled &>/dev/null && restorecon /etc/rc.d/init.d/anamon /usr/local/sbin/anamon
Comment 3 Dan Callaghan 2014-01-21 06:00:05 UTC 
selinuxenabled exists on RHEL4 so I think we can safely assume that if the command doesn't exist, SELinux is not enabled. So just testing selinuxenabled &>/dev/null should do it.
Comment 4 Dan Callaghan 2014-01-21 06:24:37 UTC 
The fix is quite easy:

http://gerrit.beaker-project.org/2713

although it's not clear to me why we even need to run restorecon at all. I thought that the context should be set correctly when the file is originally written. But I can see that it's not. Sometimes SELinux confuses me...
Comment 5 Nick Coghlan 2014-01-21 07:56:56 UTC 
My understanding is that install and mv don't set the destination context appropriately by default, so they need to be followed by restorecon.

It's something like that, anyway - the SELinux support in coretools is occasionally sketchy (especially on older versions), so it can be easier to just use restorecon rather than trying to figure out exactly where the context originally failed to be set properly.
Comment 9 Nick Coghlan 2014-02-03 04:52:07 UTC 
This change is included in the Beaker 0.15.3 maintenance release:

http://beaker-project.org/docs/whats-new/release-0.15.html#beaker-0-15-3