Bug 2006017
| Summary: | Regression in ipa-and-similar test suite during test runs | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Amith <apeetham> |
| Component: | ipa | Assignee: | Thomas Woerner <twoerner> |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.4 | CC: | frenaud, lvrabec, mmalik, myusuf, ndehadra, rcritten, rjeffman, ssekidde, ssidhaye, sumenon, tscherf, vmojzis |
| Target Milestone: | rc | Keywords: | Regression |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ipa-4.9.8-2.module+el8.6.0+13621+937b8cd9 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-10 14:08:46 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Comment 3
Milos Malik
2021-09-22 10:45:09 UTC
Is it possible that the use of "/run = /var/run" equivalence causes that? # semanage fcontext -l | grep -A 20 "fcontext Equivalence" SELinux Distribution fcontext Equivalence /run = /var/run /run/lock = /var/lock /run/systemd/system = /usr/lib/systemd/system /run/systemd/generator = /usr/lib/systemd/system /run/systemd/generator.late = /usr/lib/systemd/system /lib = /usr/lib /lib64 = /usr/lib /usr/lib64 = /usr/lib /usr/local/lib64 = /usr/lib /usr/local/lib32 = /usr/lib /etc/systemd/system = /usr/lib/systemd/system /var/lib/xguest/home = /home /var/named/chroot/usr/lib64 = /usr/lib /var/named/chroot/lib64 = /usr/lib /home-inst = /home /home/home-inst = /home /var/roothome = /root /sbin = /usr/sbin /sysroot/tmp = /tmp # After adding a local customization which uses the "/var/run/ipa" pattern instead of "/run/ipa" pattern, everything is OK again: # semanage fcontext -a -t ipa_var_run_t '/var/run/ipa(/.*)?' # semanage fcontext -l -C SELinux fcontext type Context /var/run/ipa(/.*)? all files system_u:object_r:ipa_var_run_t:s0 # restorecon -Rv /run/ipa Relabeled /run/ipa from unconfined_u:object_r:var_run_t:s0 to unconfined_u:object_r:ipa_var_run_t:s0 # matchpathcon /run/ipa /run/ipa system_u:object_r:ipa_var_run_t:s0 # The equivalences are tricky. Fixed upstream master: https://pagure.io/freeipa/c/cd85b729d3fd03e6acd75ec4f0f916aec4bc9247 Fixed upstream ipa-4-9: https://pagure.io/freeipa/c/186497cb790a81d43c35659f81fab2eb47ea65cd ipa-server-4.9.8-2.module+el8.6.0+13621+937b8cd9.x86_64 ipa-selinux-4.9.8-2.module+el8.6.0+13621+937b8cd9.noarch selinux-policy-3.14.3-86.el8.noarch [root@server oddjob]# pwd /usr/libexec/ipa/oddjob [root@server oddjob]# ls -lZ total 24 -rwxr-xr-x. 1 root root system_u:object_r:ipa_helper_exec_t:s0 9556 Dec 10 14:26 com.redhat.idm.trust-fetch-domains -rwxr-xr-x. 1 root root system_u:object_r:ipa_helper_exec_t:s0 2332 Dec 10 14:26 org.freeipa.server.config-enable-sid -rwxr-xr-x. 1 root root system_u:object_r:ipa_helper_exec_t:s0 76 Nov 4 09:12 org.freeipa.server.conncheck -rwxr-xr-x. 1 root root system_u:object_r:ipa_helper_exec_t:s0 210 Dec 10 14:26 org.freeipa.server.trust-enable-agent Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (idm:client and idm:DL1 bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2022:1884 |