Bug 2026680

Summary:	[RFE] add possibility to check sum of loaded module
Product:	Red Hat Enterprise Linux 9	Reporter:	Petr Lautrbach <plautrba>
Component:	policycoreutils	Assignee:	Petr Lautrbach <plautrba>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	9.0	CC:	dwalsh, lvrabec, mmalik, plautrba, ssekidde, vmojzis
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	policycoreutils-3.3-2.el9	Doc Type:	Enhancement
Doc Text:	Feature: # semodule -l --checksum \| grep localmodule localmodule sha256:db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd # /usr/libexec/selinux/hll/pp localmodule.pp \| sha256sum db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd - man semodule: -m,--checksum Add SHA256 checksum of modules to the list output. Reason: Result:	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 15:50:30 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Petr Lautrbach 2021-11-25 13:49:29 UTC

This bug was initially created as a copy of Bug #1731501

I am copying this bug because:

Description of problem:

1. Proposed title of this feature request

[RFE] add possibility to check sum of loaded module

2. Who is the customer behind the request?

Account: RED HAT IT/IS 5243891
TAM customer: yes
CSM customer: yes
Strategic: yes

3. What is the nature and description of the request?

Use case:

Ansible loads a module. If I then need to make changes to
this policy in the future, how can Ansible compare the .pp file in
config management with the state loaded on the system?

Need some mechanism to compare loaded module with definition of the module we expect to be running.

4. Why does the customer need this? (List the business requirements here)

Having Ansible reload the module every run will cause problems in real operations.

5. How would the customer like to achieve this? (List the functional requirements here)

Introduce st like `semodule -l --checksum` that could be compared with the module definition.

6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.

7. Is there already an existing RFE upstream or in Red Hat Bugzilla?

8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?

9. Is the sales team involved in this request and do they have any additional input?

10. List any affected packages or components.

11. Would the customer be able to assist in testing this functionality if implemented?

Yes

Comment 9 errata-xmlrpc 2022-05-17 15:50:30 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: policycoreutils), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:3920