This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours

Bug 728576

Summary: python-imgcreate looks for /selinux which has moved to /sys/fs/selinux
Product: [Fedora] Fedora Reporter: Mads Kiilerich <mads>
Component: livecd-toolsAssignee: Brian Lane <bcl>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: adam.stokes, awilliam, bcl, bruno, dhuff, dwalsh, Jasper.Hartline, katzj, satellitgo, tflink
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: RejectedBlocker
Fixed In Version: livecd-tools-16.6-1.fc16 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-09-23 00:04:45 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Attachments:
Description Flags
Untested Patch
none
Updated patch
none
This updated patch removes the hard coding of /sys/fs/selinux and looks it up within /proc/self/mountinfo none

Description Mads Kiilerich 2011-08-05 12:31:32 EDT
python-imgcreate-16.3-1.fc16.x86_64 /usr/lib/python2.7/site-packages/imgcreate/creator.py contains some checks for os.path.exists("/selinux/enforce")

selinuxfs has however moved to /sys/fs/selinux , so /selinux is now the wrong place to look.

There has been some discussion about creating a symlink from /selinux to /sys/fs/selinux , but that has apparently not happened.

(This was a problem for me because I for some reason had some wrong content in /selinux that no longer was hidden by the mounted selinuxfs, and that caused livecd-creator to fail.)
Comment 1 Brian Lane 2011-08-05 16:13:57 EDT
The right thing to do here is support both.
Comment 2 Mads Kiilerich 2011-08-05 19:42:59 EDT
Note that in theory, because /selinux usually is a mount point for selinuxfs, then the directory should be empty when selinuxfs no longer is mounted there. Some machines do have some content in /selinux in the filesystem. It might primarily be systems that has been installed from a livecd, but it also seems like some other tools touches it.

Thus, if both locations are supported then it is important that /sys/fs/selinux is searched first.

However, AFAIK a livecd-tools version only runs on the one Fedora release and can build the platforms supported at release time, so I doubt there is any reason to look in the old location at all.
Comment 3 Brian Lane 2011-08-05 20:32:27 EDT
Created attachment 516966 [details]
Untested Patch

Here's a quick patch. Give it a try and let me know. I'll do some testing Monday.
Comment 4 Mads Kiilerich 2011-08-08 12:38:41 EDT
Traceback (most recent call last):
  File "/usr/bin/livecd-creator", line 187, in <module>
    sys.exit(main())
  File "/usr/bin/livecd-creator", line 169, in main
    creator.mount(options.base_on, options.cachedir)
  File "/usr/lib/python2.7/site-packages/imgcreate/creator.py", line 525, in mount
    booleans = selinux_path() + "/booleans"
TypeError: unsupported operand type(s) for +: 'NoneType' and 'str'

- which indicates that there now is a problem with the case where there is no selinux path.

I do however have selinux (in permissive mode), so the real problem here is however that it looks for .../selinux/enforcing in util.py - it should be .../selinux/enforce.

With that fixed my test run seems to succeed.

(During the test run I got
/usr/bin/chcon: cannot access `/var/tmp/imgcreate-PXqd63/install_root/selinux': No such file or directory
which might be a slightly different problem - but apparently related.)
Comment 5 Mads Kiilerich 2011-08-08 12:57:54 EDT
And then, after composing:

Traceback (most recent call last):
  File "/usr/bin/livecd-creator", line 187, in <module>
    sys.exit(main())
  File "/usr/bin/livecd-creator", line 171, in main
    creator.configure()
  File "/usr/lib/python2.7/site-packages/imgcreate/creator.py", line 751, in configure
    kickstart.SelinuxConfig(self._instroot).apply(ksh.selinux)
  File "/usr/lib/python2.7/site-packages/imgcreate/kickstart.py", line 442, in apply
    self.relabel(ksselinux)
  File "/usr/lib/python2.7/site-packages/imgcreate/kickstart.py", line 427, in relabel
    "/etc/selinux/targeted/contexts/files/file_contexts", "/"])
  File "/usr/lib/python2.7/site-packages/imgcreate/kickstart.py", line 124, in call
    subprocess.call(args, preexec_fn = self.chroot)
  File "/usr/lib64/python2.7/subprocess.py", line 493, in call
    return Popen(*popenargs, **kwargs).wait()
  File "/usr/lib64/python2.7/subprocess.py", line 679, in __init__
    errread, errwrite)
  File "/usr/lib64/python2.7/subprocess.py", line 1228, in _execute_child
    raise child_exception
TypeError: execv() arg 2 must contain only strings

- apparently/obviously because selinux isn't available inside the instroot and we thus get a None?
Comment 6 Brian Lane 2011-08-08 14:36:08 EDT
Created attachment 517274 [details]
Updated patch

Give this one a try. I ran it against the fedora-live-mini.ks and it appeared to work for me (w/o selinux in enforcing mode)
Comment 7 Mads Kiilerich 2011-08-09 06:08:29 EDT
Traceback (most recent call last):
  File "/usr/bin/livecd-creator", line 187, in <module>
    sys.exit(main())
  File "/usr/bin/livecd-creator", line 171, in main
    creator.configure()
  File "/usr/lib/python2.7/site-packages/imgcreate/creator.py", line 754, in configure
    kickstart.SelinuxConfig(self._instroot).apply(ksh.selinux)
  File "/usr/lib/python2.7/site-packages/imgcreate/kickstart.py", line 445, in apply
    self.relabel(ksselinux)
  File "/usr/lib/python2.7/site-packages/imgcreate/kickstart.py", line 430, in relabel
    "/etc/selinux/targeted/contexts/files/file_contexts", "/"])
  File "/usr/lib/python2.7/site-packages/imgcreate/kickstart.py", line 124, in call
    subprocess.call(args, preexec_fn = self.chroot)
  File "/usr/lib64/python2.7/subprocess.py", line 493, in call
    return Popen(*popenargs, **kwargs).wait()
  File "/usr/lib64/python2.7/subprocess.py", line 679, in __init__
    errread, errwrite)
  File "/usr/lib64/python2.7/subprocess.py", line 1228, in _execute_child
    raise child_exception
TypeError: execv() arg 2 must contain only strings

- because an empty list now in some cases is inserted in the argument list.

I propose something like:

self.call(["/sbin/setfiles", "-e", "/proc", "-e", "/sys", "-e", "/dev"] +
          selinux_args +
          ["/etc/selinux/targeted/contexts/files/file_contexts", "/"])


I end up in this case because util.selinux_path still look for /sys/fs/selinux/enforcing - it should be .../enforce .


It also seems incorrect that __create_selinuxfs uses self._instroot + selinux_path() . I thought the whole reason this is a bit tricky is that it should be possible to build livecds where the target os version is different from the build os version and where they thus have different location of selinuxfs.

Isn't this version of livecd-tools designed to run on F16 only? Then why not just make the selinuxfs location in the outer system const? And inside the chroot why not just fake selinuxfs in both new and old location or make a symlink? (Note however that the filesystem package still think it owns /selinux - bug 729255)
Comment 8 Mads Kiilerich 2011-08-10 11:31:45 EDT
Quoting dwalsh on bug 729563#c9 :

Anaconda should be using selinux python bindings rather the hard coding paths
if possible.
Comment 9 Daniel Walsh 2011-08-10 11:54:58 EDT
Created attachment 517645 [details]
This updated patch removes the hard coding of /sys/fs/selinux and looks it up within /proc/self/mountinfo

Also uses selinux python binding to find file_context file.
Comment 10 Mads Kiilerich 2011-08-10 13:56:24 EDT
dwalshs patch seems to work for me (in combination with dracut-011-40.git20110810)
Comment 11 Adam Williamson 2011-08-11 14:15:58 EDT
What's the impact of this? With the dracut to fix https://bugzilla.redhat.com/show_bug.cgi?id=728863 , and with current livecd-tools / python-imgcreate - i.e. no kind of fix to this bug at all - I was able to generate a live image which seemed to work pretty well (there was a single AVC at boot, which I didn't investigate yet). Unless the impact of this is greater than it currently seems, I'd be -1 blocker.
Comment 12 Mads Kiilerich 2011-08-11 14:55:38 EDT
The impact of this bug varies, depending on the host livecd-creator runs on and whether it has a /selinux directory and what is in it. Some hosts have stale and wrong content there - probably a left over from previous bugs in livecd-creator or anaconda. The consequences of the wrong content also depends on the selinux mode on the host and on the image that is build.

I guess the simple workaround is to create a symlink from /selinux to /sys/fs/selinux on all build hosts or chroots (after removing /selinux/ if it exists).
Comment 13 Brian Lane 2011-08-11 15:05:07 EDT
*** Bug 729701 has been marked as a duplicate of this bug. ***
Comment 14 Daniel Walsh 2011-08-11 16:03:04 EDT
Well without this patch you will see ugly SELinux errors during the build of F16.  But it is not necessary to get out this for Alpha if that is why you are asking.  I think my patch should be applied.

If you find problems with back porting to older versions of the OS, I will revisit the patch.
Comment 15 Adam Williamson 2011-08-11 16:23:38 EDT
Right - I should have been clearer, I was coming from the angle of assessing the blocker-iness of this bug, since it's been proposed as an Alpha blocker. I'm not looking at the *validity* of it, just whether we should take it as an Alpha blocker and hence pull the fix through the freeze into Alpha.
Comment 16 Daniel Walsh 2011-08-11 16:34:24 EDT
Well I guess if the virtual machines work with SELinux in enforcing mode without this fix, then it is not a blocker.
Comment 17 Tim Flink 2011-08-12 14:54:11 EDT
Discussed in the 2011-08-12 blocker review meeting. This bug does not hit any release criteria since the live images are building. Rejected as a blocker for Fedora 16 alpha.
Comment 18 Brian Lane 2011-08-26 16:18:50 EDT
*** Bug 733321 has been marked as a duplicate of this bug. ***
Comment 19 Fedora Update System 2011-08-26 16:54:28 EDT
livecd-tools-16.4-1.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/livecd-tools-16.4-1.fc16
Comment 20 Fedora Update System 2011-08-28 01:47:36 EDT
Package livecd-tools-16.4-1.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing livecd-tools-16.4-1.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/livecd-tools-16.4-1.fc16
then log in and leave karma (feedback).
Comment 21 Fedora Update System 2011-09-01 15:39:30 EDT
livecd-tools-16.5-1.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/livecd-tools-16.5-1.fc16
Comment 22 Fedora Update System 2011-09-14 14:33:55 EDT
livecd-tools-16.6-1.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/livecd-tools-16.6-1.fc16
Comment 23 Fedora Update System 2011-09-23 00:04:14 EDT
livecd-tools-16.6-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.