|Summary:||F16Alpha install does not have selinux enabled!|
|Product:||[Fedora] Fedora||Reporter:||Jens Petersen <petersen>|
|Component:||anaconda||Assignee:||Anaconda Maintenance Team <anaconda-maint-list>|
|Status:||CLOSED ERRATA||QA Contact:||Fedora Extras Quality Assurance <extras-qa>|
|Version:||16||CC:||anaconda-maint-list, awilliam, dwalsh, jonathan, mads, rstrode, sandro, tflink, vanmeeuwen+fedora|
|Fixed In Version:||anaconda-16.14.6-1.fc16||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2011-08-18 22:25:04 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:|
Description Jens Petersen 2011-08-10 07:48:04 UTC
Description of problem: Installing F16 Alpha from DVD or net install results in a system with selinux disabled. Version-Release number of selected component (if applicable): FC16 Alpha RC3 How reproducible: every time Steps to Reproduce: 1. install Alpha from net or dvd Actual results: selinux is disabled Expected results: selinux to be enforcing
Comment 1 Adam Williamson 2011-08-10 07:58:51 UTC
proposing as alpha blocker so we can discuss whether we should have a criterion for this, and if so, at which stage. selinux is disabled by /etc/selinux/config , which is part of selinux-policy package, and rpm -V selinux-policy doesn't complain, so it seems selinux disabled actually is the package default - is this a package bug, or is it supposed to be that way and anaconda should override it at install time or smth? CCing Dan for clarification.
Comment 2 Adam Williamson 2011-08-10 08:00:35 UTC
oh, seems rpm -V doesn't complain whatever you do to the file. i guess it intentionally ignores config files. i'll poke into the package to see what the default really is.
Comment 3 Mads Kiilerich 2011-08-10 08:28:11 UTC
This might have been caused by the move of /selinux to /sys/fs/, and this might thus be a consequence/duplicate of bug 728576.
Comment 4 Sandro Mathys 2011-08-10 11:08:25 UTC
FWIW: [root@localhost ~]# grep selinux anaconda-ks.cfg selinux --disabled This is on a freshly installed system, set up with the Alpha RC3 DVD.
Comment 5 Chris Lumens 2011-08-10 13:59:58 UTC
Please attach /var/log/anaconda/anaconda.log to this bug report. Thanks.
Comment 6 Sandro Mathys 2011-08-10 14:09:14 UTC
Created attachment 517619 [details] anaconda.log from Alpha RC3 DVD installation with enforcing=0
Comment 7 Chris Lumens 2011-08-10 14:36:25 UTC
Are you sure that's the right log? I'd expect if that were the case, I'd see enforcing=0 on the command line there at the top. Did you set it at tty2 or something? Also yes, I'm wondering if comment #3 has it right too. There are a couple places in anaconda where we refer to /selinux. I've got a patch along those lines that I need to test out.
Comment 8 Sandro Mathys 2011-08-10 15:21:18 UTC
I'm 100% sure it's the correct log. What I'm not sure about right now whether I needed enforcing=0 for the DVD too or only for the live media installs. By the way, this issue can be observed with both, live media and dvd installs. I'm also 100% sure the installed system had selinux disabled when I first booted it. I then rebooted it into permissive mode (without relabeling) and generated attachment #517580 [details] for bug #728863 which might or might not be connected to this bug.
Comment 9 Daniel Walsh 2011-08-10 15:23:37 UTC
Anaconda should be using selinux python bindings rather the hard coding paths if possible. import selinux if selinux.is_selinux_enabled(): print "You made dan happy"
Comment 10 Adam Williamson 2011-08-10 15:59:43 UTC
I didn't need enforcing=0 to install from DVD. for me, installing from DVD with next, next, next, next works, and reproduces this bug. I can provide a log if you're worried about Sandro's.
Comment 11 Daniel Walsh 2011-08-10 16:04:26 UTC
Right the problem again is hard coding of /selinux. Which Chris is working to fix.
Comment 12 Chris Lumens 2011-08-10 17:31:40 UTC
Anyone want to give updates=http://clumens.fedorapeople.org/729563.img a try? It worked for me in a brief test.
Comment 13 Ray Strode [halfline] 2011-08-10 21:15:25 UTC
I thought is_selinux_enabled could return 3 possible values? shouldn't it be if selinux.is_selinux_enabled() > 0: print "You made dan happy" ?
Comment 14 Tim Flink 2011-08-10 21:20:41 UTC
Discussed in the 2011-08-10 Fedora 16 go/no-go meeting. Since there are no release criteria stating that SELinux must be enabled, rejected as a blocker. However, it was accepted as an NTH bug for Fedora 16 alpha.
Comment 15 Tim Flink 2011-08-11 00:57:12 UTC
(In reply to comment #12) > Anyone want to give updates=http://clumens.fedorapeople.org/729563.img a try? > It worked for me in a brief test. I tried it on a default graphical i686 netinstall and SELinux is enabled by default with no apparent AVC issues.
Comment 16 Fedora Update System 2011-08-11 15:49:33 UTC
anaconda-16.14.4-1.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/anaconda-16.14.4-1.fc16
Comment 17 Fedora Update System 2011-08-12 04:22:48 UTC
Package anaconda-16.14.4-1.fc16: * should fix your issue, * was pushed to the Fedora 16 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing anaconda-16.14.4-1.fc16' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/anaconda-16.14.4-1.fc16 then log in and leave karma (feedback).
Comment 18 Fedora Update System 2011-08-15 16:55:19 UTC
anaconda-16.14.5-1.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/anaconda-16.14.5-1.fc16
Comment 19 Sandro Mathys 2011-08-16 07:49:40 UTC
Just installed F16 Alpha RC4 x86_64 from DVD and this issue seems to be fixed.
Comment 20 Fedora Update System 2011-08-16 20:14:30 UTC
anaconda-16.14.6-1.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/anaconda-16.14.6-1.fc16
Comment 21 Fedora Update System 2011-08-17 14:55:04 UTC
Package anaconda-16.14.6-1.fc16: * should fix your issue, * was pushed to the Fedora 16 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing anaconda-16.14.6-1.fc16' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/anaconda-16.14.6-1.fc16 then log in and leave karma (feedback).
Comment 22 Adam Williamson 2011-08-17 16:28:06 UTC
Comment 23 Fedora Update System 2011-08-18 22:24:03 UTC
anaconda-16.14.6-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.