To run Ceph/Hammer with SELinux in enforcing mode in OSPd9 (see BZ 1349194 and BZ 1379751), we need to label the default OSD data directory with the 'ceph_var_lib_t' context. This is not necessary in OSPd10 because for Ceph/Jewel the puppet module will label correctly any directory given to it to be used as OSD data. NOTE: 'ceph_var_lib_t' in OSPd9 is only available when the 'ceph-selinux' package is installed.
This change would need to be a backported patch carried only in osp 9
I'll need acks to build this
Erm... So, this forces openstack-selinux to depend on ceph-selinux, since without it, the ceph_var_lib_t would not exist. Why is this not handled in ceph-selinux ?
https://access.redhat.com/documentation/en/red-hat-openstack-platform/9/paged/manual-installation-procedures/chapter-1-introduction Ceph is not a required component.
So, this needs to be conditional or handled elsewhere. Depending on types which are included in packages from products which may or may not be present/desired during installation isn't correct, nor is simply ignoring the return value (which results in a non-deterministic state).
(In reply to Lon Hohberger from comment #3) > Erm... > > So, this forces openstack-selinux to depend on ceph-selinux, since without > it, the ceph_var_lib_t would not exist. > > Why is this not handled in ceph-selinux ? because there isn't really a default data directory for an OSD; for OSPd10 the puppet-ceph module is tagging with that label whatever directory is given to it as data directory ... this is possible because ceph-selinux is a *requirement* for Ceph/Jewel for Ceph/Hammer instead (shipped with OSPd9) it is not, daemons can run in unconfined mode I am not entirely sure what we want for OSPd9 anymore; the requirement is to not run with SELinux in permissive mode, this should be possible without installing ceph-selinux at all (in which case we won't need to tag the directory either) but Ceph will be unconfined anyway. Maybe that is acceptable. If we want Ceph to be confined, then we need ceph-selinux and we also need to tag appropriately the directory to which OSPd itself defaults for OSDs.
This is fixed in puppet-ceph: https://github.com/openstack/puppet-ceph/commit/f13493abc38cb13eec94bf203f15ec1d26d7ad28 This should be resolved in OSP10