Description of problem: Add recovery steps of SELinux label in restore procedure. Current restore procedure lacks the steps of SELinux labeling to rsynced directories and files. It causes inconsistency between original node and recovered node. This inconsistency may cause the issue by SELinux in the future change in undercloud. c.f. https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/13/html-single/back_up_and_restore_the_director_undercloud/#restore_the_undercloud As far as I checked, following directories are mapped to usr_tmp_t label. /var/lib/glance /var/lib/docker /var/lib/registry /var/lib/registry/docker These directories should be /var/lib/glance: glance_var_lib_t /var/lib/docker: container_var_lib_t /var/lib/registry: var_lib_t /var/lib/registry/docker: container_var_lib_t Most of them will be restored with restorecon command but restorecon to /var/lib/registry/docker might not work because predefined selinux policy doesn't exist for /var/lib/registry.
Additionally, /etc/puppet needs to run restorecon command.
Hi Documentation team, Do you have any updates on this bugzilla? Best Regards, Keigo Noha
Hi Documentation team, Do you have any updates on this bugzilla? Regards, Keigo Noha
It looks like the doc has been updated to use tar extraction instead of rsync, so the selinux context should be preserved. And even if it isn't, I don't think this has any effect on the standard operation of director (at least none that the Cloud Ops and Upgrades DFGs have noticed, as well as my own testing).
Please confirm that the updated doc clears the request.