Bug 2041503
| Summary: | Remove the SELinux lockdown class from pcp-selinux | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Zdenek Pytela <zpytela> |
| Component: | pcp | Assignee: | Nathan Scott <nathans> |
| Status: | CLOSED ERRATA | QA Contact: | Jan Kurik <jkurik> |
| Severity: | high | Docs Contact: | Jacob Taylor Valdez <jvaldez> |
| Priority: | unspecified | ||
| Version: | 9.0 | CC: | agerstmayr, iromanos, jkurik, mmarusak, nathans |
| Target Milestone: | rc | Keywords: | Bugfix, Triaged |
| Target Release: | 9.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | pcp-5.3.5-5.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-17 12:39:51 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Zdenek Pytela
2022-01-17 14:23:50 UTC
Could this just be a rebuild, Andreas? Assigning to you to clear my plate a little. Note we likely need another rebuild anyway to pull in one final systemd fix from the end of last year - let's coordinate on that when you're back from PTO. Zdenek, I'm a little surprised this el9 PCP build: https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=1829989 ... did not already remove all references to the lockdown class from pcp-selinux already. Was the selinux-policy in the build root out-of-date I wonder? (the selinux build removing lockdown was done at the end of November AFAICS, while that PCP build was from the second half of December) Scanning the build logs, looks like this was installed for that build: selinux-policy-34.1.20-1.el9.noarch 1639607315 25206 9784c4d6ff7e01be8f5473be3306faad installed I'm not sure from reading BZ 1945581 as to which selinux-policy version removed the class though (the BZ lists a kernel build in Fixed-In field). If I was to start a build soon, would it pick up the correct selinux-policy without this class? If so, I can do that later this week. Thanks! (In reply to Nathan Scott from comment #2) > Zdenek, I'm a little surprised this el9 PCP build: > https://brewweb.engineering.redhat.com/brew/buildinfo?buildID=1829989 > ... did not already remove all references to the lockdown class from > pcp-selinux already. > > Was the selinux-policy in the build root out-of-date I wonder? (the selinux > build removing lockdown was done at the end of November AFAICS, while that > PCP build was from the second half of December) > > Scanning the build logs, looks like this was installed for that build: > selinux-policy-34.1.20-1.el9.noarch 1639607315 25206 > 9784c4d6ff7e01be8f5473be3306faad installed > > I'm not sure from reading BZ 1945581 as to which selinux-policy version > removed the class though (the BZ lists a kernel build in Fixed-In field). > If I was to start a build soon, would it pick up the correct selinux-policy > without this class? If so, I can do that later this week. > > Thanks! I am not sure if I completely understand, but this is the current state: BZ 1945581 removed the support from kernel kernel-5.14.0-11.el9 BZ 2017848 removed the support from selinux-policy selinux-policy-34.1.21-1.el9 Newer packages than these are now available in the buildroot, with the same results. Surely we did not expect this impact, we'd have got you know in advance, sorry for that. The resolution should be as easy as removing all permissions for the lockdown class which does not exist any longer. *** Bug 2043023 has been marked as a duplicate of this bug. *** *** Bug 2044383 has been marked as a duplicate of this bug. *** Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: pcp), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:2370 |