Red Hat Bugzilla – Bug 862350
update_yaml.rb sets yaml file to wrong selinux context...
Last modified: 2015-05-14 19:00:12 EDT
Description of problem:
update_yaml.rb is creating the out_file in /tmp and then moving it, which sets the file's selinux context to this:
However, the context needs to be set to the context of where the file is moved to. In our case, we use /etc/mcollective/facts.yaml which needs an selinux context of (according to restorecon):
A possible fix would be to use cp instead of mv since cp will set the context correctly for the new location. Then use rm to get rid of the tmp file.
Note: this is a new bug in this script. This was not a problem in r2.0.17.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. run: /usr/libexec/mcollective/update_yaml.rb /etc/mcollective/facts.yaml
2. run: restorecon -Rvn /etc/mcollective/facts.yaml
3. Notice that restorecon says that this file's context is wrong.
Wrong selinux context: unconfined_u:object_r:user_tmp_t:s0
Correct selinux context: unconfined_u:object_r:etc_t:s0
Pull request https://github.com/openshift/crankcase/pull/576
Pull request accepted into master.
verified with devenv_2288
root@ip-10-144-64-109 ~]# /usr/libexec/mcollective/update_yaml.rb /etc/mcollective/facts.yaml
[root@ip-10-144-64-109 ~]# restorecon -Rvn /etc/mcollective/facts.yaml
// note, there's no error.