Restore selinux context systemd unit file

[galal-hussein]

Proposed Changes

Fix to restore the context of systemd unit file of k3s and its env file to the correct context container_unit_file_t

Types of Changes

Bug fix

Verification

Testing

Linked Issues

• Incorrect selinux context #8317

User-Facing Change

Further Comments

[brandond]

Would this perhaps fit better with the rest of the context changes? It doesn't feel right just blindly calling restorecon when creating the systemd unit.

Perhaps fit it in somewhere down here:

k3s/install.sh

Lines 560 to 569 in 7d38b4a

	if ! $SUDO chcon -u system_u -r object_r -t container_runtime_exec_t ${BIN_DIR}/k3s >/dev/null 2>&1; then
	if $SUDO grep '^\s*SELINUX=enforcing' /etc/selinux/config >/dev/null 2>&1; then
	$policy_error "Failed to apply container_runtime_exec_t to ${BIN_DIR}/k3s, ${policy_hint}"
	fi
	elif [ ! -f /usr/share/selinux/packages/k3s.pp ]; then
	if [ -x /usr/sbin/transactional-update ] || [ "${ID_LIKE:-}" = coreos ] || [ "${VARIANT_ID:-}" = coreos ]; then
	warn "Please reboot your machine to activate the changes and avoid data loss."
	else
	$policy_error "Failed to find the k3s-selinux policy, ${policy_hint}"
	fi

[galal-hussein]

unfortunately the systemd unit file deployment happens after this section in the create_service_file function, and a chicken-egg problem happens because the context is applied before the systemd unit file is deployed

setup_selinux
...    
create_env_file
create_service_file

[brandond]

My only concern is that we're going to get a request to disable this behavior. Whenever we add something to the install script, someone always asks for an option to not do it.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (7d38b4a) 47.05% compared to head (2707119) 49.74%.
Report is 29 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8593      +/-   ##
==========================================
+ Coverage   47.05%   49.74%   +2.68%     
==========================================
  Files         144      148       +4     
  Lines       14964    15919     +955     
==========================================
+ Hits         7042     7919     +877     
+ Misses       6809     6713      -96     
- Partials     1113     1287     +174     

Flag	Coverage Δ
e2etests	46.72% <ø> (?)
inttests	42.87% <ø> (-1.56%)	⬇️
unittests	17.93% <ø> (-1.62%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 62 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.