Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restore selinux context systemd unit file #8593

Merged
merged 3 commits into from
Oct 31, 2023
Merged

Restore selinux context systemd unit file #8593

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
89f3c94
Restore context of systemd unit file
galal-hussein Oct 11, 2023
b48e263
Restore context of systemd unit file
galal-hussein Oct 11, 2023
2707119
update the hash of install.sh file
galal-hussein Oct 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -961,11 +961,16 @@ EOF

# --- write systemd or openrc service file ---
create_service_file() {
[ "${HAS_SYSTEMD}" = true ] && create_systemd_service_file
[ "${HAS_SYSTEMD}" = true ] && create_systemd_service_file && restore_systemd_service_file_context
Copy link
Member

@brandond brandond Oct 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would this perhaps fit better with the rest of the context changes? It doesn't feel right just blindly calling restorecon when creating the systemd unit.

Perhaps fit it in somewhere down here:

k3s/install.sh

Lines 560 to 569 in 7d38b4a

if ! $SUDO chcon -u system_u -r object_r -t container_runtime_exec_t ${BIN_DIR}/k3s >/dev/null 2>&1; then
if $SUDO grep '^\s*SELINUX=enforcing' /etc/selinux/config >/dev/null 2>&1; then
$policy_error "Failed to apply container_runtime_exec_t to ${BIN_DIR}/k3s, ${policy_hint}"
fi
elif [ ! -f /usr/share/selinux/packages/k3s.pp ]; then
if [ -x /usr/sbin/transactional-update ] || [ "${ID_LIKE:-}" = coreos ] || [ "${VARIANT_ID:-}" = coreos ]; then
warn "Please reboot your machine to activate the changes and avoid data loss."
else
$policy_error "Failed to find the k3s-selinux policy, ${policy_hint}"
fi

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unfortunately the systemd unit file deployment happens after this section in the create_service_file function, and a chicken-egg problem happens because the context is applied before the systemd unit file is deployed

setup_selinux
...    
create_env_file
create_service_file

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My only concern is that we're going to get a request to disable this behavior. Whenever we add something to the install script, someone always asks for an option to not do it.

[ "${HAS_OPENRC}" = true ] && create_openrc_service_file
return 0
}

restore_systemd_service_file_context() {
restorecon -R -i ${FILE_K3S_SERVICE} || true
restorecon -R -i ${FILE_K3S_ENV} || true
}

# --- get hashes of the current k3s bin and service files
get_installed_hashes() {
$SUDO sha256sum ${BIN_DIR}/k3s ${FILE_K3S_SERVICE} ${FILE_K3S_ENV} 2>&1 || true
Expand Down
2 changes: 1 addition & 1 deletion install.sh.sha256sum
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
3798b669b3ede25b2d3bfb9039a744604efb3681a351b2c1e0b01b7b05f0a434 install.sh
8966bae2e82e04a774209f1e85a529049529b9e5c7152797d26a4e6e52da743b install.sh
Loading