|
 |
5ce0c7 |
From a5e6e764c8753c254e801b32059530fbc2e86e8d Mon Sep 17 00:00:00 2001
|
|
|
5ce0c7 |
From: "Richard W.M. Jones" <rjones@redhat.com>
|
|
|
5ce0c7 |
Date: Tue, 5 May 2020 16:44:15 +0100
|
|
|
5ce0c7 |
Subject: [PATCH] mlcustomize: Fall back to autorelabel if specfile does not
|
|
|
5ce0c7 |
exist (RHBZ#1828952).
|
|
|
5ce0c7 |
|
|
|
5ce0c7 |
https://bugzilla.redhat.com/show_bug.cgi?id=1828952#c2
|
|
|
5ce0c7 |
|
|
|
5ce0c7 |
Cherry picked from libguestfs-common
|
|
|
5ce0c7 |
commit 101dac2eac8c61f0081c343b5d69cfa4efbc2a98 and backported
|
|
|
5ce0c7 |
to libguestfs 1.40 branch (which predates the common submodule).
|
|
|
5ce0c7 |
|
|
|
5ce0c7 |
If SELINUXTYPE is set to some value other than targeted then we look
|
|
|
5ce0c7 |
for a directory /etc/selinux/<SELINUXTYPE> which does not exist.
|
|
|
5ce0c7 |
However this should not cause a fatal error. Using setfiles to do the
|
|
|
5ce0c7 |
relabelling immediately is a nice-to-have, but we can fallback to
|
|
|
5ce0c7 |
using autorelabel if we're unable to achieve it.
|
|
|
5ce0c7 |
---
|
|
|
5ce0c7 |
customize/SELinux_relabel.ml | 6 ++++++
|
|
|
5ce0c7 |
1 file changed, 6 insertions(+)
|
|
|
5ce0c7 |
|
|
|
5ce0c7 |
diff --git a/customize/SELinux_relabel.ml b/customize/SELinux_relabel.ml
|
|
|
5ce0c7 |
index 5df1f0895..5ecf7bd7e 100644
|
|
|
5ce0c7 |
--- a/customize/SELinux_relabel.ml
|
|
|
5ce0c7 |
+++ b/customize/SELinux_relabel.ml
|
|
|
5ce0c7 |
@@ -77,6 +77,12 @@ and use_setfiles g =
|
|
|
5ce0c7 |
let specfile =
|
|
|
5ce0c7 |
sprintf "/etc/selinux/%s/contexts/files/file_contexts" policy in
|
|
|
5ce0c7 |
|
|
|
5ce0c7 |
+ (* If the spec file doesn't exist then fall back to using
|
|
|
5ce0c7 |
+ * autorelabel (RHBZ#1828952).
|
|
|
5ce0c7 |
+ *)
|
|
|
5ce0c7 |
+ if not (g#is_file ~followsymlinks:true specfile) then
|
|
|
5ce0c7 |
+ failwith "no spec file";
|
|
|
5ce0c7 |
+
|
|
|
5ce0c7 |
(* RHEL 6.2 - 6.5 had a malformed specfile that contained the
|
|
|
5ce0c7 |
* invalid regular expression "/var/run/spice-vdagentd.\pid"
|
|
|
5ce0c7 |
* (instead of "\.p"). This stops setfiles from working on
|
|
|
5ce0c7 |
--
|
|
|
5ce0c7 |
2.18.4
|
|
|
5ce0c7 |
|