openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Ensure SELinux context persist across restorecon and reboot 

Until now, we only relied on the ":z" flag in order to set container
volumes label to container_file_t.
While it works fine, it has multiple issues:
- if an operator runs a restorecon, it might break the container service
- if an SELinux related package is updated, it might reset the label,
  and break the container service
- it requires a container stop&start to reset the label to the expected
  value
- in case of deep tree or huge amount of file, relabelling takes time

This change ensures the system sets the expected context on the specific
locations, instead of following the content of selinux-policy-targeted
rulesets.

It has an equivalent for some locations in tripleo-ansible repository:
https://review.opendev.org/c/openstack/tripleo-ansible/+/782393

Note about swift locations:
Since openstack-selinux already sets fcontext rules for, at least, once
swift location, we can't override it here. The following
openstack-selinux patch is being pushed in order to work around this
specific case:
https://github.com/redhat-openstack/openstack-selinux/pull/73

Change-Id: Icb7f58004e281b42141c70a9a4895905dc32b45d
Resolves: rhbz#1941922
This commit is contained in:
Cédric Jeanneret 2021-03-23 12:42:06 +01:00
parent aa601a280f
commit d77fe55516
16 changed files with 86 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
common/common-container-config-scripts.yaml
View File

@ -1,3 +1,11 @@
- name: Create fcontext entry for container-config-scripts
sefcontext:
target: "/var/lib/container-config-scripts(/.*)?"
setype: container_file_t
state: present
tags:
- container_config_scripts
- name: Create /var/lib/container-config-scripts
become: true
file:

5
deployment/cinder/cinder-common-container-puppet.yaml
View File

@ -107,6 +107,11 @@ outputs:
cinder_common_host_prep_tasks:
description: Common host prep tasks for cinder-volume and cinder-backup services
value: &cinder_common_host_prep_tasks
- name: create fcontext entry for cinder data
sefcontext:
target: "/var/lib/cinder(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/database/mysql-container-puppet.yaml
View File

@ -261,6 +261,11 @@ outputs:
deploy_steps_tasks:
get_attr: [MysqlBase, role_data, deploy_steps_tasks]
host_prep_tasks:
- name: create fcontext entry for mysql data
sefcontext:
target: "/var/lib/mysql(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/database/redis-container-puppet.yaml
View File

@ -242,6 +242,11 @@ outputs:
ca: ipa
- null
host_prep_tasks:
- name: create fcontext entry for redis data
sefcontext:
target: "/var/run/redis(/.*)?" # conflicts with equivalency rule '/run /var/run' - have to use /var/run here...
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/ironic/ironic-conductor-container-puppet.yaml
View File

@ -590,6 +590,11 @@ outputs:
vars:
modules:
- name: iscsi_tcp
- name: create fcontext entry for ironic data
sefcontext:
target: "/var/lib/ironic(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/ironic/ironic-inspector-container-puppet.yaml
View File

@ -519,6 +519,11 @@ outputs:
environment:
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
host_prep_tasks:
- name: create fcontext entry for ironic-inspector data
sefcontext:
target: "/var/lib/ironic-inspector/dhcp-hostsdir(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

9
deployment/iscsid/iscsid-container-puppet.yaml
View File

@ -144,6 +144,15 @@ outputs:
environment:
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
host_prep_tasks:
- name: create fcontext entry for iscsi
sefcontext:
target: "{{ item.path }}(/.*)?"
setype: "{{ item.setype }}"
state: present
with_items:
- { 'path': /etc/iscsi, 'setype': container_file_t }
- { 'path': /etc/target, 'setype': container_file_t }
- { 'path': /var/lib/iscsi, 'setype': container_file_t }
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/manila/manila-share-container-puppet.yaml
View File

@ -178,6 +178,11 @@ outputs:
volumes: {get_attr: [ManilaShareCommon, manila_share_volumes]}
environment: {get_attr: [ManilaShareCommon, manila_share_environment]}
host_prep_tasks:
- name: create fcontext entry for manila data
sefcontext:
target: "/var/lib/manila(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/messaging/rpc-qdrouterd-container-puppet.yaml
View File

@ -140,6 +140,11 @@ outputs:
environment:
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
host_prep_tasks:
- name: create fcontext entry for qdrouterd data
sefcontext:
target: "/var/lib/qdrouterd(/.*)?"
setype: container_file_t
state: present
- name: create persistent logs directory
file:
path: "{{ item.path }}"

5
deployment/qdr/qdrouterd-container-puppet.yaml
View File

@ -130,6 +130,11 @@ outputs:
environment:
KOLLA_CONFIG_STRATEGY: COPY_ALWAYS
host_prep_tasks:
- name: create fcontext entry for qrouterd data
sefcontext:
target: "/var/lib/qdrouterd(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/rabbitmq/rabbitmq-container-puppet.yaml
View File

@ -389,6 +389,11 @@ outputs:
ca: ipa
- null
host_prep_tasks:
- name: creat fcontext entry for rabbitmq data
sefcontext:
target: "/var/lib/rabbitmq(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/rabbitmq/rabbitmq-messaging-notify-container-puppet.yaml
View File

@ -324,6 +324,11 @@ outputs:
ca: ipa
- null
host_prep_tasks:
- name: create fcontext for rabbitmq data
sefcontext:
target: "/var/lib/rabbitmq(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/rabbitmq/rabbitmq-messaging-pacemaker-puppet.yaml
View File

@ -221,6 +221,11 @@ outputs:
# update (scale-out, etc.)
TRIPLEO_DEPLOY_IDENTIFIER: {get_param: DeployIdentifier}
host_prep_tasks:
- name: create fcontext for rabbitmq data
sefcontext:
target: "/var/lib/rabbitmq(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/rabbitmq/rabbitmq-messaging-rpc-container-puppet.yaml
View File

@ -324,6 +324,11 @@ outputs:
ca: ipa
- null
host_prep_tasks:
- name: create fcontext for rabbitmq data
sefcontext:
target: "/var/lib/rabbitmq(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

5
deployment/rabbitmq/rabbitmq-messaging-rpc-pacemaker-puppet.yaml
View File

@ -223,6 +223,11 @@ outputs:
metadata_settings:
get_attr: [RabbitmqBase, role_data, metadata_settings]
host_prep_tasks:
- name: create fcontext for rabbitmq data
sefcontext:
target: "/var/lib/rabbitmq(/.*)?"
setype: container_file_t
state: present
- name: create persistent directories
file:
path: "{{ item.path }}"

4
deployment/swift/swift-storage-container-puppet.yaml
View File

@ -602,6 +602,10 @@ outputs:
- {}
host_prep_tasks:
# NOTE: we can't set fcontext for swift locations since they are
# already set in openstack-selinux package. In order to work around
# this specific case, the following change is being pushed:
# https://github.com/redhat-openstack/openstack-selinux/pull/73
- name: create persistent directories
file:
path: "{{ item.path }}"