fs: Add restorecon to fs utility #85
Conversation
jakub-vavra-cz
force-pushed
the
restorecon
branch
from
a7886de to
37d0142
Compare
jakub-vavra-cz
force-pushed
the
restorecon
branch
3 times, most recently
from
bd3485a to
d368988
Compare
pytest_mh/utils/fs.py
Outdated
| def restorecon(self, path: str) -> bool: | ||
| """ | ||
| Restore selinux context on a file or directory. | ||
| Does nothing when restorecon is not present on os without selinux. |
| :param path: File or directory where changes will happen | ||
| :type path: str | ||
| :return: True if restorecon succeeded | ||
| :rtype: bool |
There was a problem hiding this comment.
I am concerned that this function will return False if restorecon is not present in the system, as this may be seen as an error by the caller. I wonder if this shouldn't be an int/enum type, which will help us detect different types of scenarios.
There was a problem hiding this comment.
The idea is that this will be noop on distros without selinux.
If we need to make sure that restorecon exists the fs utility can already do that before calling this.
We do not need to complicate this one.
There was a problem hiding this comment.
Current implementation isn't a noop as any caller checking the return value for this method where SELinux isn't present would get a False value and this could be interpreted as a failure. If we are to return a boolean, then the non-SELinux case should return True
We need to handle selinx contexts properly to prevent AVCs.
jakub-vavra-cz
force-pushed
the
restorecon
branch
from
d368988 to
b2366f2
Compare
|
I wouldn't merge this until we understand what happens and confirm that this will actually fix it. The problem was with /etc/krb5.conf, which we don't modify using the fs util, and it is present only in FIPS mode. I would like to avoid binding this class to SELinux, unless it serves some use case. |
|
IIRC you said that everything works fine in FIPS mode yesterday, then this is not in fact needed. Please, reopen it if I understood it wrongly. |
The files/dirs created by the fs utility needs to have proper selinux context.