Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-2169

Not possible to manage SELinux file contexts via puppet in a sane way


    • Type: Bug
    • Status: Resolved
    • Priority: Normal
    • Resolution: Fixed
    • Affects Version/s: PUP 3.4.3, PUP 3.6.2, PUP 4.8.1, PUP 4.8.2, PUP 4.10.5
    • Fix Version/s: PUP 6.8.0
    • Component/s: None
    • Environment:

      CentOS 7 with Puppet 4.8.2 (puppet-agent 1.8.3)
      Fedora 25 with Puppet 4.8.2 (puppet-agent 1.8.3)
      CentOS 6.5 x86_64 Puppet 3.4.3 from Puppetlabs repository
      CentOS 6 with Puppet 3.8.7 from Pupptlabs Repo
      Rhel 7.3 PE 2016.4.7

    • Template:
      PUP Bug Template
    • Team:
      Night's Watch
    • Story Points:
    • Sprint:
      PR - 2019-07-10, PR - 2019-07-23
    • Method Found:
      Customer Feedback
    • CS Priority:
    • Zendesk Ticket IDs:
    • Zendesk Ticket Count:
    • Release Notes:
      Bug Fix
    • Release Notes Summary:
      Previously, puppet was unable to effectively manage the SELinux file context without restarting the puppet service due to an infinitely cached default context for each file. Now puppet will clear this cache after each catalog apply.
    • QA Risk Assessment:
      No Action


      There's currently no sane way to manage SELinux file contexts using puppet. The only way is to call 'semanage' via a 'exec' resource. But then the next issue comes up: Puppet seems to keep some file context rule cache, built once at startup. I wasn't able to find a way to invalidate this cache without restarting the whole puppet agent. Even when calling 'restorecon' from puppet, the next puppet run will reset file contexts for 'file' resources found in the catalog because of the cached file context rules.

      How to reproduce:


      file { '/srv/setest-before':
      	ensure => directory,
      -> exec { 'semanage':
      	command =>  '/usr/sbin/semanage fcontext -a -t home_root_t /srv/setest[^/]*',
      	creates => '/srv/setest-after',
      -> file { '/srv/setest-after':
      	ensure => directory,

      # semanage fcontext -l | grep -c '^/srv/setest'
      # puppet apply setest.pp

      Expected behavior:
      /srv/setest-before created with default file context
      /srv/setest-after created according to new file context rule.

      Seen behavior:
      Both directories are created with default file context.tUP21


          Issue Links



              • Assignee:
                ciprian.badescu Ciprian Badescu
                cp-msch Markus Schuster
              • Votes:
                9 Vote for this issue
                19 Start watching this issue


                • Created:

                  Zendesk Support