Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-7559

puppet doesn't specify file type to get default selinux context

    XMLWordPrintable

    Details

    • Template:
    • Acceptance Criteria:
      Hide

      File should be created with the actual default context for the appropriate file type for new files.

      Show
      File should be created with the actual default context for the appropriate file type for new files.
    • Team:
      Night's Watch
    • QA Risk Assessment:
      Needs Assessment

      Description

      When creating a new file, puppet finds out the default selinux context with matchpathcon but it's not specifying the file type what can lead to use the incorrect context (selinux default context depends on file type) and breaks idempotency.

      Reproducer:

       
      [root@vmname ~]# cat test.pp 
      file {
          '/etc/systemd/system/redis.service.d':
             ensure => directory
      }
       
      # puppet apply test.pp 
      Notice: Compiled catalog for vmname.example.com in environment production in 0.15 seconds
      Notice: /Stage[main]/Main/File[/etc/systemd/system/redis.service.d]/ensure: created
      Notice: Applied catalog in 0.54 seconds
      # ll -Zd /etc/systemd/system/redis.service.d
      drwxr-xr-x. root root system_u:object_r:redis_unit_file_t:s0 /etc/systemd/system/redis.service.d
      # puppet apply test.pp 
      Notice: Compiled catalog for vmname.example.com in environment production in 0.15 seconds
      Notice: /Stage[main]/Main/File[/etc/systemd/system/redis.service.d]/seltype: seltype changed 'redis_unit_file_t' to 'systemd_unit_file_t'
      Notice: Applied catalog in 0.51 seconds
      [root@vmname ~]# ll -Zd /etc/systemd/system/redis.service.d
      drwxr-xr-x. root root system_u:object_r:systemd_unit_file_t:s0 /etc/systemd/system/redis.service.d
       
      
      

      Note that first run used wrong selinux type for the just created directory.

        Attachments

          Activity

            People

            Assignee:
            Unassigned
            Reporter:
            amoralej Alfredo Moralejo
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:

                Zendesk Support