mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-08-17 18:06:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1502 from flatcar-linux/t-lo/fix-semodule-in-policycoreutils-postinst

Browse Source 
sys-apps/policycoreutils: update correct SELinux store
This commit is contained in:
Thilo Fromm 2021-12-16 18:51:40 +01:00 committed by GitHub
commit cfc5fe67cc
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sdk_container/src/third_party/coreos-overlay/changelog/bugfixes/2021-12-16-policycoreutils-fix-semodule-postinst.md vendored Normal file
View File

@ -0,0 +1,10 @@
The policycoreutils ebuild calls semodule in postinst to update SELinux stores.
It does not, however, tells semodule the correct ROOT to use, so builds that go into /build/[arch]-usr end up updating the SDK's store.
This patch resolves the following error message:
```
$ emerge-amd64-usr policycoreutils
[...]
libsemanage.semanage_commit_sandbox: Error while renaming /var/lib/selinux/targeted/active to /var/lib/selinux/targeted/previous. (Invalid cross-device link)
```
The error is observed when using the SDK Container to build an OS image.
The `semanage` run in policycoreutilsi' `postinst` now also updates the correct store, which it previously did not.

4
sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/policycoreutils-3.1-r3.ebuild vendored
View File

@ -219,7 +219,7 @@ pkg_postinst() {
for POLICY_TYPE in ${POLICY_TYPES} ; do
# There have been some changes to the policy store, rebuilding now.
# https://marc.info/?l=selinux&m=143757277819717&w=2
einfo "Rebuilding store ${POLICY_TYPE} (without re-loading)."
semodule -s "${POLICY_TYPE}" -n -B || die "Failed to rebuild policy store ${POLICY_TYPE}"
einfo "Rebuilding store ${POLICY_TYPE} in '${ROOT:-/}' (without re-loading)."
semodule -S "${ROOT:-/}" -s "${POLICY_TYPE}" -n -B || die "Failed to rebuild policy store ${POLICY_TYPE}"
done
}