Actions
Story #97
open
As a contributor, I rest easy knowing SELinux is Enforcing in the Pulp3 Vagrant environment
Status:
NEW
Priority:
Normal
Assignee:
-
Category:
Installer - Moved to GitHub issues
Sprint/Milestone:
-
Start date:
Due date:
% Done:
50%
Estimated time:
(Total: 0:00 h)
Platform Release:
Groomed:
No
Sprint Candidate:
No
Tags:
SELinux
Sprint:
Quarter:
Description
The real deliverables are in the checklist, but here is some extra info on how to compile it.
To compile and install the Pulp SELinux with Ansible for Vagrant you will need to:
- Install selinux-policy-devel rpm with ansible
- Compile the policy similar to
make NAME=celery -f /usr/share/selinux/devel/Makefile DISTRO=fedora24except with ansible - Install the policy using Ansible
- Have ansible call the restorecon script or fixfiles (see checklist item) so that all the right restorecon calls occur. Stay DRY with these calls if possible.[0]
- If necessary, have the policy use "developer layout" .fc files to cause the .te compiled policies to be compatible with the layout used by Vagrant.
Use the ps -awfuxZ | grep celery to verify it is becoming the celery_t security label type. Similarly httpd should get an httpd security type. Then do some testing with Pulp and SELinux enabled.
[0]: https://github.com/pulp/pulp/blob/master/server/selinux/server/relabel.sh
Related issues
Actions
.