Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Add file mode-awareness to selabel_lookup #9448

Merged
merged 2 commits into from
Aug 14, 2024
Merged

Add file mode-awareness to selabel_lookup #9448

merged 2 commits into from
Aug 14, 2024

Commits on Aug 13, 2024

  1. Infer file mode when doing selabel lookup 

    SELinux file contexts can be limited to files with a particular mode,
such as symbolic links only or directories only. Therefore, if we
specify no mode (a value of zero), our SELinux label lookup can return
an inaccurate result for the file, causing Puppet to set the wrong
SELinux type for a file. selabel_file(5) notes this:

> mode may be zero, however full matching may not occur.

This commit changes the behaviour of
get_selinux_default_context_with_handle to attempt to lstat(2) the file,
or otherwise rely on the `ensure` property to infer a suitable mode.

This should fix puppetlabs#9431.
    @davejbax @joshcooper
    davejbax authored and joshcooper committed Aug 13, 2024
    Configuration menu
    Copy the full SHA
    05421c5 View commit details
    Browse the repository at this point in the history

  2. Refactor selinux file mode 

    Create private `file_mode` method that returns either the current mode or a
default mode based on the desired `resource_ensure` value.
    @joshcooper
    joshcooper committed Aug 13, 2024
    Configuration menu
    Copy the full SHA
    bd1c0e5 View commit details
    Browse the repository at this point in the history