SELinux & Koji question

[Richard W.M. Jones]

This command fails:

+ chcon system_u:object_r:tmp_t:s0 tmp
chcon: failed to change context of 'tmp' to 'system_u:object_r:tmp_t:s0':
Operation not permitted

when run on Koji.  However it works fine when run on a Fedora 18
machine, with SELinux enforcing.

Does Koji have SELinux enforcing?  Why is labelling not allowed when
it works on a local machine?

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://et.redhat.com/~rjones/virt-df/

[Richard W.M. Jones]

On Tue, Sep 25, 2012 at 05:29:39PM +0100, Richard W.M. Jones wrote:
>  
>  This command fails:
>  
>  + chcon system_u:object_r:tmp_t:s0 tmp
>  chcon: failed to change context of 'tmp' to 'system_u:object_r:tmp_t:s0':
> Operation not permitted 
I should add that 'tmp' is the name of a directory under the
build dir.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://et.redhat.com/~rjones/virt-df/

[Kevin Fenzi]

On Tue, 25 Sep 2012 17:29:39 +0100
"Richard W.M. Jones" <rjones(a)redhat.com&gt; wrote:

>  
>  This command fails:
>  
>  + chcon system_u:object_r:tmp_t:s0 tmp
>  chcon: failed to change context of 'tmp' to
>  'system_u:object_r:tmp_t:s0': Operation not permitted
>  
>  when run on Koji.  However it works fine when run on a Fedora 18
>  machine, with SELinux enforcing.
>  
>  Does Koji have SELinux enforcing?  Why is labelling not allowed when
>  it works on a local machine? 
No, builders have selinux disabled, as running in permissive mode a
while back caused odd build failures. ;( 

It may be that it works fine now, but we would need to test that and
confirm before changing anything. 

kevin

[Richard W.M. Jones]

On Tue, Sep 25, 2012 at 10:35:43AM -0600, Kevin Fenzi wrote:
>  On Tue, 25 Sep 2012 17:29:39 +0100
>  "Richard W.M. Jones" <rjones(a)redhat.com&gt; wrote:
>  
>  > 
>  > This command fails:
>  > 
>  > + chcon system_u:object_r:tmp_t:s0 tmp
>  > chcon: failed to change context of 'tmp' to
>  > 'system_u:object_r:tmp_t:s0': Operation not permitted
>  > 
>  > when run on Koji.  However it works fine when run on a Fedora 18
>  > machine, with SELinux enforcing.
>  > 
>  > Does Koji have SELinux enforcing?  Why is labelling not allowed when
>  > it works on a local machine?
>  
>  No, builders have selinux disabled, as running in permissive mode a
>  while back caused odd build failures. ;( 
>  
>  It may be that it works fine now, but we would need to test that and
>  confirm before changing anything.  
Ah, I guess that explains it!

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/25/2012 12:29 PM, Richard W.M. Jones wrote:
>  
>  This command fails:
>  
>  + chcon system_u:object_r:tmp_t:s0 tmp chcon: failed to change context of
>  'tmp' to 'system_u:object_r:tmp_t:s0': Operation not permitted
>  
>  when run on Koji.  However it works fine when run on a Fedora 18 machine,
>  with SELinux enforcing.
>  
>  Does Koji have SELinux enforcing?  Why is labelling not allowed when it
>  works on a local machine?
>  
>  Rich.
>   
No idea.  Operation not supported seems like a file system without Xattr
support.  I thought apps within Koji (mock) think SELinux is disabled.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iEYEARECAAYFAlBh97oACgkQrlYvE4MpobO4RQCfe1b6J9Wz/sTWXEwSkvf+X5Xs
> L8cAn0inoUaIdZMZEry8Je7AgIEmzW8X
> =Pnuu
> -----END PGP SIGNATURE-----