selinux and kickstart

[irfan irfan]

Somebody can help me, how to install xguest with kickstart file. in the log file semanage
can`t run in kickstart process. Is selinux disable on kickstart process ?
Thanks before

[Dominick Grift]

On Sat, May 29, 2010 at 11:07:21PM +0800, irfan irfan wrote:
>  Somebody can help me, how to install xguest with kickstart file. in
> the log file semanage can`t run in kickstart process. Is selinux disable on kickstart
> process ?
>  Thanks before 
I am not sure but can you not just "useradd -Z xguest_u liveuser" and "yum
install xguest"?
>  
>  
>  
>         
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux

[irfan irfan]

xguest still cannot install in kickstart process with error like this 
Error in PREIN scriptlet in rpm package xguest-1.0.8-3.fc12.noarch 
error:%pre(xguest-1.0.8-3.fc12.noarch) scriptlet failed,exit status 1






________________________________
From: Dominick Grift <domg472(a)gmail.com&gt;
To: selinux(a)lists.fedoraproject.org
Sent: Sun, May 30, 2010 3:54:20 AM
Subject: Re: selinux and kickstart

On Sat, May 29, 2010 at 11:07:21PM +0800, irfan irfan wrote:
>  Somebody can help me, how to install xguest with kickstart file. in
> the log file semanage can`t run in kickstart process. Is selinux disable on kickstart
> process ?
>  Thanks before 
I am not sure but can you not just "useradd -Z xguest_u liveuser" and "yum
install xguest"?
>  
>  
>  
>        
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux

[Dominick Grift]

On Sun, May 30, 2010 at 03:08:02PM +0800, irfan irfan wrote:
>  xguest still cannot install in kickstart process with error like this
>
>  Error in PREIN scriptlet in rpm package xguest-1.0.8-3.fc12.noarch 
>  error:%pre(xguest-1.0.8-3.fc12.noarch) scriptlet failed,exit status 1 
I guess you also need to install policycoreutils-python
>  
>  
>  
>  
>  
>  
>  ________________________________
>  From: Dominick Grift <domg472(a)gmail.com&gt;
>  To: selinux(a)lists.fedoraproject.org
>  Sent: Sun, May 30, 2010 3:54:20 AM
>  Subject: Re: selinux and kickstart
>  
>  On Sat, May 29, 2010 at 11:07:21PM +0800, irfan irfan wrote:
>  > Somebody can help me, how to install xguest with kickstart file. in the log file
> semanage can`t run in kickstart process. Is selinux disable on kickstart process ?
>  > Thanks before
>  
>  I am not sure but can you not just "useradd -Z xguest_u liveuser" and "yum
> install xguest"?
>  > 
>  > 
>  > 
>  >      
>  
>  > --
>  > selinux mailing list
>  > selinux(a)lists.fedoraproject.org
>  > https://admin.fedoraproject.org/mailman/listinfo/selinux
>  
>  
>

[Ted Toth]

On Sun, May 30, 2010 at 2:08 AM, irfan irfan <irfan_area47(a)yahoo.co.id&gt; wrote:
>  xguest still cannot install in kickstart process with error like
> this
>  Error in PREIN scriptlet in rpm package xguest-1.0.8-3.fc12.noarch
>  error:%pre(xguest-1.0.8-3.fc12.noarch) scriptlet failed,exit status 1
>
>
>
>  ________________________________
>  From: Dominick Grift <domg472(a)gmail.com&gt;
>  To: selinux(a)lists.fedoraproject.org
>  Sent: Sun, May 30, 2010 3:54:20 AM
>  Subject: Re: selinux and kickstart
>
>  On Sat, May 29, 2010 at 11:07:21PM +0800, irfan irfan wrote:
> > Somebody can help me, how to install xguest with kickstart file. in the
> > log file semanage can`t run in kickstart process. Is selinux disable on
> > kickstart process ?
> > Thanks before
>
>  I am not sure but can you not just "useradd -Z xguest_u liveuser" and
> "yum
>  install xguest"?
> >
> >
> >
> >
>
> > --
> > selinux mailing list
> > selinux(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
>
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux
>  
I think the issue is that SELinux is install but isn't really running
yet. We have packages that install policy and do semanage stuff and we
install them in a %post (without the --nochroot) after a reboot.

Ted

[Moray Henderson (ICT)]

Xavier Toth wrote:
> Sent: 30 May 2010 21:46
> To: irfan irfan
> Cc: selinux(a)lists.fedoraproject.org
> Subject: Re: selinux and kickstart
>
> On Sun, May 30, 2010 at 2:08 AM, irfan irfan <irfan_area47(a)yahoo.co.id&gt;
> wrote:
> > xguest still cannot install in kickstart process with error like this
> > Error in PREIN scriptlet in rpm package xguest-1.0.8-3.fc12.noarch
> > error:%pre(xguest-1.0.8-3.fc12.noarch) scriptlet failed,exit status 1
> >
> >
> >
> > ________________________________
> > From: Dominick Grift <domg472(a)gmail.com&gt;
> > To: selinux(a)lists.fedoraproject.org
> > Sent: Sun, May 30, 2010 3:54:20 AM
> > Subject: Re: selinux and kickstart
> >
> > On Sat, May 29, 2010 at 11:07:21PM +0800, irfan irfan wrote:
> >> Somebody can help me, how to install xguest with kickstart file. in 
the
> >> log file semanage can`t run in kickstart process. Is selinux
> disable 
on
> >> kickstart process ?
> >> Thanks before
> >
> > I am not sure but can you not just "useradd -Z xguest_u liveuser" and
> "yum
> > install xguest"?
> >>
> >>
> >>
> >>
> >
> >> --
> >> selinux mailing list
> >> selinux(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >
> >
> >
> > --
> > selinux mailing list
> > selinux(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
> >
>
> I think the issue is that SELinux is install but isn't really running
> yet. We have packages that install policy and do semanage stuff and we
> install them in a %post (without the --nochroot) after a reboot.
>
> Ted
> --
> selinux mailing list
> selinux(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux 

SELinux is installed and running during kickstart - but it is not the
_same_ SELinux that appears on your live system.  If a particular policy
module is required to install a package, that policy module must be
present in the anaconda boot image to make it available during
kickstart.  You may have to start fiddling with anaconda's buildinstall
scripts, or Fedora's pungi tool, to get the policy module you need
running during kickstart.


Moray.
"To err is human.  To purr, feline"

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The problem I believe is the xguest package in F12 is trying to set the
booleans required for xguest in the %pre script using setsebool.  These
booleans do not exist in the chroot so the setsebool command fails and
xguest fails to install.

In F13, I have changed this around so that the booleans are set using
the semanage booleans -a -S targeted call.  This allows the booleans to
be turned on without the booleans being present in the running system.
I believe this fix required fixes in policycoreutils as well as the
xguest package.  I can look into back porting the fix for F12 if you can
not move to the Fedora 13.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.14 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAkwFCDUACgkQrlYvE4MpobMv+ACgpTNSxKbpESoCesG93B4xYa8k
> FTgAnRhnE6CEcIEKn/ogbOBUL7orAoTc
> =nYXM
> -----END PGP SIGNATURE-----