The restorecon problem is coming back

[Ron Yorston]

On 6th May an update to selinux-policy for Fedora 32 (3.14.5-38.fc32)
caused all filesystems to be relabelled.  In my case this took over
twelve hours.  I was not happy.

It appears the developers have a workaround for the problem but the
update that applies it will cause all filesystems to be relabelled
if you already have the borked 3.14.5-38.fc32 update.

The new update is currently in updates-testing and will no doubt be
making its way onto our systems soon enough.  The developers say[1]:

   Please note updating from the previous package version
   selinux-policy-3.14.5-38.fc32 will have all filesystems relabeling
   as a result which cannot be prevented. If relabeling takes a lot
   of time, consider unmounting some filesystems, updating manually,
   postponing the update to later.

You have been warned.

Ron

[1] https://bodhi.fedoraproject.org/updates/FEDORA-2020-886cc9af08

[Ed Greshko]

On 2020-05-25 15:36, Ron Yorston wrote:
>  On 6th May an update to selinux-policy for Fedora 32
> (3.14.5-38.fc32)
>  caused all filesystems to be relabelled.  In my case this took over
>  twelve hours.  I was not happy. 
Thanks for the Heads-UP.  I suppose we'll soon find out how many people didn't
read this.  :-)

Lucky for me the time it takes on most of my systems is less than 15 minutes.


>  It appears the developers have a workaround for the problem but the
>  update that applies it will cause all filesystems to be relabelled
>  if you already have the borked 3.14.5-38.fc32 update.
>
>  The new update is currently in updates-testing and will no doubt be
>  making its way onto our systems soon enough.  The developers say[1]:
>
>     Please note updating from the previous package version
>     selinux-policy-3.14.5-38.fc32 will have all filesystems relabeling
>     as a result which cannot be prevented. If relabeling takes a lot
>     of time, consider unmounting some filesystems, updating manually,
>     postponing the update to later.
>
>  You have been warned.
>
>  Ron
>
>  [1] https://bodhi.fedoraproject.org/updates/FEDORA-2020-886cc9af08
>  
-- 
The key to getting good answers is to ask good questions.

[Patrick O'Callaghan]

On Mon, 2020-05-25 at 16:56 +0800, Ed Greshko wrote:
>  On 2020-05-25 15:36, Ron Yorston wrote:
>  
>  > On 6th May an update to selinux-policy for Fedora 32 (3.14.5-38.fc32)
>  > caused all filesystems to be relabelled.  In my case this took over
>  > twelve hours.  I was not happy.
>  
>  
>  Thanks for the Heads-UP.  I suppose we'll soon find out how many people didn't
> read this.  :-)
>  
>  
>  
>  Lucky for me the time it takes on most of my systems is less than 15 minutes. 
Didn't even notice it. I just rebooted and it did take longer than
usual (a minute or two instead of 30 seconds) but I put that down to my
current RAID problems.

poc

[Ed Greshko]

On 2020-05-25 20:20, Patrick O'Callaghan wrote:
>  On Mon, 2020-05-25 at 16:56 +0800, Ed Greshko wrote:
> > On 2020-05-25 15:36, Ron Yorston wrote:
> >
> >> On 6th May an update to selinux-policy for Fedora 32 (3.14.5-38.fc32)
> >> caused all filesystems to be relabelled.  In my case this took over
> >> twelve hours.  I was not happy.
> >
> > Thanks for the Heads-UP.  I suppose we'll soon find out how many people
> didn't read this.  :-)
> >
> >
> >
> > Lucky for me the time it takes on most of my systems is less than 15 minutes.
>  Didn't even notice it. I just rebooted and it did take longer than
>  usual (a minute or two instead of 30 seconds) but I put that down to my
>  current RAID problems. 
So, you're now at selinux-policy-3.14.5-39.fc32?  If you didn't notice it, I want
your darn fast
CPU's.  :-)


-- 
The key to getting good answers is to ask good questions.

[Patrick O'Callaghan]

On Mon, 2020-05-25 at 20:35 +0800, Ed Greshko wrote:
>  On 2020-05-25 20:20, Patrick O'Callaghan wrote:
>  > On Mon, 2020-05-25 at 16:56 +0800, Ed Greshko wrote:
>  > > On 2020-05-25 15:36, Ron Yorston wrote:
>  > > 
>  > > > On 6th May an update to selinux-policy for Fedora 32 (3.14.5-38.fc32)
>  > > > caused all filesystems to be relabelled.  In my case this took over
>  > > > twelve hours.  I was not happy.
>  > > 
>  > > Thanks for the Heads-UP.  I suppose we'll soon find out how many people
> didn't read this.  :-)
>  > > 
>  > > 
>  > > 
>  > > Lucky for me the time it takes on most of my systems is less than 15 minutes.
>  > Didn't even notice it. I just rebooted and it did take longer than
>  > usual (a minute or two instead of 30 seconds) but I put that down to my
>  > current RAID problems.
>  
>  So, you're now at selinux-policy-3.14.5-39.fc32?  If you didn't notice it, I want
> your darn fast
>  CPU's.  :-) 
No, 3.14.5-38 as the previous message said. I read that as "to
<version>" rather than "for <version>". Why "for"?
Presumably the
update works for more than one existing version.

poc

[Ed Greshko]

On 2020-05-25 21:52, Patrick O'Callaghan wrote:
>  On Mon, 2020-05-25 at 20:35 +0800, Ed Greshko wrote:
> > On 2020-05-25 20:20, Patrick O'Callaghan wrote:
> >> On Mon, 2020-05-25 at 16:56 +0800, Ed Greshko wrote:
> >>> On 2020-05-25 15:36, Ron Yorston wrote:
> >>>
> >>>> On 6th May an update to selinux-policy for Fedora 32 (3.14.5-38.fc32)
> >>>> caused all filesystems to be relabelled.  In my case this took over
> >>>> twelve hours.  I was not happy.
> >>> Thanks for the Heads-UP.  I suppose we'll soon find out how many people
> didn't read this.  :-)
> >>>
> >>>
> >>>
> >>> Lucky for me the time it takes on most of my systems is less than 15
> minutes.
> >> Didn't even notice it. I just rebooted and it did take longer than
> >> usual (a minute or two instead of 30 seconds) but I put that down to my
> >> current RAID problems.
> > So, you're now at selinux-policy-3.14.5-39.fc32?  If you didn't notice it, I
> want your darn fast
> > CPU's.  :-)
>  No, 3.14.5-38 as the previous message said. I read that as "to
>  <version>" rather than "for <version>". Why "for"?
> Presumably the
>  update works for more than one existing version. 
I see.

Oh, and the restorecon happens when the scriplet is run during the update.  So, not a
"re-label" in the sense of "fixfiles onboot".


-- 
The key to getting good answers is to ask good questions.