Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid fixing labels while deploying new updates #3215

Merged
merged 1 commit into from
Oct 22, 2024
Merged

Avoid fixing labels while deploying new updates #3215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions overlay.d/07fix-selinux-labels/usr/lib/systemd/system/coreos-fix-selinux-labels.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ ExecStartPre=/bin/touch /var/lib/coreos-fix-selinux-labels.stamp
ExecStart=/usr/libexec/coreos-fix-selinux-labels
RemainAfterExit=yes
MountFlags=slave
# Run before zincati so we're not creating new files on the filesystem
# while we are fixing labels on existing files.
Before=zincati.service

[Install]
WantedBy=multi-user.target
13 changes: 12 additions & 1 deletion tests/kola/upgrade/extended/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,11 +154,18 @@ move-to-cgroups-v2() {
fi
}

selinux-sanity-check() {
# A helper to wait for the fix-selinux-labels script to finish
wait-for-coreos-fix-selinux-labels() {
# First make sure the migrations/fix script has finished (if it is going
# to run) before doing the checks
systemd-run --wait --property=After=coreos-fix-selinux-labels.service \
echo "Waited for coreos-fix-selinux-labels.service to finish"
}

selinux-sanity-check() {
# First make sure the migrations/fix script has finished if this is the boot
# where the fixes are taking place.
wait-for-coreos-fix-selinux-labels
# Verify SELinux labels are sane. Migration scripts should have cleaned
# up https://github.com/coreos/fedora-coreos-tracker/issues/1772
unlabeled="$(find /sysroot -context '*unlabeled_t*' -print0 | xargs --null -I{} ls -ldZ '{}')"
Expand Down Expand Up @@ -267,6 +274,10 @@ esac
# version, which should be in the compose OSTree repo.
if vereq $version $last_release; then
systemctl stop zincati
# In case the SELinux fix script is running this boot let's wait for it to
# finish before initiating an `rpm-ostree rebase` so we aren't writing at the
# same time it's fixing.
wait-for-coreos-fix-selinux-labels
rpm-ostree rebase "fedora-compose:fedora/$(arch)/coreos/${target_stream}" $target_version
/tmp/autopkgtest-reboot $version # execute the reboot
sleep infinity
Expand Down
Loading