(PA-5632) Update SELinux on Red Hat 9 to 3.3 #737
Conversation
|
These changes were built and passed an ad hoc pipeline for both x86_64 and aarch64: https://jenkins-platform.delivery.puppetlabs.net/view/puppet-agent/view/ad-hoc/job/platform_puppet-agent-extra_puppet-agent-integration-suite_adhoc-ad_hoc/RMM_COMPONENT_TO_TEST_NAME=puppet_agent,SLAVE_LABEL=k8s-beaker,TEST_TARGET=redhat9-64a/1194/ This is definitely pretty hacky so feedback and improvements welcome |
mhashizume
force-pushed
the
PA-5632/master/rhel9-selinux
branch
from
d423169 to
249b0bd
Compare
| @@ -57,6 +68,11 @@ | |||
| steps << "#{platform.patch} --strip=0 --fuzz=0 --ignore-whitespace --no-backup-if-mismatch < ../selinuxswig_ruby_wrap.patch" | |||
| end | |||
|
|
|||
| # libselinux 3.3 is the minimum version we want to build on RHEL 9, but the | |||
There was a problem hiding this comment.
Have we tried using versions 3.4 or 3.5? I'm fine merging this as is, but, if we could just use a later version of selinux, maybe we can avoid this hack?
There was a problem hiding this comment.
I haven't tried it, my assumption was that there would be compatibility issues if there were a discrepancy between the bindings we built and the version running on the system. Do you think it would be worth a shot?
There was a problem hiding this comment.
Yeah, I'm not sure if there would be a discrepancy, seems like it might possibly work? As long as the major versions are the same...
There was a problem hiding this comment.
I tried using the SELinux 3.4 tarball and installing the libselinux-devel-3.4 package. It seems like it creates the same compatibility issue as we saw in the original ticket. On an adhoc agent build on x86_64:
Begin tests/selinux.rb
PA-3067: Manage selinux
* test require 'selinux'
ergotropic-trap.delivery.puppetlabs.net (ergotropic-trap.delivery.puppetlabs.net) 23:22:11$ env PATH="/opt/puppetlabs/puppet/bin:${PATH}" ruby -e 'require "selinux"'
/opt/puppetlabs/puppet/lib/ruby/site_ruby/2.7.0/rubygems/core_ext/kernel_require.rb:86:in `require': /lib64/libselinux.so.1: version `LIBSELINUX_3.4' not found (required by /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/2.7.0/x86_64-linux/selinux.so) - /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/2.7.0/x86_64-linux/selinux.so (LoadError)
from /opt/puppetlabs/puppet/lib/ruby/site_ruby/2.7.0/rubygems/core_ext/kernel_require.rb:86:in `require'
from -e:1:in `<main>'
I assume this happens because there's a mismatch between what we build against and what's present on the system.
I think the only way we can avoid this issue is to target the lowest common denominator, SELinux 3.3.
Prior to this commit, there was a discrepancy between the versions of SELinux we built our Red Hat Enterprise Linux (RHEL) 9 runtimes on and the minimum version available on the OS (SELinux 3.3). This commit builds RHEL 9 runtimes with version 3.3 of SELinux to resolve that discrepancy.
mhashizume
force-pushed
the
PA-5632/master/rhel9-selinux
branch
from
249b0bd to
0228a1a
Compare
Prior to this commit, there was a discrepancy between the versions of SELinux we built our Red Hat Enterprise Linux (RHEL) 9 runtimes on and the minimum version available on the OS (SELinux 3.3).
This commit builds RHEL 9 runtimes with version 3.3 of SELinux to resolve that discrepancy.