From c3c4805f9d7a6b78c1e5a45abb60555491a2dc83 Mon Sep 17 00:00:00 2001 From: Markus Hilger Date: Thu, 16 Jul 2026 19:51:07 +0200 Subject: [PATCH] SELinux label diskless runtime files on EL Centralize the SELinux chcon helper and use it for downloaded systemd units, onboot hooks, and apiclient files across EL7 through EL10. Include chcon in captured EL initramfs images. Without this fix the onboot services failed to start on SELinux enabled captured image. --- confluent_osdeploy/common/profile/scripts/functions | 10 +++++++--- .../profiles/default/scripts/imageboot.sh | 3 +++ .../el7-diskless/profiles/default/scripts/imageboot.sh | 3 +++ .../el8-diskless/profiles/default/scripts/imageboot.sh | 3 +++ .../el9-diskless/profiles/default/scripts/imageboot.sh | 3 +++ imgutil/el10/dracut/install | 2 +- imgutil/el7/dracut/install | 3 +-- imgutil/el8/dracut/install | 3 +-- imgutil/el9/dracut/install | 2 +- 9 files changed, 23 insertions(+), 9 deletions(-) diff --git a/confluent_osdeploy/common/profile/scripts/functions b/confluent_osdeploy/common/profile/scripts/functions index a88ba210..6cfd5c3b 100644 --- a/confluent_osdeploy/common/profile/scripts/functions +++ b/confluent_osdeploy/common/profile/scripts/functions @@ -108,6 +108,12 @@ run_remote_parts() { unset confluentscripttmpdir } +set_selinux_context() { + if [ -x /usr/bin/chcon ]; then + /usr/bin/chcon "$1" "$2" + fi +} + source_remote() { set_confluent_vars unsettmpdir=0 @@ -150,9 +156,7 @@ run_remote() { if [ $? != 0 ]; then echo $requestedcmd failed to download; return 1; fi chmod +x $1 cmd=$1 - if [ -x /usr/bin/chcon ]; then - chcon system_u:object_r:bin_t:s0 $cmd - fi + set_selinux_context system_u:object_r:bin_t:s0 "$cmd" shift ./$cmd $* retcode=$? diff --git a/confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh b/confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh index df34883d..86ba145a 100644 --- a/confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh +++ b/confluent_osdeploy/el10-diskless/profiles/default/scripts/imageboot.sh @@ -150,6 +150,9 @@ mkdir -p /sysroot/opt/confluent/bin curl -sf https://$confluent_whost/confluent-public/os/$confluent_profile/scripts/onboot.sh > /sysroot/opt/confluent/bin/onboot.sh chmod +x /sysroot/opt/confluent/bin/onboot.sh cp /opt/confluent/bin/apiclient /sysroot/opt/confluent/bin +set_selinux_context system_u:object_r:systemd_unit_file_t:s0 /sysroot/etc/systemd/system/onboot.service +set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/onboot.sh +set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/apiclient ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service cp /etc/confluent/functions /sysroot/etc/confluent/functions if grep installtodisk /proc/cmdline > /dev/null; then diff --git a/confluent_osdeploy/el7-diskless/profiles/default/scripts/imageboot.sh b/confluent_osdeploy/el7-diskless/profiles/default/scripts/imageboot.sh index 4e81fe19..0e960776 100644 --- a/confluent_osdeploy/el7-diskless/profiles/default/scripts/imageboot.sh +++ b/confluent_osdeploy/el7-diskless/profiles/default/scripts/imageboot.sh @@ -116,6 +116,9 @@ mkdir -p /sysroot/opt/confluent/bin curl -sf https://$confluent_mgr/confluent-public/os/$confluent_profile/scripts/onboot.sh > /sysroot/opt/confluent/bin/onboot.sh chmod +x /sysroot/opt/confluent/bin/onboot.sh cp /opt/confluent/bin/apiclient /sysroot/opt/confluent/bin +set_selinux_context system_u:object_r:systemd_unit_file_t:s0 /sysroot/etc/systemd/system/onboot.service +set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/onboot.sh +set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/apiclient ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service cp /etc/confluent/functions /sysroot/etc/confluent/functions if grep installtodisk /proc/cmdline > /dev/null; then diff --git a/confluent_osdeploy/el8-diskless/profiles/default/scripts/imageboot.sh b/confluent_osdeploy/el8-diskless/profiles/default/scripts/imageboot.sh index 38be47f7..6ca880fb 100644 --- a/confluent_osdeploy/el8-diskless/profiles/default/scripts/imageboot.sh +++ b/confluent_osdeploy/el8-diskless/profiles/default/scripts/imageboot.sh @@ -120,6 +120,9 @@ mkdir -p /sysroot/opt/confluent/bin curl -sf https://$confluent_whost/confluent-public/os/$confluent_profile/scripts/onboot.sh > /sysroot/opt/confluent/bin/onboot.sh chmod +x /sysroot/opt/confluent/bin/onboot.sh cp /opt/confluent/bin/apiclient /sysroot/opt/confluent/bin +set_selinux_context system_u:object_r:systemd_unit_file_t:s0 /sysroot/etc/systemd/system/onboot.service +set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/onboot.sh +set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/apiclient ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service cp /etc/confluent/functions /sysroot/etc/confluent/functions if grep installtodisk /proc/cmdline > /dev/null; then diff --git a/confluent_osdeploy/el9-diskless/profiles/default/scripts/imageboot.sh b/confluent_osdeploy/el9-diskless/profiles/default/scripts/imageboot.sh index ec188a2b..0f870319 100644 --- a/confluent_osdeploy/el9-diskless/profiles/default/scripts/imageboot.sh +++ b/confluent_osdeploy/el9-diskless/profiles/default/scripts/imageboot.sh @@ -153,6 +153,9 @@ mkdir -p /sysroot/opt/confluent/bin curl -sf https://$confluent_whost/confluent-public/os/$confluent_profile/scripts/onboot.sh > /sysroot/opt/confluent/bin/onboot.sh chmod +x /sysroot/opt/confluent/bin/onboot.sh cp /opt/confluent/bin/apiclient /sysroot/opt/confluent/bin +set_selinux_context system_u:object_r:systemd_unit_file_t:s0 /sysroot/etc/systemd/system/onboot.service +set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/onboot.sh +set_selinux_context system_u:object_r:bin_t:s0 /sysroot/opt/confluent/bin/apiclient ln -s /etc/systemd/system/onboot.service /sysroot/etc/systemd/system/multi-user.target.wants/onboot.service cp /etc/confluent/functions /sysroot/etc/confluent/functions if grep installtodisk /proc/cmdline > /dev/null; then diff --git a/imgutil/el10/dracut/install b/imgutil/el10/dracut/install index bface540..8578565c 100644 --- a/imgutil/el10/dracut/install +++ b/imgutil/el10/dracut/install @@ -13,7 +13,7 @@ dracut_install du df ssh-keygen scp dracut_install /lib64/libnss_dns* dracut_install /usr/lib64/libnl-3.so.200 dracut_install /etc/nsswitch.conf /etc/services /etc/protocols -dracut_install chmod whoami head tail basename tr +dracut_install chmod chcon whoami head tail basename tr dracut_install /usr/sbin/arping dhcpcd logger hostnamectl inst /bin/bash /bin/sh dracut_install /lib64/libfuse.so.2 diff --git a/imgutil/el7/dracut/install b/imgutil/el7/dracut/install index 08878d86..31d56f38 100644 --- a/imgutil/el7/dracut/install +++ b/imgutil/el7/dracut/install @@ -14,7 +14,7 @@ dracut_install du df ssh-keygen scp clear dhclient dracut_install /lib64/libnss_dns.so.2 dracut_install /usr/lib64/libnl-3.so.200 dracut_install /etc/nsswitch.conf /etc/services /etc/protocols -dracut_install chmod whoami head tail basename tr +dracut_install chmod chcon whoami head tail basename tr dracut_install /usr/sbin/arping /usr/sbin/dhclient-script ipcalc logger hostnamectl inst /bin/bash /bin/sh dracut_install /lib64/libfuse.so.2 @@ -33,4 +33,3 @@ inst /usr/lib/dracut/modules.d/40network/net-lib.sh /lib/net-lib.sh # network mount, and disk imaging helpers can come from a second stage # this is narrowly focused on getting network up and fetching images # and those images may opt to do something with cloning or whatever - diff --git a/imgutil/el8/dracut/install b/imgutil/el8/dracut/install index c00120b7..8d235db8 100644 --- a/imgutil/el8/dracut/install +++ b/imgutil/el8/dracut/install @@ -12,7 +12,7 @@ dracut_install du df ssh-keygen scp clear dhclient dracut_install /lib64/libnss_dns-2.28.so /lib64/libnss_dns.so.2 dracut_install /usr/lib64/libnl-3.so.200 dracut_install /etc/nsswitch.conf /etc/services /etc/protocols -dracut_install chmod whoami head tail basename tr +dracut_install chmod chcon whoami head tail basename tr dracut_install /usr/sbin/arping /usr/sbin/dhclient-script ipcalc logger hostnamectl inst /bin/bash /bin/sh dracut_install /lib64/libfuse.so.2 /lib64/libfuse.so.2.9.7 @@ -31,4 +31,3 @@ inst /usr/lib/dracut/modules.d/40network/net-lib.sh /lib/net-lib.sh # network mount, and disk imaging helpers can come from a second stage # this is narrowly focused on getting network up and fetching images # and those images may opt to do something with cloning or whatever - diff --git a/imgutil/el9/dracut/install b/imgutil/el9/dracut/install index 27e68a2f..46bf6b75 100644 --- a/imgutil/el9/dracut/install +++ b/imgutil/el9/dracut/install @@ -12,7 +12,7 @@ dracut_install du df ssh-keygen scp dhclient dracut_install /lib64/libnss_dns* dracut_install /usr/lib64/libnl-3.so.200 dracut_install /etc/nsswitch.conf /etc/services /etc/protocols -dracut_install chmod whoami head tail basename tr +dracut_install chmod chcon whoami head tail basename tr dracut_install /usr/sbin/arping /usr/sbin/dhclient-script ipcalc logger hostnamectl inst /bin/bash /bin/sh dracut_install /lib64/libfuse.so.2