setfiles without -F only corrects the type of a file and keeps its user,
role and range. Files of a new build tree get the SELinux user of the
process that created them, so about 1800 of them stayed unconfined_u
instead of system_u. Label the new tree with -F. Pack keeps relabeling
without it, so contexts set on purpose in a captured or edited tree stay.
imageboot.sh wrote /etc/netplan/10-<iface>-confluentcfg.yaml with the
default mode 0644, and netplan warns that its configuration should not
be accessible by others. confignet already writes its files 0600, but
it leaves an identical file in place, so the boot-time one stayed 0644.
extract_untethered_rootimg reports failure, for example when the image
does not fit into the memory backed root, but imageboot.sh ignored it and
booted into the partly extracted root, which then hung later on. Stop
with a message saying why instead.
Without netplan, nmcli or wicked the manager variable was never set and
confignet died with a NameError. Say what is missing instead. Also pick
netplan over nmcli in the retry pass, as the first pass does, instead of
switching to NetworkManager on systems that have both.
The kernel package writes a boot loader entry inside the build chroot.
Its linux and initrd paths point into the scratch directory of the
server (grub2-mkrelpath sees the bind mount) and its options are the
kernel command line of the server. Diskless boot never reads it, but
after installing to disk it sits next to the entry post.sh writes on
the installed system, so grub may pick the broken one. Remove the
entries when building, post.sh writes the right one when installing.
The _dbpath macro set for fingerprinting an image is process global. It
was only removed after a successful query, so an error left it set and
later fingerprinting in the same process, which fancy_chroot does on
every command, read the wrong database.
Without the rpm Python bindings, fingerprinting an image found its
system-release provider in the image database but then ran rpm -qi
against the host, so an image whose release package the host lacks was
not recognized. Use the same rooted rpm command for both queries.
image2disk rewrote root= in the boot loader entries but kept their
linux and initrd paths. Those come from where the image was built: in a
diskless image from imgutil they carry the scratch directory of the
server (grub2-mkrelpath sees its bind mount), and a /boot/ path does not
match the separate /boot filesystem image2disk creates for such images.
grub then fails with "you need to load the kernel". Make the paths
relative to the boot filesystem of the target.
DebHandler raised SystemExit on a failed apt-get, but prep_root runs
under run_constrained, which only catches Exception and otherwise exits
0. A failed package install was therefore reported as a successful
build. Raise an Exception instead, as ElHandler already does.
f9dc92ec fixed this in client.py, but nodeattrib has used asynclient.py
since 76efea7c, so it still sends the underscored name (info_note
instead of info.note) as the attribute, and a missing variable raises a
KeyError instead of a usage error. Port the client.py logic over.
EL9 and older keep the rpm database in /var/lib/rpm, EL10 moved it to
/usr/lib/sysimage/rpm. fingerprint_host_el opened the image with the
default path of the host, so on an EL10 server an EL9 image was not
recognized (and an empty database was created in it). pack then wrote
no profile.yaml and no addons link, and import refused the image. Use
/var/lib/rpm when it is a real directory in the image. In EL10 it is a
relative link, so the default of the host still applies.
An untethered or uncompressed diskless boot downloaded the root image
only from the deployment server and retried it forever when that server
failed. Try the other managers that answered discovery as well, as the
tethered urlmount already does.
urlmount limits each small range request to 10 seconds, but the single
whole-image download cannot take a total limit. Give up on a connect
after 10 seconds and on a transfer that stalls for 30 seconds instead,
so a hung server moves on to the next one.
Write the nightly release notes only after every bundle is uploaded.
The notes carry the build key that prepare compares against, so a
failed upload used to record the new build anyway, and the following
nights skipped it while the release kept stale or missing bundles.
Publish only from the default branch. A manual run defaulted to
publishing, so testing the workflow on a topic branch replaced the
nightly with that branch.
Run the packaging build on pull requests that touch MANIFEST.in, which
decides what goes into the client and server packages, or anything
under confluent_vtbufferd, which is compiled here and carries the only
debian/ packaging in the tree.
Give every job a timeout instead of the six hour default, so a hung
container or download fails within minutes.
The initramfs writes the overlay upper layer before the SELinux policy
is loaded, so those files are unlabeled_t. On an enforcing image /
itself is unlabeled, and logind, getty and sshd fail.
Label exactly the upper layer paths like el9-diskless does. The root
is an overlay in untethered mode too, so this covers both. chcon comes
from the image, the initramfs has none.
Without it the server is only found by link-local discovery, so nodes
behind a DHCP relay never boot. Ported from el9-diskless. The initramfs
has dhcpcd from 24.04 on and only ipconfig before.
Without it the server is only found by link-local discovery, so nodes
behind a DHCP relay never boot. Ported from el9-diskless, with dhcpcd
in place of dhclient.
The SUSE kernel builds it as a module, so dhcpcd failed with "Address
family not supported" and a diskless node with ipv4_method dhcp never
got an address.
Removing it afterwards copied /etc/dracut.conf.d up unlabeled in
tethered mode on images built with SELinux. Skip the whiteout that the
removal leaves in the upper layer.
imgutil build --selinux installs the targeted policy and keeps SELinux enforcing.
imgutil pack labels images that enable SELinux with their own policy.
The install runs before a policy is loaded, so the module index from
kernel-install and files of later post scripts stayed unlabeled and
systemd-modules-load failed. Relabel every local filesystem last.
On an untethered root, files the initramfs writes before policy load
and sockets that unsquashfs creates without attributes have no label.
Label every inode without one, as the upper layer is in tethered mode.
Jarrod Johnson
Markus Hilger