mirror of
https://github.com/xcat2/confluent.git
synced 2026-11-12 11:06:17 +00:00
Markus Hilger
ebdb71f321
urlmount is started by the initramfs before the policy is loaded, so it keeps running as kernel_t. The EL10 targeted policy denies kernel_t connecting to http_port_t, so after systemd loads the policy every read of a tethered root image that needs a new connection fails and the node freezes. imageboot.sh also runs dd from the initramfs later, which is denied entrypoint. Install a small module with exactly these two rules in images built with --selinux.