Selinux causes problems for rpm scriptlets in the installroot.
---
src/pylorax/__init__.py | 12 ++++++++++++
1 file changed, 12 insertions(+)

diff --git a/src/pylorax/__init__.py b/src/pylorax/__init__.py
index 64924ce..44598d5 100644
--- a/src/pylorax/__init__.py
+++ b/src/pylorax/__init__.py
@@ -35,6 +35,7 @@ import os
import ConfigParser
import tempfile
import locale
+import subprocess

from base import BaseLoraxClass, DataHolder
import output
@@ -160,6 +161,17 @@ class Lorax(BaseLoraxClass):
logger.critical("no root privileges")
sys.exit(1)

+ # is selinux disabled?
+ logger.info("checking the selinux mode")
+ try:
+ seoutput = subprocess.check_output("/sbin/getenforce").strip()
+ except subprocess.CalledProcessError:
+ logger.error("could not get the selinux mode")
+ else:
+ if seoutput == "Enforcing":
+ logger.critical("selinux must be disabled or in Permissive mode")
+ sys.exit(1)
+
# do we have a proper yum base object?
logger.info("checking yum base object")
if not isinstance(ybo, yum.YumBase):
--
1.7.9.5

_______________________________________________
Anaconda-devel-list mailing list
Anaconda-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/anaconda-devel-list

On Tue, 2012-05-29 at 11:02 +0200, Martin Gracik wrote:
> Selinux causes problems for rpm scriptlets in the installroot.

You could use the selinux module instead:

import selinux
if selinux.security_getenforce():
...

There's also selinux.security_setenforce(), if you want to turn it off..

Also, could you make a note (in a comment in the code) about *why* we
need to turn off SELinux (i.e. what goes wrong when it's left on), so we
can work on fixing that later?

-w

_______________________________________________
Anaconda-devel-list mailing list
Anaconda-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/anaconda-devel-list

----- Original Message -----
> On Tue, 2012-05-29 at 11:02 +0200, Martin Gracik wrote:
> > Selinux causes problems for rpm scriptlets in the installroot.
>
> You could use the selinux module instead:

I was looking at this, I tried selinux_getenforcemode() and it didn't work.
I must have overlooked the security_getenforce() method. Thanks.

>
> import selinux
> if selinux.security_getenforce():
> ...
>
> There's also selinux.security_setenforce(), if you want to turn it
> off..

I don't want to turn off anything in lorax. User should be aware he needs to turn it off.

>
> Also, could you make a note (in a comment in the code) about *why* we
> need to turn off SELinux (i.e. what goes wrong when it's left on), so
> we
> can work on fixing that later?

I don't think we can fix it. Selinux just does not behave very good in chroots.
And I put in the comment "Selinux causes problems for rpm scriptlets in the installroot.".
Not enough?

>
> -w
>
> _______________________________________________
> Anaconda-devel-list mailing list
> Anaconda-devel-list@redhat.com
> https://www.redhat.com/mailman/listinfo/anaconda-devel-list
>

_______________________________________________
Anaconda-devel-list mailing list
Anaconda-devel-list@redhat.com
https://www.redhat.com/mailman/listinfo/anaconda-devel-list