Jira (PUP-8477) selinux types are being set on every run

Andreas Ntaflos (JIRA) Sun, 25 Feb 2018 13:58:17 -0800

Title: Message Title

We observe similar problems on Ubuntu 14.04 and 16.04 using Puppet 5.4.0. SELinux properties are set on every Puppet agent run for the .k5login files we manage. The output of a typical Puppet agent run looks like this:

Notice: /Stage[main]/Profile::K5login/K5login[/root/.k5login]/seluser: seluser changed  to 'user_u'

Notice: /Stage[main]/Profile::K5login/K5login[/root/.k5login]/selrole: selrole changed  to 'object_r'

Notice: /Stage[main]/Profile::K5login/K5login[/root/.k5login]/seltype: seltype changed  to 'krb5_home_t'

Notice: /Stage[main]/Profile::K5login/K5login[/root/.k5login]/selrange: selrange changed  to 's0'

Notice: Applied catalog in 22.20 seconds

We manage the .k5login files using a profile that looks like this:

class profile::k5login {

  $k5login_defaults = lookup('profile::k5login::k5login_defaults', Hash, 'deep', {})

  $k5logins         = lookup('profile::k5login::k5logins', Hash, 'deep', {})

  create_resources('k5login', $k5logins, $k5login_defaults)

We never set any SELinux-specific properties; in fact SELinux is not even active on our Ubuntu nodes. The output of ls -laZ /root/.k5login looks like this:

-rw-r--r-- 1 root root ? 21 Sep  4 19:10 /root/.k5login

Note the ? which means there are not security contexts active for the file.

Add Comment

This message was sent by Atlassian JIRA

--
You received this message because you are subscribed to the Google Groups "Puppet Bugs" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/group/puppet-bugs.
For more options, visit https://groups.google.com/d/optout.

Jira (PUP-8477) selinux types are being set on every run

Reply via email to