Issue #8714 has been updated by Sean Millichamp. Status changed from Needs Decision to Needs More Information
Alright, sorry that this took longer than I had hoped. I have looked into it and the code in Puppet actually calls the ruby-selinux library bindings (not chcon) but it does use the lgetfilecon and lsetfilecon calls which will (if the file is a symbolic link) set the context on the link itself, not the target of the link. Ioannis - can you provide an actual example with Puppet manifest code that exhibits this behavior? I can't reproduce it. Thanks. ---------------------------------------- Bug #8714: Changing SELinux contexts on symlinks requires the '-h' parameter in chcon https://projects.puppetlabs.com/issues/8714 Author: Ioannis Aslanidis Status: Needs More Information Priority: Normal Assignee: Sean Millichamp Category: SELinux Target version: Affected Puppet version: 2.6.9 Keywords: Branch: There is a problem when trying to chance SELinux contexts through puppet. Looks like puppet does not call **chcon** with the **-h** parameter. # ls -ald /home/file/test lrwxrwxrwx 1 root root 20 Aug 1 12:23 /home/file/test -> /mnt/file/test # chcon -v -t user_home_t test failed to change context of test to system_u:object_r:user_home_t chcon: failed to change context of test to system_u:object_r:user_home_t: Operation not supported # chcon -v -h -t user_home_t test context of /home/file/test changed to system_u:object_r:user_home_t This results in puppet trying to change the SELinux contexts on every run without success and without knowing that it actually failed. -- You have received this notification because you have either subscribed to it, or are involved in it. To change your notification preferences, please click here: http://projects.puppetlabs.com/my/account -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/puppet-bugs?hl=en.
