Repository navigation
fix(netboot): correct SELinux settings and firewalld cleanup - #7970
Merged
dhilst merged 5 commits intoOct 23, 2026
Merged
Conversation
Older bubblewrap releases reject a symlink mount destination. Bind Bash over the resolved shell path without changing the profile cases.
Match the complete enforcing or permissive setting. Preserve comments and whitespace, and do not change unrelated lines or create a missing policy file.
Execute all affected owners and their aliases in isolated image roots. Check policy contents and metadata, missing files, repeated runs and host sentinels. Run the cases in Ubuntu and EL CI.
Use separate test commands under /bin/sh. Remove regular files and symlinks, including dangling links, while retaining absent entries and directories.
Execute each profile through /bin/sh. Check both firewalld entries as regular files, valid links, dangling links, directories and missing paths. Preserve unit targets, unrelated links and the older profiles without this cleanup.
dhilst
approved these changes
Oct 23, 2026
dhilst
approved these changes
Oct 23, 2026
dhilst
added a commit
to VersatusHPC/xcat-core
that referenced
this pull request
Oct 23, 2026
Twelve conflicts, all from xcat-core/xcat2#7970 landing. Eleven are the one sed line in the netboot postinstall profiles, where xcat2#7970 and this branch replaced the same line with different patterns. Master's wins: it anchors on optional leading blanks and preserves a trailing comment, which this branch's `s/^SELINUX=.*$/SELINUX=disabled/` would have eaten. This branch's own postinstall_selinux_config.bats asserts "the comment that names permissive keeps its text", so the better pattern is the one its test already wanted -- 6 of 6 pass on master's version. What master's pattern does not catch is a value outside enforcing|permissive, which nothing here tests and no stock config ships. The twelfth is .github/workflows/xcat_test.yml: master added a step to the existing job and this branch adds a whole selinux_policy_test job after it. Resolved as the union, with master's step where it put it; the file still parses and names three jobs. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
dhilst
added a commit
to VersatusHPC/xcat-core
that referenced
this pull request
Oct 23, 2026
Clean against the master that now carries xcat-core/xcat2#7968, xcat2#7970, xcat2#7971, xcat2#7975, xcat2#7978 and xcat2#7980. xcat2#7968 touches buildrpms.pl and release_repository.t as this branch does, in disjoint regions -- the locking sites here, createrepo_dir, index_repo and sign_repo_dir there -- which a review of xcat2#7968 measured before it landed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
EL netboot postinstall scripts turn
SELINUX=permissiveinto an invalidassignment. Some also use Bash conditionals under
/bin/sh, leaving firewalldenabled when the shell is dash.
Set enforcing and permissive settings to
SELINUX=disabledand use POSIXfirewalld checks across the affected profiles and their aliases. Preserve
comments and unrelated service links.