fix(netboot): correct SELinux settings and firewalld cleanup

.github/workflows/xcat_test.yml

@@ -102,7 +102,7 @@ jobs:
         run: |
           log=$(mktemp)
           trap 'rm -f -- "$log"' EXIT
-          prove -v xCAT-test/native/install_profile_riscv64.t xCAT-test/native/netboot_profile_riscv64.t xCAT-test/native/builddebs_riscv64.t xCAT-test/native/ubuntu_subiquity_template.t | tee "$log"
+          prove -v xCAT-test/native/install_profile_riscv64.t xCAT-test/native/netboot_profile_riscv64.t xCAT-test/native/netboot_profile_postinstall.t xCAT-test/native/builddebs_riscv64.t xCAT-test/native/ubuntu_subiquity_template.t | tee "$log"
           ! grep -qi skipped "$log"
   rpm_lifecycle_test:
     runs-on: ubuntu-24.04
@@ -123,11 +123,14 @@ jobs:
       - name: Install lifecycle test dependencies
         run: |
           dnf install -y epel-release
-          dnf --enablerepo=${{ matrix.repository }} install -y perl perl-Capture-Tiny perl-File-Slurper perl-Test-Simple perl-DBI perl-DBD-SQLite perl-JSON perl-XML-Simple rpm-build bubblewrap systemd chkconfig initscripts tar gzip bzip2 which diffutils httpd curl procps-ng openssl
+          dnf --enablerepo=${{ matrix.repository }} install -y perl perl-Capture-Tiny perl-File-Slurper perl-Test-Simple perl-DBI perl-DBD-SQLite perl-JSON perl-XML-Simple rpm-build bubblewrap dash systemd chkconfig initscripts tar gzip bzip2 which diffutils httpd curl procps-ng openssl
       - name: Enable lifecycle test namespaces
         run: sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
       - name: Test RPM package lifecycle
         run: su -s /bin/sh nobody -c 'prove -v xCAT-test/native/xcatd_rpm_lifecycle.t xCAT-test/native/apache_rpm_configuration.t xCAT-test/native/apache_package_lifecycle.t xCAT-test/native/package_upgrade_logging.t xCAT-test/native/profile_package_payload.t'
       - name: Test FIPS package artifacts
         if: ${{ !cancelled() }}
         run: su -s /bin/sh nobody -c 'prove -v xCAT-test/native/fips_package_payload.t'
+      - name: Test netboot postinstall profiles
+        if: ${{ !cancelled() }}
+        run: su -s /bin/sh nobody -c 'prove -v xCAT-test/native/netboot_profile_postinstall.t'

xCAT-server/share/xcat/netboot/rh/compute.rhels10.aarch64.postinstall

@@ -37,19 +37,19 @@ END
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 #--for redhat 8 and 8.1
 #-- Need to disable firewalld, otherwise, the remoteshell script will not able to get all the SSH keys
 FIREWALLD="$installroot/etc/systemd/system/multi-user.target.wants/firewalld.service"
-if [[ -f "$FIREWALLD" || -L "$FIREWALLD" ]]
+if [ -f "$FIREWALLD" ] || [ -L "$FIREWALLD" ]
 then
-    rm -f $FIREWALLD
+    rm -f "$FIREWALLD"
 fi
 FIREWALLD1="$installroot/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service"
-if [[ -f "$FIREWALLD1" || -L "$FIREWALLD1" ]]
+if [ -f "$FIREWALLD1" ] || [ -L "$FIREWALLD1" ]
 then
-    rm -f $FIREWALLD1
+    rm -f "$FIREWALLD1"
 fi
 
 

xCAT-server/share/xcat/netboot/rh/compute.rhels10.ppc64le.postinstall

@@ -37,20 +37,20 @@ echo "co:2345:respawn:/sbin/agetty -L 38400 console" >> $installroot/etc/inittab
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 
 #--for redhat 8 and 8.1
 #-- Need to disable firewalld, otherwise, the remoteshell script will not able to get all the SSH keys
 FIREWALLD="$installroot/etc/systemd/system/multi-user.target.wants/firewalld.service"
-if [[ -f "$FIREWALLD" || -L "$FIREWALLD" ]]
+if [ -f "$FIREWALLD" ] || [ -L "$FIREWALLD" ]
 then
-    rm -f $FIREWALLD
+    rm -f "$FIREWALLD"
 fi
 FIREWALLD1="$installroot/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service"
-if [[ -f "$FIREWALLD1" || -L "$FIREWALLD1" ]]
+if [ -f "$FIREWALLD1" ] || [ -L "$FIREWALLD1" ]
 then
-    rm -f $FIREWALLD1
+    rm -f "$FIREWALLD1"
 fi
 
 

xCAT-server/share/xcat/netboot/rh/compute.rhels10.x86_64.postinstall

@@ -37,19 +37,19 @@ END
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 #--for redhat 8 and 8.1
 #-- Need to disable firewalld, otherwise, the remoteshell script will not able to get all the SSH keys
 FIREWALLD="$installroot/etc/systemd/system/multi-user.target.wants/firewalld.service"
-if [[ -f "$FIREWALLD" || -L "$FIREWALLD" ]]
+if [ -f "$FIREWALLD" ] || [ -L "$FIREWALLD" ]
 then
-    rm -f $FIREWALLD
+    rm -f "$FIREWALLD"
 fi
 FIREWALLD1="$installroot/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service"
-if [[ -f "$FIREWALLD1" || -L "$FIREWALLD1" ]]
+if [ -f "$FIREWALLD1" ] || [ -L "$FIREWALLD1" ]
 then
-    rm -f $FIREWALLD1
+    rm -f "$FIREWALLD1"
 fi
 
 

xCAT-server/share/xcat/netboot/rh/compute.rhels7.ppc64.postinstall

@@ -37,7 +37,7 @@ echo "co:2345:respawn:/sbin/agetty -L 38400 console" >> $installroot/etc/inittab
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 
 #-- Example of booted image versioning

xCAT-server/share/xcat/netboot/rh/compute.rhels7.x86_64.postinstall

@@ -37,7 +37,7 @@ END
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 
 #-- Example of booted image versioning

xCAT-server/share/xcat/netboot/rh/compute.rhels8.ppc64le.postinstall

@@ -37,20 +37,20 @@ echo "co:2345:respawn:/sbin/agetty -L 38400 console" >> $installroot/etc/inittab
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 
 #--for redhat 8 and 8.1
 #-- Need to disable firewalld, otherwise, the remoteshell script will not able to get all the SSH keys
 FIREWALLD="$installroot/etc/systemd/system/multi-user.target.wants/firewalld.service"
-if [[ -f "$FIREWALLD" || -L "$FIREWALLD" ]]
+if [ -f "$FIREWALLD" ] || [ -L "$FIREWALLD" ]
 then
-    rm -f $FIREWALLD
+    rm -f "$FIREWALLD"
 fi
 FIREWALLD1="$installroot/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service"
-if [[ -f "$FIREWALLD1" || -L "$FIREWALLD1" ]]
+if [ -f "$FIREWALLD1" ] || [ -L "$FIREWALLD1" ]
 then
-    rm -f $FIREWALLD1
+    rm -f "$FIREWALLD1"
 fi
 
 

xCAT-server/share/xcat/netboot/rh/compute.rhels8.x86_64.postinstall

@@ -37,19 +37,19 @@ END
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 #--for redhat 8 and 8.1
 #-- Need to disable firewalld, otherwise, the remoteshell script will not able to get all the SSH keys
 FIREWALLD="$installroot/etc/systemd/system/multi-user.target.wants/firewalld.service"
-if [[ -f "$FIREWALLD" || -L "$FIREWALLD" ]]
+if [ -f "$FIREWALLD" ] || [ -L "$FIREWALLD" ]
 then
-    rm -f $FIREWALLD
+    rm -f "$FIREWALLD"
 fi
 FIREWALLD1="$installroot/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service"
-if [[ -f "$FIREWALLD1" || -L "$FIREWALLD1" ]]
+if [ -f "$FIREWALLD1" ] || [ -L "$FIREWALLD1" ]
 then
-    rm -f $FIREWALLD1
+    rm -f "$FIREWALLD1"
 fi
 
 

xCAT-server/share/xcat/netboot/rh/compute.rhels9.ppc64le.postinstall

@@ -37,20 +37,20 @@ echo "co:2345:respawn:/sbin/agetty -L 38400 console" >> $installroot/etc/inittab
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 
 #--for redhat 8 and 8.1
 #-- Need to disable firewalld, otherwise, the remoteshell script will not able to get all the SSH keys
 FIREWALLD="$installroot/etc/systemd/system/multi-user.target.wants/firewalld.service"
-if [[ -f "$FIREWALLD" || -L "$FIREWALLD" ]]
+if [ -f "$FIREWALLD" ] || [ -L "$FIREWALLD" ]
 then
-    rm -f $FIREWALLD
+    rm -f "$FIREWALLD"
 fi
 FIREWALLD1="$installroot/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service"
-if [[ -f "$FIREWALLD1" || -L "$FIREWALLD1" ]]
+if [ -f "$FIREWALLD1" ] || [ -L "$FIREWALLD1" ]
 then
-    rm -f $FIREWALLD1
+    rm -f "$FIREWALLD1"
 fi
 
 

xCAT-server/share/xcat/netboot/rh/compute.rhels9.x86_64.postinstall

@@ -37,19 +37,19 @@ END
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 #--for redhat 8 and 8.1
 #-- Need to disable firewalld, otherwise, the remoteshell script will not able to get all the SSH keys
 FIREWALLD="$installroot/etc/systemd/system/multi-user.target.wants/firewalld.service"
-if [[ -f "$FIREWALLD" || -L "$FIREWALLD" ]]
+if [ -f "$FIREWALLD" ] || [ -L "$FIREWALLD" ]
 then
-    rm -f $FIREWALLD
+    rm -f "$FIREWALLD"
 fi
 FIREWALLD1="$installroot/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service"
-if [[ -f "$FIREWALLD1" || -L "$FIREWALLD1" ]]
+if [ -f "$FIREWALLD1" ] || [ -L "$FIREWALLD1" ]
 then
-    rm -f $FIREWALLD1
+    rm -f "$FIREWALLD1"
 fi
 
 

xCAT-server/share/xcat/netboot/rh/service.postinstall

@@ -41,7 +41,7 @@ echo "co:2345:respawn:/sbin/agetty -L 38400 console" >> $installroot/etc/inittab
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 
 #-- Example of booted image versioning

xCAT-server/share/xcat/netboot/rocky/compute.rocky10.riscv64.postinstall

@@ -37,19 +37,19 @@ END
 #-- Need to disable selinux, otherwise, the booting  will hang on "Loading selinux policy"
 if [ -f "$installroot/etc/selinux/config" ]
 then
-    sed -i 's/SELINUX=enforcing\|permissive/SELINUX=disabled/' $installroot/etc/selinux/config
+    sed -i 's/^\([[:blank:]]*SELINUX=\)\(enforcing\|permissive\)\([[:blank:]]*\(#.*\)\{0,1\}\)$/\1disabled\3/' "$installroot/etc/selinux/config"
 fi
 #--for redhat 8 and 8.1
 #-- Need to disable firewalld, otherwise, the remoteshell script will not able to get all the SSH keys
 FIREWALLD="$installroot/etc/systemd/system/multi-user.target.wants/firewalld.service"
-if [[ -f "$FIREWALLD" || -L "$FIREWALLD" ]]
+if [ -f "$FIREWALLD" ] || [ -L "$FIREWALLD" ]
 then
-    rm -f $FIREWALLD
+    rm -f "$FIREWALLD"
 fi
 FIREWALLD1="$installroot/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service"
-if [[ -f "$FIREWALLD1" || -L "$FIREWALLD1" ]]
+if [ -f "$FIREWALLD1" ] || [ -L "$FIREWALLD1" ]
 then
-    rm -f $FIREWALLD1
+    rm -f "$FIREWALLD1"
 fi
 
 

xCAT-test/native/README.md

@@ -374,6 +374,7 @@ user with Bubblewrap and unprivileged user namespaces enabled:
 ```
 prove xCAT-test/native/install_profile_riscv64.t \
       xCAT-test/native/netboot_profile_riscv64.t \
+      xCAT-test/native/netboot_profile_postinstall.t \
       xCAT-test/native/builddebs_riscv64.t \
       xCAT-test/native/ubuntu_subiquity_template.t
 ```
@@ -386,13 +387,21 @@ The Debian case needs debhelper, devscripts, fakeroot, and reprepro, and skips
 on non-Debian hosts. Each case creates its own temporary files and database.
 The temporary directory must allow execution; set TMPDIR if /tmp is noexec.
 Sandbox commands require GNU timeout and have a 45-second limit.
-Pull-request CI runs these cases and rejects whole-file skips. The permissive
-SELinux case records an existing postinstall defect as TODO, without changing
-production behavior.
+Pull-request CI runs these cases and rejects whole-file skips.
 
 The netboot case executes the selected postinstall file directly. Its private
 /bin/sh uses Bash, as on EL, including when the test host uses another shell.
 
+`netboot_profile_postinstall.t` runs the affected EL postinstall owners and
+their distro and service aliases. It checks the resulting SELinux settings,
+missing files, comments, repeated execution, permissions, ownership and host
+sentinels. It uses the same sandbox and Perl dependencies. CI runs it on
+Ubuntu, EL8 and EL10. It executes host tools against private image roots;
+it does not boot the target architecture or verify kernel SELinux state.
+Both Bash and dash are required. The firewalld cases cover regular files,
+valid and dangling symlinks, absent entries and directories under both shells.
+The unit files, unrelated links and host entries must remain unchanged.
+
 The Subiquity case replaces downloads and external commands, and uses a
 loopback install-monitor peer. It does not install an operating system.
 Architecture names in these fixtures do not qualify native firmware or boot