openstack/bifrost
Code Issues Proposed changes

Fix TFTP read access for enforcing SELinux

Browse Source 
This change adds ironic_tftp_master_path to the list of paths to get
the tftpdir_t context, so that images copied from here to
tftp_boot_folder will have a context which allows the file to be read.

This change also applies the context changes when SELinux is in
Permissive mode, as well as Enforcing.

Change-Id: I43dd4a2f7cf47934bc9f5cdee85acf53a40dd468
This commit is contained in:
Steve Baker 2022-07-11 11:59:03 +12:00
parent b8ebbeb376
commit 0baff1e124
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
playbooks/roles/bifrost-ironic-install/tasks/bootstrap.yml
View File

@ -502,6 +502,7 @@
loop: loop:
- "{{ tftp_boot_folder }}" - "{{ tftp_boot_folder }}"
- "{{ tftp_boot_folder }}/pxelinux.cfg" - "{{ tftp_boot_folder }}/pxelinux.cfg"
- "{{ ironic_tftp_master_path }}"
- name: "Add proper context on created data for http_boot" - name: "Add proper context on created data for http_boot"
sefcontext: sefcontext:
@ -518,8 +519,9 @@
loop: loop:
- "{{ http_boot_folder }}" - "{{ http_boot_folder }}"
- "{{ tftp_boot_folder }}" - "{{ tftp_boot_folder }}"
- "{{ ironic_tftp_master_path }}"
when: (ansible_os_family == 'RedHat' or ansible_os_family == 'Suse') and when: (ansible_os_family == 'RedHat' or ansible_os_family == 'Suse') and
ansible_selinux.status == 'enabled' and ansible_selinux.mode == "enforcing" ansible_selinux.status == 'enabled'
- name: "Configure remote logging" - name: "Configure remote logging"
template: src=10-rsyslog-remote.conf.j2 dest=/etc/rsyslog.d/10-rsyslog-remote.conf template: src=10-rsyslog-remote.conf.j2 dest=/etc/rsyslog.d/10-rsyslog-remote.conf
when: when:

7
releasenotes/notes/selinux-tftp-c37e34311238f8fd.yaml Normal file
View File

@ -0,0 +1,7 @@
---
fixes:
- |
An issue has been fixed where enforcing SELinux resulted in files in
``tftp_boot_folder`` not being readable by dnsmasq. This has been fixed by
ensuring files in ``ironic_tftp_master_path`` have the SELinux context
``tftpdir_t``.