selinux in this role?

[tombarron]

On CentOS 7 I had to 'setenforce permissive' to get the installer to work. Should there be a task to do that as part of this role?

[dhellmann]

Interesting, that's not something I had to do. Maybe selinux wasn't enabled on my system to start, though? Does changing that setting require a reboot?

[tombarron]

I didn't reboot, just did 'sudo setenforce permissive'. Now I have alerts that aren't actually enforced:

The source process: /usr/libexec/qemu-kvm Attempted this access: read On this file: test1-worker-0-tc24r.ignition

and similarly for test1-master.ign and test1-bootstrap.ign

Also

The source process: systemd-machined Attempted this access: getattr On this file: /proc//cgroup and similarly for machined attempting to search directory 5193

I'm running the install as user tbarron who belongs to groups wheel, qemu, libvirt, and docker.

[tombarron]

It may well be something about my CentOS install that's triggering this -- similar perhaps to dmacvicar/terraform-provider-libvirt#142 (comment)

[dhellmann]

I'm not sure I want the role to just set the mode to permissive because if someone isn't paying close attention they might not notice. How about if we check the mode and fail if it isn't set permissive, with a message that they need to make that security-related change themselves?

[tombarron]

That seems like a good idea if this isn't something idiosyncratic to my environment. Maybe the message should just suggest making the change if selinux prevents the install from succeeding. Presumably someday that will no longer be a problem :)

[tombarron]

I think my selinux labels were screwed up in my default libvirt pool, so probably never mind on this one. Sorry for the noise.