search

k3s-io / k3s-selinux

SELinux policy for k3s
Apache License 2.0
66 stars 20 forks source link

Move /var/run fc entries to /run #61

Open ca-hu opened 4 months ago

ca-hu commented 4 months ago

/var/run is a symlink to /run in microos.

Currently the selinux-policy package has a rule for file contexts from /run/ use to the same file context specified in /var/run/.

The upcoming main selinux-policy package update will change the direction of that "forwarding", so /var/run will follow the rules in /run. This way, the file context entries will match the actual filesystem path.

All existing file context entries in custom modules based on the /var/run path need to change to /run, otherwise there is no rule for /var/run entries to "be forwarded to" in /run.

ca-hu commented 4 months ago

This is also happening in fedora, see: https://github.com/fedora-selinux/selinux-policy/commit/1f76e522ab3e4c6faafde161036aa5bb49a0cbe0

I did not add a commit for fedora/coreos since I don't really know your setup there.

jsegitz commented 3 months ago

This is blocking our policy update ATM. Can you please work on this? We'll wait until next week, but then we'll update our package, which will break your build