Closed brandond closed 1 month ago
No backports necessary, as install script is served off master.
Validated with single server install on the latest v1.27.16-rc4+rke2r1, re-ran the v1.27 installation, upgraded using the latest v1.28.12-rc4+rke2r1 which logs to stdout no fapolicyd changes, all confirmed by comparing the file before and after.
$ cat /etc/os-release | grep -i pretty
PRETTY_NAME="Oracle Linux Server 9.4"
$ sudo INSTALL_RKE2_VERSION=$VERSION INSTALL_RKE2_EXEC=server INSTALL_RKE2_METHOD=rpm INSTALL_RKE2_CHANNEL=testing ./install-rke2.sh
[INFO] using 1.27 series from channel testing
Rancher RKE2 Common (testing) 6.0 kB/s | 3.3 kB 00:00
Rancher RKE2 1.27 (testing) 39 kB/s | 23 kB 00:00
Dependencies resolved.
======================================================================================================================================================
Package Architecture Version Repository Size
======================================================================================================================================================
Installing:
rke2-server x86_64 1.27.16~rc4~rke2r1-1.el9 rancher-rke2-1.27-testing 9.1 k
Installing dependencies:
container-selinux noarch 3:2.229.0-1.el9_3 ol9_appstream 66 k
rke2-common x86_64 1.27.16~rc4~rke2r1-1.el9 rancher-rke2-1.27-testing 24 M
rke2-selinux noarch 0.18-2.el9 rancher-rke2-common-testing 22 k
Transaction Summary
======================================================================================================================================================
Install 4 Packages
Total download size: 25 M
Installed size: 100 M
Downloading Packages:
(1/4): container-selinux-2.229.0-1.el9_3.noarch.rpm 433 kB/s | 66 kB 00:00
(2/4): rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64.rpm 50 kB/s | 9.1 kB 00:00
(3/4): rke2-selinux-0.18-2.el9.noarch.rpm 66 kB/s | 22 kB 00:00
(4/4): rke2-common-1.27.16~rc4~rke2r1-1.el9.x86_64.rpm 17 MB/s | 24 MB 00:01
------------------------------------------------------------------------------------------------------------------------------------------------------
Total 17 MB/s | 25 MB 00:01
Rancher RKE2 Common (testing) 9.9 kB/s | 2.4 kB 00:00
Importing GPG key 0xD161F542:
Userid : "Rancher (CI) <ci@rancher.com>"
Fingerprint: 856A 0069 529C A63B 21AA 4E0A 089F A20E D161 F542
From : https://rpm-testing.rancher.io/public.key
Key imported successfully
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Running scriptlet: container-selinux-3:2.229.0-1.el9_3.noarch 1/4
Installing : container-selinux-3:2.229.0-1.el9_3.noarch 1/4
Running scriptlet: container-selinux-3:2.229.0-1.el9_3.noarch 1/4
Running scriptlet: rke2-selinux-0.18-2.el9.noarch 2/4
Installing : rke2-selinux-0.18-2.el9.noarch 2/4
Running scriptlet: rke2-selinux-0.18-2.el9.noarch 2/4
Installing : rke2-common-1.27.16~rc4~rke2r1-1.el9.x86_64 3/4
Installing : rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64 4/4
Running scriptlet: rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64 4/4
Running scriptlet: container-selinux-3:2.229.0-1.el9_3.noarch 4/4
Running scriptlet: rke2-selinux-0.18-2.el9.noarch 4/4
Running scriptlet: rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64 4/4
Verifying : container-selinux-3:2.229.0-1.el9_3.noarch 1/4
Verifying : rke2-selinux-0.18-2.el9.noarch 2/4
Verifying : rke2-common-1.27.16~rc4~rke2r1-1.el9.x86_64 3/4
Verifying : rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64 4/4
Installed:
container-selinux-3:2.229.0-1.el9_3.noarch rke2-common-1.27.16~rc4~rke2r1-1.el9.x86_64 rke2-selinux-0.18-2.el9.noarch
rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64
Complete!
$ sudo cat /etc/fapolicyd/compiled.rules
## This file is automatically generated from /etc/fapolicyd/rules.d
%languages=application/x-bytecode.ocaml,application/x-bytecode.python,application/java-archive,text/x-java,application/x-java-applet,application/javascript,text/javascript,text/x-awk,text/x-gawk,text/x-lisp,application/x-elc,text/x-lua,text/x-m4,text/x-nftables,text/x-perl,text/x-php,text/x-python,text/x-R,text/x-ruby,text/x-script.guile,text/x-tcl,text/x-luatex,text/x-systemtap
allow perm=any uid=0 : dir=/var/tmp/
allow perm=any uid=0 trust=1 : all
allow perm=open exe=/usr/bin/rpm : all
allow perm=open exe=/usr/bin/python3.9 comm=dnf : all
deny_audit perm=any pattern=ld_so : all
deny_audit perm=any all : ftype=application/x-bad-elf
allow perm=open all : ftype=application/x-sharedlib trust=1
deny_audit perm=open all : ftype=application/x-sharedlib
allow perm=execute all : trust=1
allow perm=open all : ftype=%languages trust=1
deny_audit perm=any all : ftype=%languages
allow perm=any all : ftype=text/x-shellscript
allow perm=any all : dir=/var/lib/rancher/
allow perm=any all : dir=/opt/cni/
allow perm=any all : dir=/run/k3s/
allow perm=any all : dir=/var/lib/kubelet/
deny_audit perm=execute all : all
allow perm=open all : all
$ VERSION=v1.28.12-rc4+rke2r1 //manually upgrading to try and get different behavior exposed $ sudo INSTALL_RKE2_VERSION=$VERSION INSTALL_RKE2_EXEC=server INSTALL_RKE2_METHOD=rpm INSTALL_RKE2_CHANNEL=testing ./install-rke2.sh
[INFO] using 1.28 series from channel testing
Error: No matching Packages to list
Last metadata expiration check: 0:00:02 ago on Thu 25 Jul 2024 11:16:37 PM UTC.
Dependencies resolved.
=======================================================================================================================================================================================================================================================
Package Architecture Version Repository Size
=======================================================================================================================================================================================================================================================
Upgrading:
rke2-common x86_64 1.28.12~rc4~rke2r1-0.el9 rancher-rke2-1.28-testing 25 M
rke2-server x86_64 1.28.12~rc4~rke2r1-0.el9 rancher-rke2-1.28-testing 9.1 k
Transaction Summary
=======================================================================================================================================================================================================================================================
Upgrade 2 Packages
Total download size: 25 M
Downloading Packages:
(1/2): rke2-server-1.28.12~rc4~rke2r1-0.el9.x86_64.rpm 30 kB/s | 9.1 kB 00:00
(2/2): rke2-common-1.28.12~rc4~rke2r1-0.el9.x86_64.rpm 18 MB/s | 25 MB 00:01
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total 18 MB/s | 25 MB 00:01
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Preparing : 1/1
Upgrading : rke2-common-1.28.12~rc4~rke2r1-0.el9.x86_64 1/4
Upgrading : rke2-server-1.28.12~rc4~rke2r1-0.el9.x86_64 2/4
Running scriptlet: rke2-server-1.28.12~rc4~rke2r1-0.el9.x86_64 2/4
Running scriptlet: rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64 3/4
Cleanup : rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64 3/4
Running scriptlet: rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64 3/4
Running scriptlet: rke2-common-1.27.16~rc4~rke2r1-1.el9.x86_64 4/4
Cleanup : rke2-common-1.27.16~rc4~rke2r1-1.el9.x86_64 4/4
Running scriptlet: rke2-common-1.27.16~rc4~rke2r1-1.el9.x86_64 4/4
Verifying : rke2-common-1.28.12~rc4~rke2r1-0.el9.x86_64 1/4
Verifying : rke2-common-1.27.16~rc4~rke2r1-1.el9.x86_64 2/4
Verifying : rke2-server-1.28.12~rc4~rke2r1-0.el9.x86_64 3/4
Verifying : rke2-server-1.27.16~rc4~rke2r1-1.el9.x86_64 4/4
Upgraded:
rke2-common-1.28.12~rc4~rke2r1-0.el9.x86_64 rke2-server-1.28.12~rc4~rke2r1-0.el9.x86_64
Complete!
/sbin/fagenrules: No change
$ sudo cat /etc/fapolicyd/compiled.rules
## This file is automatically generated from /etc/fapolicyd/rules.d
%languages=application/x-bytecode.ocaml,application/x-bytecode.python,application/java-archive,text/x-java,application/x-java-applet,application/javascript,text/javascript,text/x-awk,text/x-gawk,text/x-lisp,application/x-elc,text/x-lua,text/x-m4,text/x-nftables,text/x-perl,text/x-php,text/x-python,text/x-R,text/x-ruby,text/x-script.guile,text/x-tcl,text/x-luatex,text/x-systemtap
allow perm=any uid=0 : dir=/var/tmp/
allow perm=any uid=0 trust=1 : all
allow perm=open exe=/usr/bin/rpm : all
allow perm=open exe=/usr/bin/python3.9 comm=dnf : all
deny_audit perm=any pattern=ld_so : all
deny_audit perm=any all : ftype=application/x-bad-elf
allow perm=open all : ftype=application/x-sharedlib trust=1
deny_audit perm=open all : ftype=application/x-sharedlib
allow perm=execute all : trust=1
allow perm=open all : ftype=%languages trust=1
deny_audit perm=any all : ftype=%languages
allow perm=any all : ftype=text/x-shellscript
allow perm=any all : dir=/var/lib/rancher/
allow perm=any all : dir=/opt/cni/
allow perm=any all : dir=/run/k3s/
allow perm=any all : dir=/var/lib/kubelet/
deny_audit perm=execute all : all
allow perm=open all : all
$ sudo INSTALL_RKE2_VERSION=$VERSION INSTALL_RKE2_EXEC=server INSTALL_RKE2_METHOD=rpm INSTALL_RKE2_CHANNEL=testing ./install-rke2.sh
[INFO] using 1.28 series from channel testing
Error: No matching Packages to list
Last metadata expiration check: 0:00:02 ago on Thu 25 Jul 2024 11:18:42 PM UTC.
Package rke2-server-1.28.12~rc4~rke2r1-0.el9.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
/sbin/fagenrules: No change
$ sudo cat /etc/fapolicyd/compiled.rules
## This file is automatically generated from /etc/fapolicyd/rules.d
%languages=application/x-bytecode.ocaml,application/x-bytecode.python,application/java-archive,text/x-java,application/x-java-applet,application/javascript,text/javascript,text/x-awk,text/x-gawk,text/x-lisp,application/x-elc,text/x-lua,text/x-m4,text/x-nftables,text/x-perl,text/x-php,text/x-python,text/x-R,text/x-ruby,text/x-script.guile,text/x-tcl,text/x-luatex,text/x-systemtap
allow perm=any uid=0 : dir=/var/tmp/
allow perm=any uid=0 trust=1 : all
allow perm=open exe=/usr/bin/rpm : all
allow perm=open exe=/usr/bin/python3.9 comm=dnf : all
deny_audit perm=any pattern=ld_so : all
deny_audit perm=any all : ftype=application/x-bad-elf
allow perm=open all : ftype=application/x-sharedlib trust=1
deny_audit perm=open all : ftype=application/x-sharedlib
allow perm=execute all : trust=1
allow perm=open all : ftype=%languages trust=1
deny_audit perm=any all : ftype=%languages
allow perm=any all : ftype=text/x-shellscript
allow perm=any all : dir=/var/lib/rancher/
allow perm=any all : dir=/opt/cni/
allow perm=any all : dir=/run/k3s/
allow perm=any all : dir=/var/lib/kubelet/
deny_audit perm=execute all : all
allow perm=open all : all
from @bordenit in https://github.com/rancher/rke2/pull/6309
If fapolicyd is enabled, the install script appends duplicate rules every time it is run.
The install script should not duplicate the fapolicyd rules in the rules file if install.sh script is ran more than once. It should be unlikely that anyone would use this rules file for anything other than RKE2, as the naming of it is specifically for RKE2. This should be a total replacement and not an append.