search

sous-chefs / selinux

Development repository for the selinux cookbook
https://supermarket.chef.io/cookbooks/selinux
Apache License 2.0
58 stars 70 forks source link

Allow override built-in fcontext #119

Open ywei2017 opened 4 months ago

ywei2017 commented 4 months ago

:frowning_person: Problem Statement

The selinux_fcontext::manage/modify does not allow override of built-in contexts. :add action would skip if semanage fcontext -l returns an entry, and :modify would fail if there is no such entry in the .local spec file. Hence there is no way to override a built-in context.

:grey_question: Possible Solution

The most straightforward solution is to check whether the type matches at the conditional statement. Instead of checking "if fcontext is already registered", it should check "if the desired fcontext is already registered". So the conditional check will the same as the :modify action.

:arrow_heading_up: Describe alternatives you've considered

One possibility is to clone and hack it, but that defeats the purpose of a re-usable cookbook.

:heavy_plus_sign: Additional context

I can submit a PR if the proposed solution is acceptable.

Stromweld commented 4 months ago

A PR will help to better understand the issue and the fix.

ywei2017 commented 4 months ago

@Stromweld I will submit a PR in the next day or 2. Thanks.

ywei2017 commented 4 months ago

@Stromweld , please take a look at PR #120. If the approach makes sense, I will update the test cases and the rest for the PR.

Thanks

Stromweld commented 4 months ago

That looks good to me. I'm not very versed in selinux though. I think it'll help to add the test cases for each scenario as well as to make sure future regression isn't introduced.

Would you also be able to open PR for the same thing here https://github.com/chef/chef/blob/main/lib/chef/resource/selinux_fcontext.rb. This resource was based on this cookbooks resource. It'll help chef-client as well as cinc-client since it's based on chef-client.

ywei2017 commented 4 months ago

@Stromweld Will do. Let me do it in 2 steps.

  1. Add the test case for this PR so it all good. I can use some education to make sure the proper procedures are followed.
  2. Then I will submit a PR to https://github.com/chef/chef/blob/main/lib/chef/resource/selinux_fcontext.rb

Thanks for the quick feedback.