Relabel / and /rw if needed #541
Conversation
|
This fails to build... But also, shouldn't this reference #9663 ? |
|
I meant for this to be a draft because I hadn’t tested it, hence the build failure. |
DemiMarie
force-pushed
the
relabel-rw-if-needed
branch
from
2abb91f to
ee39235
Compare
|
I didn’t reference #9663 because I don’t know if this actually fixes that issue. |
DemiMarie
force-pushed
the
relabel-rw-if-needed
branch
3 times, most recently
from
523b6d5 to
da46272
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #541 +/- ##
=======================================
Coverage 70.57% 70.57%
=======================================
Files 3 3
Lines 469 469
=======================================
Hits 331 331
Misses 138 138 ☔ View full report in Codecov by Sentry. |
| @@ -0,0 +1,6 @@ | |||
| #!/bin/bash -- | |||
There was a problem hiding this comment.
What bash features you use here? I'd prefer /bin/sh (and consequently shellcheck noticing non-POSIX features) in scritpts that don't absolutely need bash (for example to have proper arrays).
There was a problem hiding this comment.
-nt is not part of POSIX.
DemiMarie
force-pushed
the
relabel-rw-if-needed
branch
from
da46272 to
d3212f6
Compare
DemiMarie
force-pushed
the
relabel-rw-if-needed
branch
2 times, most recently
from
b026dca to
360c8aa
Compare
DemiMarie
force-pushed
the
relabel-rw-if-needed
branch
from
360c8aa to
6a12d32
Compare
|
shellcheck needs a comment near sourcing /etc/selinux/config |
DemiMarie
force-pushed
the
relabel-rw-if-needed
branch
3 times, most recently
from
612c68c to
93141bd
Compare
Creating /.autorelabel must cause a Qubes OS VM to relabel everything, as otherwise users will not be able to troubleshoot their systems and upstream packages that create it will break. However, it was ignored, so fix that. Furthermore, relabel the filesystem of a TemplateBasedVM whenever its TemplateVM has been relabeled since the TemplateBasedVM was. This ensures that policy changes propagate to TemplateBasedVMs too.
DemiMarie
force-pushed
the
relabel-rw-if-needed
branch
from
93141bd to
31bb12a
Compare
OpenQA test summaryComplete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2025012002-4.3&flavor=pull-requests Test run included the following:
New failures, excluding unstableCompared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024111705-4.3&flavor=update
Failed tests96 failures
Fixed failuresCompared to: https://openqa.qubes-os.org/tests/119126#dependencies 3 fixed
Unstable tests |
Creating /.autorelabel must cause a Qubes OS VM to relabel everything, as otherwise users will not be able to troubleshoot their systems and upstream packages that create it will break. However, it was ignored, so fix that.
Furthermore, relabel the filesystem of a TemplateBasedVM whenever its TemplateVM has been relabeled since the TemplateBasedVM was. This ensures that policy changes propagate to TemplateBasedVMs too.