Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make OpenNebula SELinux friendly #739

Open
OpenNebulaProject opened this issue Nov 20, 2017 · 3 comments

Comments

@OpenNebulaProject
Copy link

commented Nov 20, 2017


Author Name: Ruben S. Montero (@rsmontero)
Original Redmine Issue: 2760, https://dev.opennebula.org/issues/2760
Original Date: 2014-02-26


None

@OpenNebulaProject

This comment has been minimized.

Copy link
Author

commented Nov 20, 2017


Original Redmine Comment
Author Name: Edouard Bourguignon (Edouard Bourguignon)
Original Date: 2014-12-05T17:49:26Z


Just to mention that with CentOS 7, OpenNebula + Selinux + Confined context labelised with svirt is OK (local FS and shared nfs 4.2 tested). Just the default contexts for files in datastores are missing. Should be set by the rpm I guess.

best regards.

@stale

This comment has been minimized.

Copy link

commented Mar 6, 2019

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. The OpenNebula Dev Team

@stale stale bot added the Status: Abandoned label Mar 6, 2019

@vholer vholer added this to the Release 5.10 milestone Apr 2, 2019

@stale stale bot removed the Status: Abandoned label Apr 2, 2019

@vholer

This comment has been minimized.

Copy link
Member

commented Aug 15, 2019

Just to mention that with CentOS 7, OpenNebula + Selinux + Confined context labelised with svirt is OK (local FS and shared nfs 4.2 tested). Just the default contexts for files in datastores are missing. Should be set by the rpm I guess.

Initial default context for the datastores in a way described here:
https://forum.opennebula.org/t/opennebula-and-selinux/7561/9
would right now fix scenario when frontend and hypervisor are running on same host with qcow2 datastore driver.

If the datastores are manually symlinked to the different location, it should be necessary to fix the directory context via chcon -t virt_image_t in the drivers on the places, we create the datastore / VM directories. E.g.:

function ssh_make_path
{
SSH_EXEC_ERR=`$SSH $1 bash -s 2>&1 1>/dev/null <<EOF
set -e -o pipefail
if [ ! -d $2 ]; then
mkdir -p $2

or

mkdir -p $DEP_FILE_LOCATION

etc.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants
You can’t perform that action at this time.