Skip to content

Commit

Permalink
Advise users on using setsebool to set pulp_manage_rsync selinux boolean
Browse files Browse the repository at this point in the history
F27+ changed the behavior of semanage to set a selinux boolean by
default, but not change its current state. Update docs to advise users
of this to avoid confusion when rsync distributors fail to run with
selinux in F27.

closes #3347
https://pulp.plan.io/issues/3347
  • Loading branch information
werwty committed Feb 19, 2018
1 parent 636e023 commit 294078f
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 2 deletions.
7 changes: 6 additions & 1 deletion docs/tech-reference/iso-rsync-distributor.rst
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,15 @@ Configuration
Pulp's SELinux policy includes a ``pulp_manage_rsync`` boolean. When enabled, the
``pulp_manage_rsync`` boolean allows Pulp to use rsync and make ssh connections. The boolean is
disabled by default. The ISO Rsync distributor will fail to publish with SELinux Enforcing unless
the boolean is enabled. To enable it, you can do this::
the boolean is enabled. To enable it by default, you can do this::

$ sudo semanage boolean --modify --on pulp_manage_rsync

In F27+ `semanage` only sets the default state of an SELinux policy, an additional command must also
be run to set its current state::

$ sudo setsebool pulp_manage_rsync on

Here is an example iso_rsync_distributor configuration::

{
Expand Down
7 changes: 6 additions & 1 deletion docs/tech-reference/rsync-distributor.rst
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,15 @@ Configuration
Pulp's SELinux policy includes a ``pulp_manage_rsync`` boolean. When enabled, the
``pulp_manage_rsync`` boolean allows Pulp to use rsync and make ssh connections. The boolean is
disabled by default. The RPM Rsync distributor will fail to publish with SELinux Enforcing unless
the boolean is enabled. To enable it, you can do this::
the boolean is enabled. To enable it by default, you can do this::

$ sudo semanage boolean --modify --on pulp_manage_rsync

In F27+ `semanage` only sets the default state of an SELinux policy, an additional command must also
be run to set its current state::

$ sudo setsebool pulp_manage_rsync on

Here's an example of rpm_rsync_distributor configuration::

{
Expand Down

0 comments on commit 294078f

Please sign in to comment.