)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"e6f8d096ee22f9592155642a3047d3f44b3ce64f","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Fix CentOS image build failure when dib runs on debian based system"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Without this fix, building a centos image on Ubuntu for instance will lead to the"},{"line_number":10,"context_line":"following error:"},{"line_number":11,"context_line":"disk-image-create centos7 dhcp-all-interfaces cloud-init-nocloud \\"},{"line_number":12,"context_line":"    devuser yum epel baremetal"},{"line_number":13,"context_line":"... dib-run-parts Running tmpdir/hooks/cleanup.d/99-selinux-fixfiles-restore"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"bf659307_45ffb400","line":10,"updated":"2018-04-09 23:41:08.000000000","message":"we do this in the gate in a couple of different ways (the nodepool tests, and the functional tests) and we\u0027re not seeing this","commit_id":"5d85237136d46500c02148db139b1061497fd997"}],"diskimage_builder/elements/rpm-distro/cleanup.d/99-selinux-fixfiles-restore":[{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"e6f8d096ee22f9592155642a3047d3f44b3ce64f","unresolved":false,"context_lines":[{"line_number":66,"context_line":"IFS\u003d\u0027|\u0027 read -ra SPLIT_MOUNTS \u003c\u003c\u003c \"$DIB_MOUNTPOINTS\""},{"line_number":67,"context_line":"for MOUNTPOINT in \"${SPLIT_MOUNTS[@]}\"; do"},{"line_number":68,"context_line":"    if [ \"${MOUNTPOINT}\" !\u003d \"/tmp/in_target.d\" ] \u0026\u0026 [ \"${MOUNTPOINT}\" !\u003d \"/dev\" ]; then"},{"line_number":69,"context_line":"        if ! sudo ${_runcon} chroot ${TARGET_ROOT} \\"},{"line_number":70,"context_line":"            /usr/sbin/setfiles -F ${_dash_m} \\"},{"line_number":71,"context_line":"            /etc/selinux/targeted/contexts/files/file_contexts ${MOUNTPOINT}; then"},{"line_number":72,"context_line":"            echo \"Warning: Building on $(lsb_release -i | awk \u0027{print $NF}\u0027): SELinux commands might fail\""}],"source_content_type":"application/x-shellscript","patch_set":2,"id":"bf659307_0246927d","line":69,"updated":"2018-04-09 23:41:08.000000000","message":"So the way we usually do this \"ignore if failed\" is \n\n  foo || echo \"Ignore if failed\"\n\nbut that\u0027s minor\n\nWhat always worries me about this though is that we\u0027re now ignoring what might be real errors coming from the runcon.\n\nis it accurate to say the root cause here is [1]?\n\nthat suggests the audit_open gets some sort of failure opening the netlink socket?  why would this only happen on debian?\n\ni\u0027d like to understand this better; at the very least put in a more specific check based on whatever the root cause is.\n\n[1] https://github.com/fedora-selinux/selinux/blob/master/policycoreutils/setfiles/setfiles.c#L112","commit_id":"5d85237136d46500c02148db139b1061497fd997"},{"author":{"_account_id":19578,"name":"Olivier Bourdon","email":"olivierbourdon38@gmail.com","username":"olivierbourdon38"},"change_message_id":"789b6a4697beb96faeb2c47e2fd3e303cbe55ae5","unresolved":false,"context_lines":[{"line_number":66,"context_line":"IFS\u003d\u0027|\u0027 read -ra SPLIT_MOUNTS \u003c\u003c\u003c \"$DIB_MOUNTPOINTS\""},{"line_number":67,"context_line":"for MOUNTPOINT in \"${SPLIT_MOUNTS[@]}\"; do"},{"line_number":68,"context_line":"    if [ \"${MOUNTPOINT}\" !\u003d \"/tmp/in_target.d\" ] \u0026\u0026 [ \"${MOUNTPOINT}\" !\u003d \"/dev\" ]; then"},{"line_number":69,"context_line":"        if ! sudo ${_runcon} chroot ${TARGET_ROOT} \\"},{"line_number":70,"context_line":"            /usr/sbin/setfiles -F ${_dash_m} \\"},{"line_number":71,"context_line":"            /etc/selinux/targeted/contexts/files/file_contexts ${MOUNTPOINT}; then"},{"line_number":72,"context_line":"            echo \"Warning: Building on $(lsb_release -i | awk \u0027{print $NF}\u0027): SELinux commands might fail\""}],"source_content_type":"application/x-shellscript","patch_set":2,"id":"5f7c97a3_8c82c0a4","line":69,"in_reply_to":"bf659307_0246927d","updated":"2018-06-08 10:33:21.000000000","message":"Done","commit_id":"5d85237136d46500c02148db139b1061497fd997"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"985e4fd7631e9a410af75042f9b2b2cb56c12b97","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"IFS\u003d\u0027|\u0027 read -ra SPLIT_MOUNTS \u003c\u003c\u003c \"$DIB_MOUNTPOINTS\""},{"line_number":67,"context_line":"for MOUNTPOINT in \"${SPLIT_MOUNTS[@]}\"; do"},{"line_number":68,"context_line":"    if [ \"${MOUNTPOINT}\" !\u003d \"/tmp/in_target.d\" ] \u0026\u0026 [ \"${MOUNTPOINT}\" !\u003d \"/dev\" ] \u0026\u0026 [ \"${MOUNTPOINT}\" !\u003d \"/boot/efi\" ] \u0026\u0026 grep -q audit\u003d1 /proc/cmdline; then"},{"line_number":69,"context_line":"        sudo ${_runcon} chroot ${TARGET_ROOT} \\"},{"line_number":70,"context_line":"            /usr/sbin/setfiles -F ${_dash_m} \\"},{"line_number":71,"context_line":"            /etc/selinux/targeted/contexts/files/file_contexts ${MOUNTPOINT}"}],"source_content_type":"application/x-shellscript","patch_set":5,"id":"3f79a3b5_8d266e68","line":68,"updated":"2018-08-31 08:03:46.000000000","message":"I think we\u0027re getting much closer to what\u0027s going on here now.  \n\nwe do not set \"audit\u003d1\" on our CI hosts, and i think this is only relevant to enable tracing before auditd starts.\n \nFrom the message and the prior source code link, it must be the audit_open() call is failing.  The man page says\n\n audit_open creates a NETLINK_AUDIT socket for communication with the kernel part of the Linux Audit Subsystem.\n\nHow can this fail?  Are you somehow running with a kernel without CONFIG_AUDIT?  Are we not running correctly as root or have some other sort of privilege issue here?  From a cursory google, this has been enabled in every distro from the 2.6 era days.  I can find very few references to \"audit_open\" failed when searching ... it does seem to indicate something quite odd.","commit_id":"461038235d5c6ed0b5d366dffd438f9759487265"},{"author":{"_account_id":7118,"name":"Ian Wienand","email":"iwienand@redhat.com","username":"iwienand"},"change_message_id":"0c6f49cf9bf75cf8a67f9b21540387516b0fa7ce","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"IFS\u003d\u0027|\u0027 read -ra SPLIT_MOUNTS \u003c\u003c\u003c \"$DIB_MOUNTPOINTS\""},{"line_number":67,"context_line":"for MOUNTPOINT in \"${SPLIT_MOUNTS[@]}\"; do"},{"line_number":68,"context_line":"    if [ \"${MOUNTPOINT}\" !\u003d \"/tmp/in_target.d\" ] \u0026\u0026 [ \"${MOUNTPOINT}\" !\u003d \"/dev\" ] \u0026\u0026 [ \"${MOUNTPOINT}\" !\u003d \"/boot/efi\" ] \u0026\u0026 pgrep kauditd \u003e/dev/null; then"},{"line_number":69,"context_line":"        sudo ${_runcon} chroot ${TARGET_ROOT} \\"},{"line_number":70,"context_line":"            /usr/sbin/setfiles -F ${_dash_m} \\"},{"line_number":71,"context_line":"            /etc/selinux/targeted/contexts/files/file_contexts ${MOUNTPOINT}"}],"source_content_type":"application/x-shellscript","patch_set":7,"id":"3f79a3b5_ed7a4d86","line":68,"updated":"2018-09-04 05:09:16.000000000","message":"I\u0027m very glad we found the root cause of this ... which appears to be that your FAI install was setting audit\u003d0 on the kernel command-line, which disables the kernel\u0027s audit subsystem, but most importantly the netlink protocol handling, which causes the audit_* calls in setfiles to fail and setfiles to subsequently die.\n\nHowever, I don\u0027t think this is the right thing to do.  This current check is for file-systems where it makes no sense to set selinux attributes (i.e. run setfiles) and is *not* a generic \"skip all selinux labelling\" check at all.\n\nI would be happy to see something like\n\n if ! pgrep kauditd; then\n   echo \"*** kauditd not found, suggesting auditing support is disabled in the host kernel.  setfiles will fail without this, please enable and rebuild\"\n   exit 1\n fi\n\nwhich would make it very obvious to the next poor person who hits this what\u0027s going on.  But I remain unconvinced it is valid to build without resetting selinux contexts.","commit_id":"011f4bc47cc83c3f2cc8d558d22ba08a71958fc0"},{"author":{"_account_id":19578,"name":"Olivier Bourdon","email":"olivierbourdon38@gmail.com","username":"olivierbourdon38"},"change_message_id":"a26ace26c8e8366bdd10c0c42e48f0762d91d2e9","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"IFS\u003d\u0027|\u0027 read -ra SPLIT_MOUNTS \u003c\u003c\u003c \"$DIB_MOUNTPOINTS\""},{"line_number":67,"context_line":"for MOUNTPOINT in \"${SPLIT_MOUNTS[@]}\"; do"},{"line_number":68,"context_line":"    if [ \"${MOUNTPOINT}\" !\u003d \"/tmp/in_target.d\" ] \u0026\u0026 [ \"${MOUNTPOINT}\" !\u003d \"/dev\" ] \u0026\u0026 [ \"${MOUNTPOINT}\" !\u003d \"/boot/efi\" ] \u0026\u0026 pgrep kauditd \u003e/dev/null; then"},{"line_number":69,"context_line":"        sudo ${_runcon} chroot ${TARGET_ROOT} \\"},{"line_number":70,"context_line":"            /usr/sbin/setfiles -F ${_dash_m} \\"},{"line_number":71,"context_line":"            /etc/selinux/targeted/contexts/files/file_contexts ${MOUNTPOINT}"}],"source_content_type":"application/x-shellscript","patch_set":7,"id":"3f79a3b5_2dbe05ae","line":68,"in_reply_to":"3f79a3b5_ed7a4d86","updated":"2018-09-04 05:44:10.000000000","message":"Done","commit_id":"011f4bc47cc83c3f2cc8d558d22ba08a71958fc0"}]}