)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8833,"name":"Rabi Mishra","email":"ramishra@redhat.com","username":"rabi"},"change_message_id":"13526ac684b029c1a102104fff5c450828a792d4","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This is partial revert of 6c26d3378dc313a530042e3484db32c66d564b3e and"},{"line_number":10,"context_line":"readds label\u003ddisable to reintroduce the fix[1] for denial when"},{"line_number":11,"context_line":"the command inside the container tries to relabel /var/lib/nova."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] 6c26d3378dc313a530042e3484db32c66d564b3e"},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"ab3c3ec9_c1500545","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":64},"updated":"2022-09-13 07:23:23.000000000","message":"Rather than relabeling, we change the ownership of /var/lib/nova on host with that container and without disabling selinux we can\u0027t do that. right?","commit_id":"a5e6c8757e2f21530608b2a01fe07aa01309cb91"},{"author":{"_account_id":8833,"name":"Rabi Mishra","email":"ramishra@redhat.com","username":"rabi"},"change_message_id":"e9b72162c1b114c2316007958f8f7951b4c6f6ae","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This is partial revert of 6c26d3378dc313a530042e3484db32c66d564b3e and"},{"line_number":10,"context_line":"readds label\u003ddisable to reintroduce the fix[1] for denial when"},{"line_number":11,"context_line":"the command inside the container tries to relabel /var/lib/nova."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] 6c26d3378dc313a530042e3484db32c66d564b3e"},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"9553db59_cdca32ac","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":64},"in_reply_to":"215a0f21_99f178e9","updated":"2022-09-13 08:59:46.000000000","message":"Ack, I can see the script doing that in https://github.com/openstack/tripleo-heat-templates/blob/master/container_config_scripts/nova_statedir_ownership.py#L224-L229. \n\nWhat I don\u0027t understand is do we need that after it\u0027s created as \u0027setype\u0027: container_file_t[1].\n\n[1] https://github.com/openstack/tripleo-heat-templates/blob/master/deployment/nova/nova-ironic-container-puppet.yaml#L224","commit_id":"a5e6c8757e2f21530608b2a01fe07aa01309cb91"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"638be156384a13b48183ed8e473eb74085c93f33","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This is partial revert of 6c26d3378dc313a530042e3484db32c66d564b3e and"},{"line_number":10,"context_line":"readds label\u003ddisable to reintroduce the fix[1] for denial when"},{"line_number":11,"context_line":"the command inside the container tries to relabel /var/lib/nova."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] 6c26d3378dc313a530042e3484db32c66d564b3e"},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"4f082a56_936d5933","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":64},"in_reply_to":"9553db59_cdca32ac","updated":"2022-09-13 09:11:26.000000000","message":"The task does not have the recurse flag so it does not fix files in the directory with wrong context. chcon/own tasks were useful in the past for upgrade but might be redundant nowadays, though.","commit_id":"a5e6c8757e2f21530608b2a01fe07aa01309cb91"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"7d343645814217f19717c2fe44a6a50d4e25249e","unresolved":true,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This is partial revert of 6c26d3378dc313a530042e3484db32c66d564b3e and"},{"line_number":10,"context_line":"readds label\u003ddisable to reintroduce the fix[1] for denial when"},{"line_number":11,"context_line":"the command inside the container tries to relabel /var/lib/nova."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] 6c26d3378dc313a530042e3484db32c66d564b3e"},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"215a0f21_99f178e9","line":11,"range":{"start_line":11,"start_character":0,"end_line":11,"end_character":64},"in_reply_to":"ab3c3ec9_c1500545","updated":"2022-09-13 08:36:14.000000000","message":"The script executed in that nova statedir ownership container changes ownership and relables the directory. What is failing without disabling selinux is relabeling according to the traceback.\n\nchown should work with selinux kept. We have several containers doing that without disabling selinux (eg horizon_fix_perms)","commit_id":"a5e6c8757e2f21530608b2a01fe07aa01309cb91"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"7d343645814217f19717c2fe44a6a50d4e25249e","unresolved":true,"context_lines":[{"line_number":10,"context_line":"readds label\u003ddisable to reintroduce the fix[1] for denial when"},{"line_number":11,"context_line":"the command inside the container tries to relabel /var/lib/nova."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] 6c26d3378dc313a530042e3484db32c66d564b3e"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Closes-Bug: #1989405"},{"line_number":16,"context_line":"Change-Id: Ie18178c99a26c6cbdb52ac437965595224133217"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"fef394c1_aca4374a","line":13,"range":{"start_line":13,"start_character":4,"end_line":13,"end_character":44},"updated":"2022-09-13 08:36:14.000000000","message":"this should be cb889805334a7cd7325b2a9a1efe2bd00bd48c31 !","commit_id":"a5e6c8757e2f21530608b2a01fe07aa01309cb91"}],"/PATCHSET_LEVEL":[{"author":{"_account_id":34754,"name":"Cristian Le","email":"opendev@lecris.me","username":"lecris"},"change_message_id":"47778251c703b555158a46b24fa7ac7d0ee23606","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"9428b035_bf60874e","updated":"2022-09-13 09:45:10.000000000","message":"I have confirmed that this patch does indeed fix the issue in #1989405. Maybe there is a more appropriate fix that Rabi mentioned.","commit_id":"5060be800c8d771e5f1fbfa93d93e89287b5ae17"},{"author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"change_message_id":"a75c0c84ff9bed4ff43cae6281d6af5440c5cb7f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"d86fd84e_4dab451c","updated":"2022-09-21 01:16:05.000000000","message":"recheck checking whether the failure is consistent.","commit_id":"5060be800c8d771e5f1fbfa93d93e89287b5ae17"}]}