j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 11:16:47 +00:00
Code Issues Projects Releases Wiki Activity

fix(installer): the panel starts on SELinux hosts, and a relabel keeps it so

Browse source 
On an AlmaLinux 10 host with SELinux enforcing, the installer finished
with exit 0 but the panel's four services never started: chcon labelled
the virtualenv httpd_sys_rw_content_t, which systemd may not execute
(status 203/EXEC, Permission denied), and the login page answered 502.
The README's manual steps did the same with httpd_sys_content_t. chcon
labels also went on a relabel, after which nginx got 403 for the
static files.

Now the installer writes file context rules, httpd_sys_content_t for
the panel and bin_t for venv/bin, restores the labels from them, and
does so whenever SELinux is enabled, not only when it enforces. The
manual steps add the bin_t rule and policycoreutils-python-utils (for
semanage).
This commit is contained in:
catborise 2026-11-03 16:55:19 +03:00
parent c7c3521c9a
commit 1cd1d63f0c
2 changed files with 19 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

7
README.md
View file

@ -145,7 +145,7 @@ nginx -t && systemctl restart nginx
```bash
# 1. System packages (libvirt-devel is in the CRB repository)
dnf -y install epel-release && crb enable
dnf -y install git python3-devel libvirt-devel python3-libvirt python3-lxml cyrus-sasl-md5 openssl-devel glibc gcc nginx python3-libguestfs iproute-tc
dnf -y install git python3-devel libvirt-devel python3-libvirt python3-lxml cyrus-sasl-md5 openssl-devel glibc gcc nginx python3-libguestfs iproute-tc policycoreutils-python-utils
# 2. Code
git clone https://github.com/retspen/webvirtcloud /srv/webvirtcloud
@ -174,7 +174,9 @@ cp conf/nginx/webvirtcloud.conf /etc/nginx/conf.d/
# 7. Ownership, private files, SELinux, firewall, start
chown -R nginx:nginx /srv/webvirtcloud
chmod 700 data && chmod 600 webvirtcloud/settings.py db.sqlite3
semanage fcontext -a -t httpd_sys_content_t "/srv/webvirtcloud(/.*)" 2>/dev/null || true
# nginx reads the static files, systemd runs the virtualenv's programs
semanage fcontext -a -t httpd_sys_content_t "/srv/webvirtcloud(/.*)?" 2>/dev/null || true
semanage fcontext -a -t bin_t "/srv/webvirtcloud/venv/bin(/.*)?" 2>/dev/null || true
restorecon -R /srv/webvirtcloud 2>/dev/null || true
setsebool -P httpd_can_network_connect on 2>/dev/null || true
firewall-cmd --add-service=http --permanent 2>/dev/null || true
@ -775,6 +777,7 @@ What an update from an older version changes for operators and users:
- The Logs page records who changed what (computes, users, groups, VM owners, settings, SSH keys, host networks, pools, volumes, interfaces, secrets and network filters) and every login, failed login and lockout, with the address and the result.
- On a host whose libvirt cannot change network interfaces (the udev backend: RHEL 9 and later, Debian 12), the interface pages offer no create, start, stop or delete.
- The panel is offered in English, Turkish and Simplified Chinese.
- With SELinux (RHEL family, openEuler), systemd could not run the virtualenv's programs and the panel did not start. The installer now writes file context rules (`httpd_sys_content_t` for the panel, `bin_t` for `venv/bin`) instead of `chcon`, so a relabel keeps them. A manual installation runs `semanage fcontext -a -t bin_t "/srv/webvirtcloud/venv/bin(/.*)?"` and `restorecon -R /srv/webvirtcloud` once; an installer one runs the installer again.
## Usage

21
webvirtcloud.sh
View file

@ -327,13 +327,20 @@ set_firewall () {
fi
}
# A file context rule (type, path pattern): added, or changed on a re-run
selinux_label () {
semanage fcontext -a -t "$1" "$2" 2>/dev/null || semanage fcontext -m -t "$1" "$2"
}
set_selinux () {
#Check if SELinux is enforcing
if [ "$(getenforce)" == "Enforcing" ]; then
if selinuxenabled 2>/dev/null; then
echo "* Configuring SELinux."
#Sets SELinux context type so that scripts running in the web server process are allowed read/write access
chcon -R -h -t httpd_sys_rw_content_t "$APP_PATH/"
setsebool -P httpd_can_network_connect 1
# nginx reads the static files and systemd runs the venv's programs; rules
# rather than chcon, so that a relabel keeps the labels
selinux_label httpd_sys_content_t "$APP_PATH(/.*)?" &&
selinux_label bin_t "$APP_PATH/venv/bin(/.*)?" &&
restorecon -R "$APP_PATH" &&
setsebool -P httpd_can_network_connect 1 || exit 1
fi
}
@ -562,7 +569,7 @@ case $distro in
log "yum -y install wget epel-release"
echo "* Installing OS requirements."
PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute-tc cyrus-sasl-md5 openssl-devel"
PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute-tc cyrus-sasl-md5 openssl-devel policycoreutils-python-utils"
install_packages
set_hosts
@ -591,7 +598,7 @@ case $distro in
tzone=\'$(get_timezone)\'
echo "* Installing OS requirements."
PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute cyrus-sasl openssl-devel"
PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute cyrus-sasl openssl-devel policycoreutils-python-utils"
install_packages
set_hosts