From 1cd1d63f0c4a878b1fc64cc4caaa028572d1aa50 Mon Sep 17 00:00:00 2001 From: catborise Date: Tue, 3 Nov 2026 16:55:19 +0300 Subject: [PATCH] fix(installer): the panel starts on SELinux hosts, and a relabel keeps it so On an AlmaLinux 10 host with SELinux enforcing, the installer finished with exit 0 but the panel's four services never started: chcon labelled the virtualenv httpd_sys_rw_content_t, which systemd may not execute (status 203/EXEC, Permission denied), and the login page answered 502. The README's manual steps did the same with httpd_sys_content_t. chcon labels also went on a relabel, after which nginx got 403 for the static files. Now the installer writes file context rules, httpd_sys_content_t for the panel and bin_t for venv/bin, restores the labels from them, and does so whenever SELinux is enabled, not only when it enforces. The manual steps add the bin_t rule and policycoreutils-python-utils (for semanage). --- README.md | 7 +++++-- webvirtcloud.sh | 21 ++++++++++++++------- 2 files changed, 19 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 1385510d..402385b8 100644 --- a/README.md +++ b/README.md @@ -145,7 +145,7 @@ nginx -t && systemctl restart nginx ```bash # 1. System packages (libvirt-devel is in the CRB repository) dnf -y install epel-release && crb enable -dnf -y install git python3-devel libvirt-devel python3-libvirt python3-lxml cyrus-sasl-md5 openssl-devel glibc gcc nginx python3-libguestfs iproute-tc +dnf -y install git python3-devel libvirt-devel python3-libvirt python3-lxml cyrus-sasl-md5 openssl-devel glibc gcc nginx python3-libguestfs iproute-tc policycoreutils-python-utils # 2. Code git clone https://github.com/retspen/webvirtcloud /srv/webvirtcloud @@ -174,7 +174,9 @@ cp conf/nginx/webvirtcloud.conf /etc/nginx/conf.d/ # 7. Ownership, private files, SELinux, firewall, start chown -R nginx:nginx /srv/webvirtcloud chmod 700 data && chmod 600 webvirtcloud/settings.py db.sqlite3 -semanage fcontext -a -t httpd_sys_content_t "/srv/webvirtcloud(/.*)" 2>/dev/null || true +# nginx reads the static files, systemd runs the virtualenv's programs +semanage fcontext -a -t httpd_sys_content_t "/srv/webvirtcloud(/.*)?" 2>/dev/null || true +semanage fcontext -a -t bin_t "/srv/webvirtcloud/venv/bin(/.*)?" 2>/dev/null || true restorecon -R /srv/webvirtcloud 2>/dev/null || true setsebool -P httpd_can_network_connect on 2>/dev/null || true firewall-cmd --add-service=http --permanent 2>/dev/null || true @@ -775,6 +777,7 @@ What an update from an older version changes for operators and users: - The Logs page records who changed what (computes, users, groups, VM owners, settings, SSH keys, host networks, pools, volumes, interfaces, secrets and network filters) and every login, failed login and lockout, with the address and the result. - On a host whose libvirt cannot change network interfaces (the udev backend: RHEL 9 and later, Debian 12), the interface pages offer no create, start, stop or delete. - The panel is offered in English, Turkish and Simplified Chinese. +- With SELinux (RHEL family, openEuler), systemd could not run the virtualenv's programs and the panel did not start. The installer now writes file context rules (`httpd_sys_content_t` for the panel, `bin_t` for `venv/bin`) instead of `chcon`, so a relabel keeps them. A manual installation runs `semanage fcontext -a -t bin_t "/srv/webvirtcloud/venv/bin(/.*)?"` and `restorecon -R /srv/webvirtcloud` once; an installer one runs the installer again. ## Usage diff --git a/webvirtcloud.sh b/webvirtcloud.sh index 6be56357..372840ee 100755 --- a/webvirtcloud.sh +++ b/webvirtcloud.sh @@ -327,13 +327,20 @@ set_firewall () { fi } +# A file context rule (type, path pattern): added, or changed on a re-run +selinux_label () { + semanage fcontext -a -t "$1" "$2" 2>/dev/null || semanage fcontext -m -t "$1" "$2" +} + set_selinux () { - #Check if SELinux is enforcing - if [ "$(getenforce)" == "Enforcing" ]; then + if selinuxenabled 2>/dev/null; then echo "* Configuring SELinux." - #Sets SELinux context type so that scripts running in the web server process are allowed read/write access - chcon -R -h -t httpd_sys_rw_content_t "$APP_PATH/" - setsebool -P httpd_can_network_connect 1 + # nginx reads the static files and systemd runs the venv's programs; rules + # rather than chcon, so that a relabel keeps the labels + selinux_label httpd_sys_content_t "$APP_PATH(/.*)?" && + selinux_label bin_t "$APP_PATH/venv/bin(/.*)?" && + restorecon -R "$APP_PATH" && + setsebool -P httpd_can_network_connect 1 || exit 1 fi } @@ -562,7 +569,7 @@ case $distro in log "yum -y install wget epel-release" echo "* Installing OS requirements." - PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute-tc cyrus-sasl-md5 openssl-devel" + PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute-tc cyrus-sasl-md5 openssl-devel policycoreutils-python-utils" install_packages set_hosts @@ -591,7 +598,7 @@ case $distro in tzone=\'$(get_timezone)\' echo "* Installing OS requirements." - PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute cyrus-sasl openssl-devel" + PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute cyrus-sasl openssl-devel policycoreutils-python-utils" install_packages set_hosts