j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-10 12:16:49 +00:00
Code Issues Projects Releases Wiki Activity

fix(installer): the panel starts on SELinux hosts, and a relabel keeps it so

Browse source 
On an AlmaLinux 10 host with SELinux enforcing, the installer finished
with exit 0 but the panel's four services never started: chcon labelled
the virtualenv httpd_sys_rw_content_t, which systemd may not execute
(status 203/EXEC, Permission denied), and the login page answered 502.
The README's manual steps did the same with httpd_sys_content_t. chcon
labels also went on a relabel, after which nginx got 403 for the
static files.

Now the installer writes file context rules, httpd_sys_content_t for
the panel and bin_t for venv/bin, restores the labels from them, and
does so whenever SELinux is enabled, not only when it enforces. The
manual steps add the bin_t rule and policycoreutils-python-utils (for
semanage).
This commit is contained in:
catborise 2026-11-03 16:55:19 +03:00
parent c7c3521c9a
commit 1cd1d63f0c
2 changed files with 19 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

21
webvirtcloud.sh
View file

@ -327,13 +327,20 @@ set_firewall () {
fi
}
# A file context rule (type, path pattern): added, or changed on a re-run
selinux_label () {
semanage fcontext -a -t "$1" "$2" 2>/dev/null || semanage fcontext -m -t "$1" "$2"
}
set_selinux () {
#Check if SELinux is enforcing
if [ "$(getenforce)" == "Enforcing" ]; then
if selinuxenabled 2>/dev/null; then
echo "* Configuring SELinux."
#Sets SELinux context type so that scripts running in the web server process are allowed read/write access
chcon -R -h -t httpd_sys_rw_content_t "$APP_PATH/"
setsebool -P httpd_can_network_connect 1
# nginx reads the static files and systemd runs the venv's programs; rules
# rather than chcon, so that a relabel keeps the labels
selinux_label httpd_sys_content_t "$APP_PATH(/.*)?" &&
selinux_label bin_t "$APP_PATH/venv/bin(/.*)?" &&
restorecon -R "$APP_PATH" &&
setsebool -P httpd_can_network_connect 1 || exit 1
fi
}
@ -562,7 +569,7 @@ case $distro in
log "yum -y install wget epel-release"
echo "* Installing OS requirements."
PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute-tc cyrus-sasl-md5 openssl-devel"
PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute-tc cyrus-sasl-md5 openssl-devel policycoreutils-python-utils"
install_packages
set_hosts
@ -591,7 +598,7 @@ case $distro in
tzone=\'$(get_timezone)\'
echo "* Installing OS requirements."
PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute cyrus-sasl openssl-devel"
PACKAGES="git hostname python3-devel libvirt-devel python3-libvirt glibc gcc nginx python3-lxml python3-libguestfs iproute cyrus-sasl openssl-devel policycoreutils-python-utils"
install_packages
set_hosts