Re: RHEL9?

Hi David,

We have just fixed up our nightly community packages for rhel8 and rhel9 
and these builds should ierrornclude the fix for selinux policy module 
import during install.

If the selinux policy included in our package is newer than the version in 
the OS you will get an error with instructions 
<https://github.com/cfengine/buildscripts/blob/master/packaging/common/cfengine-non-hub/postinstall.sh#L121-L150> 
on what to do. The source for the selinux policy is included in the RPM now 
so you can build it custom for your system if need be.

For example, on an rhel 9 system that is not upgraded I get:

Error:
  Problem: conflicting requests
    - nothing provides selinux-policy >= 34.1.43 needed by 
cfengine-community-3.21.1a.921398ce3-25452.el9.x86_64

The best option is to upgrade your system which should ensure that your 
selinux and kernel are the same or newer than the policy included in our 
package.

cf-remote can show you the package URL:

$ cf-remote --version 3.21.x list --edition community el9 Available 
releases: master, 3.21.x, 3.21.0, 3.18.x, 3.18.3, 3.18.2, 3.18.1, 3.18.0 
Using 3.21.x LTS: 
http://buildcache.cfengine.com/packages/testing-pr/jenkins-community-nightly-3.21.x-42/PACKAGES_x86_64_linux_redhat_9/cfengine-community-3.21.1a.921398ce3-25452.el9.x86_64.rpm

or can install if the host has nopasswd sudo access:

$ cf-remote --version 3.21.x install --edition community --clients 
vagrant@rhel-9

Also available on the 
website: https://cfengine.com/downloads/cfengine-community-nightly/

Let us know how it goes!
-Craig

On Thursday, January 19, 2023 at 9:31:49 AM UTC-6 
[email protected] wrote:

> Craig,
>
> Many thanks.  In this context, we are simply end-users.  We'd like to get 
> RHEL9 prepared, but we can probably wait until you have an RPM (assuming 
> the next few weeks).  That said, when you believe your RPM is in a 
> reasonable beta (or release-candidate or pre-release) state let me know and 
> I can give it a try and report back.  This would apply both to 3.21 and to 
> 3.18 backport.
>
> Thanks.
>
> -- David Lee
>
> On Friday, 6 January 2023 at 21:30:47 UTC [email protected] wrote:
>
>> Hi David,
>>
>> I am working on this right now and have worked up a solution.
>>
>> Essentially our compiled cfengine-enterprise.pp selinux policy is 
>> compiled to a certain policydb version.
>>
>> Probably the best work-around for you right now is to re-compile the 
>> policy yourself from sources in the cfengine core repository.
>>
>> $ git clone https://github.com/cfengine/core --depth 1 # or use what you 
>> have already checked out
>> $ sudo yum install selinux-policy-devel
>> $ cd core/misc/selinux
>> $ make -f /usr/share/selinux/devel/Makefile -j1
>> $ sudo semodule -n -i cfengine-enterprise.pp
>>
>> See this pair of PRs for core and buildscripts for my pretty close to 
>> done work in progress for solving this in the installer package:
>>
>> https://github.com/cfengine/core/pull/5146
>> https://github.com/cfengine/buildscripts/pull/1187
>>
>> Where I have added a Requires for the version of selinux-policy package 
>> that we use when we build the package and similar work-around notes as 
>> above if the module fails to import.
>>
>> Cheers,
>> Craig
>>
>>
>> On Friday, January 6, 2023 at 12:37:49 PM UTC-6 Nick Anderson wrote:
>>
>>> "t.d…@servicemusic.org.uk" <[email protected]> writes: 
>>>
>>> I observe that the community download page 
>>> https://cfengine.com/downloads/cfengine-community/ offers RHEL9/CentOS9 
>>> for 3.21.0 LTS (good) but not for 3.18.3 LTS. If 3.18.3 now supports RHEL9, 
>>> could that page be investigated and rectified, please? (Because of "rxdirs" 
>>> I'd rather avoid 3.21 for the moment… there's plenty of other catch-up for 
>>> me to do prior to that! So if a 3.18/RHEL9 RPM s available that would be 
>>> great.) 
>>>
>>> That's because we have not released a 3.18 package for el9. The 3.18.x 
>>> output I showed you was from nightly builds, so 3.18.4 (hopefully). 
>>>
>>> Meanwhile: a possible "semodule" bug report for 3.21 on RHEL9. Latest OS 
>>> (yum upgrade); I had installed before Christmas. I hit the problem just 
>>> now; then did a yum upgrade (lots of packages upgraded), then rebooted, 
>>> then tried again. Problem still there. This is the latest:: 
>>>
>>> Yeah, we have noticed some issues with el9 and needing to be updated in 
>>> order for the package to install. We are still looking at how to best 
>>> address it. 
>>>
>>> – Nick Anderson | Doer of Things | (+1) 785-550-1767 <(785)%20550-1767> 
>>> | https://northern.tech 
>>>
>>

-- 
You received this message because you are subscribed to the Google Groups "help-cfengine" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/help-cfengine/0d8bfd79-ba2e-4dd4-b820-ebb422a39421n%40googlegroups.com.