Re: lorax - selinux limitation

Keep in mind - it may be fine still you are using SELinux targeted policy, which is kiddy mode :D
Some users (I am, for example) can use SELinux MLS policy, where you should write a lot of rules for every apps, so one part of lorax would works fine, another - do not at all, and third one - looks like work fine, but SELinux blocked something unusual inside lorax/installroot.

On 17 December 2015 10:53:12 GMT+03:00, Dominique Martinet <[email protected]> wrote:
>Well, all my systems here (in the cluster I'm rebuilding the image for)
>have selinux enforced, so I basically either have to maintain a local
>patch to skip the check or to spawn a VM just for the job - both of
>which I can do right now, but would rather avoid in the long term.
>
>Would it be possible to add a switch like
>--yes-selinux-is-enforced-do-it-anyway
>or something ugly to bypass the check then?
>
>
>FWIW selinux policies are rather centralised and updated everywhere so
>it should be ok for anyone in el7/recent-ish fedora (would need to test
>el6) that runs root as unconstrained, may be worth checking for id -Z
>instead even if it's a bit more work?
>
>
>(I'm actually not sure if the preferred way to change which kernel to
>use in the pxe images is to go through lorax or just to fix the kernel
>modules in the initrd by hand.. I find lorax "cleaner", but if I have
>to
>kludge around it may be easier to go back to scripting around the
>initrd
>modification)
>
>Thanks,

---
Regards,
Vit Ry.