Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Import SElinux module #477 #486

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

yasminvalim
Copy link
Contributor

Import SElinux module

We want to add sugar to butane which will allow users import costum SElinux module.


Related Issues

#477

@yasminvalim yasminvalim self-assigned this Aug 28, 2023
@yasminvalim yasminvalim marked this pull request as draft August 28, 2023 17:55
@yasminvalim yasminvalim linked an issue Aug 28, 2023 that may be closed by this pull request
@yasminvalim yasminvalim force-pushed the 477-import-selinux branch 2 times, most recently from 6e31b30 to 586a029 Compare August 30, 2023 14:02
@travier
Copy link
Member

travier commented Aug 31, 2023

Just a small note for your name in the Git config:

From: YASMIN VALIM <[email protected]>

You probably want Yasmin Valim <[email protected]> instead.

You'll have to modify it in you ~/.gitconfig and then "reset" the author for all your commits here with git rebase or git commit --amend.

@yasminvalim
Copy link
Contributor Author

I'm now trying to test manually, and while reading the documentation, I had a question:
How can I be sure that my code is running locally?

I understand that I can build it with custom files that I created and it will be translated from BU to Ignition.
But I'm not sure how can I run the code I made instead of the butane version I installed and the latest image.

I think I am missing something.

@prestist
Copy link
Collaborator

I'm now trying to test manually, and while reading the documentation, I had a question: How can I be sure that my code is running locally?

I understand that I can build it with custom files that I created and it will be translated from BU to Ignition. But I'm not sure how can I run the code I made instead of the butane version I installed and the latest image.

Noooo worries there are a lot of layers here.

So, to test it locally we have to exercise your code which lives in butane, then we want to test that our expectation of what is required for the system to effectively implement the sugar is correct which is done by exercising existing code in ignition through first booting a fcos image.

The simplest step is directly exercising your code by creating a butane config which references the sugar you added, and using your locally built butane to create an .ign file.

  • build your butane, and then ./butane.bin --pretty --strict example.bu > example.ign
    Note you will want a way to get into your running fcos image so you can verify things in the OS after its running.
    you can read a guide about auto login here.
    • so to summarize your .bu will be the bu yaml in the example + your sugar.

Now to exercise your assumptions for enabling a semodule you would then need to first boot a fcos vm with your ignition config. The simpliest way to do this is by using cosa

  1. You can either download a qcow image from here or build your own using cosa int, fetch, build

  2. Then you can pass your ign file you built earlier using a command like so $ cosa kola qemuexec --ignition ./ignition.json --ignition-direct --qemu-image ./yourImage.qcow2

  3. If the ign config is understood and functional, you should be greeted by the console (with auto login) then you can do your probing of the os to see if the selinux module is enabled (as your sugar indicates)

@travier
Copy link
Member

travier commented Sep 18, 2023

You can find an small example SELinux module (CIL) in coreos/fedora-coreos-tracker#1447 (comment)

@yasminvalim
Copy link
Contributor Author

yasminvalim commented Oct 5, 2023

Hey there,

I'm sharing my current approach for tackling this issue. I did have a few other ideas, but this one seems to be the most on point. I'm planning to commit the code I've been working on in the next few days, even though it might not be 100% ready, and it could potentially break my CI setup.

Here's the plan I've got in mind. If you've got any cool ideas or questions that could help me sharpen things up, please don't hold back.

  • Fields with content of the SElinux file and the file path
  • Create a filesystem (file: translate.go) (do I need it?)
  • Create the file with that path and the content (file: translate.go)
  • Execute the command “semodule -i” + path (file: translate.go)
  • Translate butane to ignition (file: translate.go)
  • Validate some rules in validate.go:
    • If there is a path, the content is required
    • If there is a content, the path is required
    • Any more rules required?
  • Unit tests

This current approach would look like that in a butane file:

variant: fcos
version: 1.6.0-experimental
selinux_module:
  - contents:
      - |
        # setenforce 1
        # cat permissive-keyutils.cil
        (type keyutils_request_t)
        (typepermissive keyutils_request_t)
        # semodule -i permissive-keyutils.cil
  - path: /path/to/selinux/custom/file

Your input would be awesome and thanks for your attention.

@travier
Copy link
Member

travier commented Oct 10, 2023

The example Butane config should likely only include the content of the SELinux module:

variant: fcos
version: 1.6.0-experimental
selinux:
  module:
    - name: "permissive-keyutils"
    - contents: |
        (type keyutils_request_t)
        (typepermissive keyutils_request_t)

Then Butane would generate an Ignition config that:

  • writes the content of this module to a file in /etc/selinux/custom-modules/<module-name.cil> (not sure where exactly would be best)
  • adds a systemd unit that loads this module on first boot using semodule -i ....

@prestist
Copy link
Collaborator

Your approach is sound. It might make sense to create tests before making the functions. In this case in particular could be well suited for TDD, and just create a test like TestTranslateBootDevice which would fail until you create the translate code to build the sugar.

Since you have a sound understanding of the input and the expected output. And as long as your spec changes are there you should be able to run the test with no compile errors.

config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
@yasminvalim yasminvalim force-pushed the 477-import-selinux branch 2 times, most recently from 5b83d3c to 48ed3ac Compare November 10, 2023 16:02
@yasminvalim
Copy link
Contributor Author

Hey folks, I am still having problem with unit tests. Currently, I am having this error and those are the logs.
This error applies to each line in translations.

--- FAIL: TestTranslateSelinux (0.00s)
    --- FAIL: TestTranslateSelinux/translate_0 (0.00s)
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:45: 
            	Error Trace:	/home/ydesouza/butane/base/util/test.go:45
            	            				/home/ydesouza/butane/config/fcos/v1_6_exp/translate_test.go:1717
            	Error:      	Not equal: 
            	            	expected: translate.Translation{From:path.ContextPath{Path:[]interface {}{"selinux", "module", 0}, Tag:"yaml"}, To:path.ContextPath{Path:[]interface {}{"storage"}, Tag:"json"}}
            	            	actual  : translate.Translation{From:path.ContextPath{Path:[]interface {}{"selinux", "module"}, Tag:"yaml"}, To:path.ContextPath{Path:[]interface {}{"storage"}, Tag:"json"}}
            	            	
            	            	Diff:
            	            	--- Expected
            	            	+++ Actual
            	            	@@ -2,6 +2,5 @@
            	            	  From: (path.ContextPath) {
            	            	-  Path: ([]interface {}) (len=3) {
            	            	+  Path: ([]interface {}) (len=2) {
            	            	    (string) (len=7) "selinux",
            	            	-   (string) (len=6) "module",
            	            	-   (int) 0
            	            	+   (string) (len=6) "module"
            	            	   },
            	Test:       	TestTranslateSelinux/translate_0
            	Messages:   	non-identity translation with unexpected From

What I am missing here?
Thanks! 😸

Copy link
Member

@jlebon jlebon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not an SME on this codebase and don't have the cycles to be one, unfortunately. :( I did a semi-shallow review of what I could piece together.

config/common/errors.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate_test.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/translate.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/validate.go Outdated Show resolved Hide resolved
@yasminvalim yasminvalim force-pushed the 477-import-selinux branch 2 times, most recently from 30a7dfa to 87011dc Compare November 20, 2023 19:27
@yasminvalim
Copy link
Contributor Author

After spending time debugging, I'm still encountering similar errors to those I had before, despite making various changes. If anyone has any ideas about what might be causing this, I would appreciate. Thanks!

--- FAIL: TestTranslateSelinux (0.00s)
    --- FAIL: TestTranslateSelinux/translate_0 (0.00s)
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module → $.storage
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.systemd.units.0.dropins
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.systemd.units.0.dropins.0
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.path
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.append
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.append.0
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.append.0.source
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:55: 
            	Error Trace:	/home/ydesouza/butane/base/util/test.go:55
            	            				/home/ydesouza/butane/config/fcos/v1_6_exp/translate_test.go:1726
            	Error:      	Not equal: 
            	            	expected: []interface {}{"selinux", "module", 0}
            	            	actual  : []interface {}{"systemd", "units", 0, "contents"}
            	            	
            	            	Diff:
            	            	--- Expected
            	            	+++ Actual
            	            	@@ -1,5 +1,6 @@
            	            	-([]interface {}) (len=3) {
            	            	- (string) (len=7) "selinux",
            	            	- (string) (len=6) "module",
            	            	- (int) 0
            	            	+([]interface {}) (len=4) {
            	            	+ (string) (len=7) "systemd",
            	            	+ (string) (len=5) "units",
            	            	+ (int) 0,
            	            	+ (string) (len=8) "contents"
            	            	 }
            	Test:       	TestTranslateSelinux/translate_0
            	Messages:   	translation is not identity
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:55: 
            	Error Trace:	/home/ydesouza/butane/base/util/test.go:55
            	            				/home/ydesouza/butane/config/fcos/v1_6_exp/translate_test.go:1726
            	Error:      	Not equal: 
            	            	expected: []interface {}{"selinux", "module", 0}
            	            	actual  : []interface {}{"systemd", "units", 0, "enabled"}
            	            	
            	            	Diff:
            	            	--- Expected
            	            	+++ Actual
            	            	@@ -1,5 +1,6 @@
            	            	-([]interface {}) (len=3) {
            	            	- (string) (len=7) "selinux",
            	            	- (string) (len=6) "module",
            	            	- (int) 0
            	            	+([]interface {}) (len=4) {
            	            	+ (string) (len=7) "systemd",
            	            	+ (string) (len=5) "units",
            	            	+ (int) 0,
            	            	+ (string) (len=7) "enabled"
            	            	 }
            	Test:       	TestTranslateSelinux/translate_0
            	Messages:   	translation is not identity
        /home/ydesouza/butane/config/fcos/v1_6_exp/translate_test.go:1727: 
            	Error Trace:	/home/ydesouza/butane/config/fcos/v1_6_exp/translate_test.go:1727
            	Error:      	Received unexpected error:
            	            	Missing paths in TranslationSet:
            	            	$.storage.files.0.path
            	            	$.storage.files.0.append.0.compression
            	            	$.storage.files.0.append.0.source
            	            	$.storage.files.0.append.0
            	            	$.storage.files.0.append
            	            	$.storage.files.0
            	            	$.storage.files
            	            	$.storage
            	            	$.systemd.units
            	            	$.systemd
            	Test:       	TestTranslateSelinux/translate_0
            	Messages:   	incomplete TranslationSet coverage
FAIL
FAIL	github.com/coreos/butane/config/fcos/v1_6_exp	0.003s

@yasminvalim yasminvalim force-pushed the 477-import-selinux branch 2 times, most recently from a47e0b0 to 8149574 Compare December 11, 2023 15:14
@yasminvalim
Copy link
Contributor Author

I've made few changes based on the review and debugged the code. However, I'm still uncertain about what's causing the issue in either the code or the test itself. Below is the current error.

Running tool: /usr/bin/go test -timeout 30s -run ^TestTranslateSelinux$ github.com/coreos/butane/config/fcos/v1_6_exp

--- FAIL: TestTranslateSelinux (0.00s)
    --- FAIL: TestTranslateSelinux/translate_0 (0.00s)
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module → $.storage
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.path
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.append
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.append.0
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.append.0.source
        /home/ydesouza/butane/config/fcos/v1_6_exp/test.go:47: missing non-identity translation $.selinux.module.0 → $.storage.files.0.append.0.compression
        /home/ydesouza/butane/config/fcos/v1_6_exp/translate_test.go:1737: 
            	Error Trace:	/home/ydesouza/butane/config/fcos/v1_6_exp/translate_test.go:1737
            	Error:      	Received unexpected error:
            	            	Missing paths in TranslationSet:
            	            	$.storage.files.0.path
            	            	$.storage.files.0.append.0.compression
            	            	$.storage.files.0.append.0.source
            	            	$.storage.files.0.append.0
            	            	$.storage.files.0.append
            	            	$.storage.files.0
            	            	$.storage.files
            	            	$.storage
            	            	$.systemd.units
            	            	$.systemd
            	Test:       	TestTranslateSelinux/translate_0
            	Messages:   	incomplete TranslationSet coverage
FAIL
FAIL	github.com/coreos/butane/config/fcos/v1_6_exp	0.003s
FAIL

Please share any insights if you have them. 😸

config/fcos/v1_6_exp/schema.go Outdated Show resolved Hide resolved
config/fcos/v1_6_exp/schema.go Outdated Show resolved Hide resolved
@yasminvalim yasminvalim force-pushed the 477-import-selinux branch 3 times, most recently from 1b6bae2 to 6f9bf5f Compare December 19, 2023 22:04
Copy link
Collaborator

@prestist prestist left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We did a debug session on this, and finally got to a workable point, but we remain puzzled on these two things @jlebon

"WantedBy=multi-user.target\n"),
Enabled: util.BoolToPtr(true),
})
ts.AddFromCommonSource(yamlPath, path.New("json", "systemd"), rendered.Systemd)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So while this certainly passes the validate, I am having difficulty understanding why this should not be

ts.AddFromCommonSource(yamlPath, path.New("json", "systemd","units",len(rendred.systemd.units)), rendered.Systemd.units)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And I think this is correct too.

},
},
})
ts.AddFromCommonSource(yamlPath, path.New("json", "storage"), rendered.Storage)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So while this certainly passes the validate, I am having difficulty understanding why this should not be

ts.AddFromCommonSource(yamlPath, path.New("json", "storage","files",len(rendred.storage.files)), rendered.storage.files)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I understand this better now.

So I do think this is correct. It's saying that everything under and including the .storage key is associated with that module (after adding the index like I mentioned above, it'd be .selinux.module.0 -> .storage and -> .storage.files and so on). Essentially, we're not just adding a file and a unit because of this module, we have to add all the keys leading up to it. All keys in the output need a source translation associated, so e.g. .storage needs to be associated to something on the YAML side.

@prestist
Copy link
Collaborator

prestist commented Jan 4, 2024

@yasminvalim the go 1.21 test should be fixed by #505.

steps to update branch assuming origin is your fork and upstream is
git fetch upstream
git merge upstream/main 
git push -f

@yasminvalim
Copy link
Contributor Author

@yasminvalim the go 1.21 test should be fixed by #505.

steps to update branch

Thanks, I updated my branch and I will squash to have just one commit. 😸

@prestist
Copy link
Collaborator

prestist commented Jan 9, 2024

@yasminvalim the go 1.21 test should be fixed by #505.
steps to update branch
assuming origin is your fork and upstream is

Sorry I led you astray, the merge commit is nooooo good, the best thing to do is likely to undo your merge and just rebase

git revert -m 1 a419de4
git fetch upstream
git rebase upstream/main

that way your fast-forwarded rather then merged into.

@yasminvalim
Copy link
Contributor Author

@yasminvalim the go 1.21 test should be fixed by #505.
steps to update branch
assuming origin is your fork and upstream is

Sorry I led you astray, the merge commit is nooooo good, the best thing to do is likely to undo your merge and just rebase

git revert -m 1 a419de4 git fetch upstream git rebase upstream/main

that way your fast-forwarded rather then merged into.

I think it's fine now, but not entirely sure because it's showing all the files updated in the old merge. Can you take a look, please?

Also, can I use rebase as a pattern when I need to update a branch?

@prestist
Copy link
Collaborator

@yasminvalim I am a bit confused because this 36f71f1 should not be a thing. after reverting your merge it should have put you in a place with only your other commit.

Once you revert the merge you can update your branch with the rebase pattern instead.


type Module struct {
Name string `yaml:"name"`
Content string `yaml:"content"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think probably this hsould be a Resource instead of a string. E.g. I can imagine wanting to keep this in a separate cil file and then using local.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did it, but I'm not sure if it's good enough.
I created a type 'resource' in v1_6_exp/schema as in the other versions to include it as a type for 'contents'.

The tests are working even with this change, so I think it's okay.

@@ -50,3 +51,12 @@ type GrubUser struct {
Name string `yaml:"name"`
PasswordHash *string `yaml:"password_hash"`
}

type Selinux struct {
Module []Module `yaml:"module"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this should be

Suggested change
Module []Module `yaml:"module"`
Modules []Module `yaml:"modules"`

List keys are pluralized (disks, filesystems, files, etc...).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! I changed it and also altered content to plural since the other examples are also using plural.

var r report.Report

for _, module := range c.Selinux.Module {
rendered = processModule(rendered, module, options, ts, r, path.New("yaml", "selinux", "module"))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should add the index to the path here so that e.g. module 2 is associated with the right output files and systemd units.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added the index path in the implementation and in the 'From Path' in test files. 👍

},
},
})
ts.AddFromCommonSource(yamlPath, path.New("json", "storage"), rendered.Storage)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I understand this better now.

So I do think this is correct. It's saying that everything under and including the .storage key is associated with that module (after adding the index like I mentioned above, it'd be .selinux.module.0 -> .storage and -> .storage.files and so on). Essentially, we're not just adding a file and a unit because of this module, we have to add all the keys leading up to it. All keys in the output need a source translation associated, so e.g. .storage needs to be associated to something on the YAML side.

"WantedBy=multi-user.target\n"),
Enabled: util.BoolToPtr(true),
})
ts.AddFromCommonSource(yamlPath, path.New("json", "systemd"), rendered.Systemd)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And I think this is correct too.

Comment on lines 1645 to 1658
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "storage")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "storage", "files")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "storage", "files", 0)},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "storage", "files", 0, "path")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "storage", "files", 0, "append")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "storage", "files", 0, "append", 0)},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "storage", "files", 0, "append", 0, "source")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "storage", "files", 0, "append", 0, "compression")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "systemd", "units", 0, "name")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "systemd", "units", 0, "contents")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "systemd", "units", 0, "enabled")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "systemd", "units", 0)},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "systemd", "units")},
{From: path.New("yaml", "selinux", "module"), To: path.New("json", "systemd")},
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With the added index, you'd add 0 to all the From paths here.

Name: module.Name + ".conf",
Contents: util.StrToPtr(
"[Unit]\n" +
"Description=Import SELinux module\n" +
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This description should be templated.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I saw in another file how it's done and managed to reproduce. Thank you for letting me know 🐱


rendered.Systemd.Units = append(rendered.Systemd.Units, types.Unit{
Name: module.Name + ".conf",
Contents: util.StrToPtr(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would add a comment here (in the generated systemd unit) like:

# Generated by Butane

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, I've added the comment. Thanks. 😸

Comment on lines 103 to 106
if m.Name == "" && m.Content == "" {
r.AddOnError(c.Append("name"), common.ErrSelinuxContentNotSpecified)
r.AddOnError(c.Append("content"), common.ErrSelinuxContentNotSpecified)
} else {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed both this implementation and test.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your review :)

config/fcos/v1_6_exp/validate_test.go Outdated Show resolved Hide resolved
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Import SElinux module
4 participants