Unnamed repository
f7e92f8a6a
Resolves: https://issues.redhat.com/browse/RHEL-124989 Conflict: None commit fe2891da11ce088ce14f7b2913bd3123b8f7c727 Author: Coiby Xu <coxu@redhat.com> Date: Mon Nov 3 09:55:07 2025 +0800 Restore SELinux label of crypttab file Currently, for LUKS encrypted dump target, the system can have booting problem with relatively older selinux-policy e.g. 40.13.21-1.el10 or 38.1.65-1.el9.noarch, [*** ] Job dev-disk-by\x2duuid-55f4fce1\x2…tart running (1min 21s / 1min 30s) ... [ TIME ] Timed out waiting for device dev-d…f4fce1-cd7f-43a6-8729-f0edcd048d73. [DEPEND] Dependency failed for luks.mount - /luks. [DEPEND] Dependency failed for local-fs.target - Local File Systems. [DEPEND] Dependency failed for selinux-auto…k the need to relabel after reboot. ... [FAILED] Failed to start kdump.service - Crash recovery kernel arming. See 'systemctl status kdump.service' for details. You are in emergency mode. After logging in, type "journalctl -xb" to view system logs, "systemctl reboot" to reboot, or "exit" to continue bootup. [ 4.375155] systemd-cryptsetup-generator[690]: Failed to open /etc/crypttab: Permission denied [ 4.376555] audit: type=1400 audit(1762134586.538:4): avc: denied { open } for pid=690 comm="systemd-cryptse" path="/etc/crypttab" dev="vda3" ino=16916076 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0 This happens because the updated crypttab file for LUKS dump target has incorrect SELinux label as it's created by mktemp. As a result, SELinux will prevent systemd-cryptsetup-generator from accessing crypttab and the encrypted dump target can fail to mount, # ls -Z /etc/crypttab unconfined_u:object_r:user_tmp_t:s0 /etc/crypttab Restore the SELinux label of crypttab to fix this issue, # ls -Z /etc/crypttab unconfined_u:object_r:etc_t:s0 /etc/crypttab Although this issue no longer happens to newer selinux-policy like policy-42.1.9-1.el10.noarch, it's better to restore the SELinux label of crypttab file. Fixes: 4e0d4cae ("Add kdumpctl setup-crypttab subcommand") Signed-off-by: Coiby Xu <coxu@redhat.com> |
||
|---|---|---|
| spec | ||
| tests | ||
| .editorconfig | ||
| .gitignore | ||
| 60-fadump.install | ||
| 60-kdump.install | ||
| 92-crashkernel.install | ||
| 98-kexec.rules | ||
| 98-kexec.rules.ppc64 | ||
| 99-kdump.conf | ||
| crashkernel-howto.txt | ||
| dracut-early-kdump-module-setup.sh | ||
| dracut-early-kdump.sh | ||
| dracut-fadump-init-fadump.sh | ||
| dracut-fadump-module-setup.sh | ||
| dracut-kdump-capture.service | ||
| dracut-kdump-emergency.service | ||
| dracut-kdump-emergency.target | ||
| dracut-kdump.sh | ||
| dracut-kexec-crypt-setup.sh | ||
| dracut-module-setup.sh | ||
| dracut-monitor_dd_progress | ||
| early-kdump-howto.txt | ||
| fadump-howto.txt | ||
| gating.yaml | ||
| gen-kdump-conf.sh | ||
| kdump-dep-generator.sh | ||
| kdump-in-cluster-environment.txt | ||
| kdump-lib-initramfs.sh | ||
| kdump-lib.sh | ||
| kdump-logger.sh | ||
| kdump-migrate-action.sh | ||
| kdump-restart.sh | ||
| kdump-udev-throttler | ||
| kdump.conf.5 | ||
| kdump.service | ||
| kdump.sysconfig | ||
| kdump.sysconfig.aarch64 | ||
| kdump.sysconfig.i386 | ||
| kdump.sysconfig.ppc64 | ||
| kdump.sysconfig.ppc64le | ||
| kdump.sysconfig.s390x | ||
| kdump.sysconfig.x86_64 | ||
| kdumpctl | ||
| kdumpctl.8 | ||
| kexec_file-add-kexec_file-flag-to-support-debug-prin.patch | ||
| kexec-kdump-howto.txt | ||
| kexec-tools.spec | ||
| kexec-update-manpage-with-explicit-mention-of-clean-.patch | ||
| live-image-kdump-howto.txt | ||
| mkdumprd | ||
| mkdumprd.8 | ||
| mkfadumprd | ||
| README | ||
| sources | ||
| supported-kdump-targets.txt | ||
| zanata-notes.txt | ||
Adding a patch to kexec-tools ============================= There is a mailing list kexec@lists.fedoraproject.org where all the dicussion related to fedora kexec-tools happen. All the patches are posted there for inclusion and committed to kexec-tools after review. So if you want your patches to be included in fedora kexec-tools package, post these to kexec@lists.fedoraproject.org. One can subscribe to list and browse through archives here. https://admin.fedoraproject.org/mailman/listinfo/kexec