Skip to content

Conversation

@craigcomstock
Copy link
Contributor

@craigcomstock craigcomstock commented Nov 4, 2025

  • Added ci/selinux-policy-check.sh to build CFEngine policy module against latest selinux-policy
  • Added fallback selinux script to label binaries as unconfined in case the cfengine-enterprise module fails to install

together
cfengine/buildscripts#2019
#5934

…nst latest selinux-policy

Also, added github workflow to run this periodically like a dependency upgrade.

Ideally we might also capture whether the policy builds, and if we can detect an incompatability between the previous and this version of selinux-policy, save it.

Also, we should just run this workflow when selinux-policy has a new release only, maybe a new tag (same thing?!)

Ticket: ENT-12980
Changelog: none
… the cfengine-enterprise module fails to install

In case the normal cfengine-enterprise policy module fails to install the scripts will run this new scripts to ensure that CFEngine can function even if SELinux is enforcing by labeling them as bin_t aka unconfined.

Ticket: ENT-12980
Changelog: title
@cf-bottom
Copy link

Thanks for submitting a pull request! Maybe @larsewi can review this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants