cluster: make SELinux and THP check auto-fixes work on non-RHEL hosts#2712
Open
yahonda wants to merge 2 commits into
Open
cluster: make SELinux and THP check auto-fixes work on non-RHEL hosts#2712yahonda wants to merge 2 commits into
yahonda wants to merge 2 commits into
Conversation
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ti-chi-bot
Bot
added
the
size/S
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #2712 +/- ##
==========================================
- Coverage 42.32% 42.29% -0.03%
==========================================
Files 424 424
Lines 47146 47146
==========================================
- Hits 19951 19938 -13
- Misses 24496 24509 +13
Partials 2699 2699 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
yahonda
changed the title
pingcap#2496 added a getenforce-based SELinux status probe in addition to the config-file check. On hosts without the SELinux userspace tools (most Debian/Ubuntu systems, including the integration-test containers), getenforce is missing, so CheckSELinuxStatus failed. With --apply that failed check triggers the SELinux fix, which runs sed -i 's/.../' /etc/selinux/config && setenforce 0 but /etc/selinux/config does not exist on those hosts, so the command errors with 'sed: can't read /etc/selinux/config: No such file or directory' and the whole check/apply run aborts. This breaks the cluster and dm integration tests on master. Treat a getenforce execution error as 'SELinux disabled' (the host has no SELinux), matching the lenient pre-pingcap#2496 behavior, instead of a failure. Enforcing still fails and Permissive still warns. The configuration is still validated independently by CheckSELinuxConf. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
pingcap#2498 added a persistent THP disable via grubby --update-kernel=ALL --args="transparent_hugepage=never" to the THP check auto-fix. grubby is a RHEL-family tool and is not present on Debian/Ubuntu (including the integration-test containers), so with --apply the fix aborts with 'grubby: command not found' (exit 127) and the whole check/apply run fails. Guard the grubby invocation with 'command -v grubby' so the persistent kernel argument is still set where grubby exists, but is skipped on hosts without it. The runtime THP setting (echo never > .../enabled) still applies everywhere. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
yahonda
force-pushed
the
fix/selinux-status-check-no-getenforce
branch
from
48f3e74 to
e976f74
Compare
Member
Author
|
CI is green now. |
13 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What problem does this PR solve?
Two recently-merged checks added auto-fix commands that assume a RHEL-family host. They break
tiup cluster check --apply(and thecluster/dmintegration tests) on Debian/Ubuntu, where the assumed tools/files don't exist. Both currently fail onmaster.SELinux status check (cluster: check both SELinux status and config #2496).
CheckSELinuxStatusrunsgetenforce. On hosts without the SELinux userspace tools (most Debian/Ubuntu, including the CI containers) the command is missing, so the check is reported as Fail. With--applythat triggers the SELinux fix:but
/etc/selinux/configdoesn't exist there →sed: can't read /etc/selinux/config: No such file or directory→ the run aborts.THP check (cluster: Persistently disable THP #2498). The THP auto-fix was extended with:
grubby --update-kernel=ALL --args="transparent_hugepage=never"grubbyis a RHEL-family tool and is absent on Debian/Ubuntu →grubby: command not found(exit 127) → the run aborts.What is changed and how it works?
CheckSELinuxStatus: treat agetenforceexecution error (binary absent → SELinux not installed/enforcing) as disabled rather than a failure, restoring the lenient pre-cluster: check both SELinux status and config #2496 behavior.Enforcingstill fails andPermissivestill warns. The configuration is still validated independently byCheckSELinuxConf.grubbycall withcommand -v grubbyso the persistent kernel argument is set wheregrubbyexists, but skipped on hosts without it. The runtime setting (echo never > .../enabled) still applies everywhere.Together these make the SELinux and THP checks Debian/non-RHEL safe and unblock the cluster/dm integration tests.
Check List
go test ./pkg/cluster/operation/... ./pkg/cluster/manager/...)Side effects
Related changes