customizations/subscription: conditionally enable semanage call (HMS-8866) by croissanne · Pull Request #1673 · osbuild/image-builder

croissanne · 2025-07-18T16:04:16Z

Only set rhcd_t to permissive on rhel 9 and 10. The selinux domain (or process type) is
missing on rhel 8.

todo?

needs a distro test somehow

supakeen · 2025-07-19T06:45:38Z

I still don't feel this has to be passed through the options; why can't it be part of the RHSMConfig already contained in ImageConfig? The options to me feel like they only set the subscription status; not how we set it? If it doesn't fit in the ImageConfig.RHSMConfig (I see that that gets merged with blueprint) then a single new property in ImageConfig would suffice too (or if you wish, the entire script to be executed can be in there too).

Why does it have to be an option? I really thought those were for specific builds, not for things that always affect a certain image type.

croissanne · 2025-07-24T14:29:17Z

I still don't feel this has to be passed through the options; why can't it be part of the RHSMConfig already contained in ImageConfig? The options to me feel like they only set the subscription status; not how we set it? If it doesn't fit in the ImageConfig.RHSMConfig (I see that that gets merged with blueprint) then a single new property in ImageConfig would suffice too (or if you wish, the entire script to be executed can be in there too).

Why does it have to be an option? I really thought those were for specific builds, not for things that always affect a certain image type.

While I think it's a good convo to have, as it is a bit confusing to have RHSMConfig on the one hand, and ImageOptions.Subscription on the other, and subscription does behave more like a customization. Can we do this merging after the bug is resolved?

supakeen

Am I missing something or is the GitHub interface being weird again? This should've changed image checksums right? Since we now have different stage options to the systemd stage?

Right now it seems that this PR changes nothing (to the images being created) while its intent is to write a different service file on RHEL 8.

mvo5

Thank you, code looks fine, I have one naming suggestion (and/or we could import the existing code for this but its probably weird).

One meta-question, the commit message is a bit short on why we need to set rhc permissive and what prompts us to do it now, am I missing something here or could we add maybe a little bit more context why this is needed (and why we are doing it now, rhel9 is out since a while)? Happy to approve if its time critical but if not maybe we could add append a bit more background?

schutzbot · 2025-07-28T08:49:43Z

A previous version of this PR changed the images API or behaviour causing integration issues with osbuild-composer.
This is now fixed.

croissanne · 2025-07-28T08:58:58Z

Thank you, code looks fine, I have one naming suggestion (and/or we could import the existing code for this but its probably weird).

One meta-question, the commit message is a bit short on why we need to set rhc permissive and what prompts us to do it now, am I missing something here or could we add maybe a little bit more context why this is needed (and why we are doing it now, rhel9 is out since a while)? Happy to approve if its time critical but if not maybe we could add append a bit more background?

added a bit more context in the commit message. lmk if more is needed.

mvo5

Thank you! Love the new commit message! It answers all my questions :)

supakeen · 2025-07-28T09:17:06Z

There are many calls to common.FromPtr but it doesn't exist in this PR?

croissanne · 2025-07-28T09:57:32Z

There are many calls to common.FromPtr but it doesn't exist in this PR?

oh woops, forgot to update the 2nd commit

Derefs a pointer, if the pointer is nil returns the default value.

On rhel 9 and 10 rhc's selinux policy is set managed in the post-install script of the rpm. In the post-install script rhcd_t is set to permissive. As osbuild executes all builds in a bubblewrap container, selinux is not seen as enabled, and the semanage call has no effect. This is why rhcd_t is set to permissive in the registration script, where semange would be effective, as it is executed on the (non-container) host. On rhel 8 the rhcd_t domain is missing, and thus cannot be set to permissive. Thus only set rhcd_t to permissive on rhel 9 and 10. This only applies when a subscription is set in the ImageOptions, and will determine whether or not `semanage permissive --add rhcd_t` is added to the subscription script.

achilleas-k

Very nice!

tag v0.165.0 Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> Changes with 0.165.0 ---------------- * distro: move rhel9 into a generic distro (osbuild/image-builder#1645) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * Revert "distro: drop `ImageType.BasePartitionTable()`" (osbuild/image-builder#1691) * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza * Update dependencies 2025-07-20 (osbuild/image-builder#1675) * Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger * defs: add missing `bootstrap_containers` (osbuild/image-builder#1679) * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza * disk: handle adding `PReP` partition on PPC64/s390x (HMS-8884) (osbuild/image-builder#1681) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * distro: bring per-distro checkOptions back (osbuild/image-builder#1678) * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza * distro: cleanups in the pkg/distro/generic area (osbuild/image-builder#1686) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * distro: move rhel8 into a generic distro (osbuild/image-builder#1643) * Author: Michael Vogt, Reviewers: Nobody * distro: small followups for PR#1682 (osbuild/image-builder#1689) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger, Tomáš Hozza * distro: unify transform/match into a single concept (osbuild/image-builder#1682) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Tomáš Hozza * distros: de-duplicate runner build packages for centos10 (osbuild/image-builder#1680) * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza * github: disable Go dep updates through dependabot (osbuild/image-builder#1683) * Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza * repos: include almalinux 9.6 (osbuild/image-builder#1677) * Author: Simon de Vlieger, Reviewers: Lukáš Zapletal, Tomáš Hozza * rhel9: wsl distribution config (osbuild/image-builder#1694) * Author: Simon de Vlieger, Reviewers: Michael Vogt, Sanne Raymaekers * test/manifests/all-customizations: don't embed local file via URI (osbuild/image-builder#1684) * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Brian C. Lane — Somewhere on the Internet, 2025-07-28 --- tag v0.166.0 Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> Changes with 0.166.0 ---------------- * customizations/subscription: conditionally enable semanage call (HMS-8866) (osbuild/image-builder#1673) * Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Michael Vogt * distro/rhel-10: versionlock shim-x64 in the azure-cvm image (osbuild/image-builder#1697) * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Simon de Vlieger * manifestmock: move container/pkg/commit mocks into helper (osbuild/image-builder#1700) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * rhel9: `vagrant-libvirt`, `vagrant-virtualbox` (osbuild/image-builder#1693) * Author: Simon de Vlieger, Reviewers: Michael Vogt, Sanne Raymaekers * rhel{9,10}: centos WSL refinement (HMS-8922) (osbuild/image-builder#1690) * Author: Simon de Vlieger, Reviewers: Ondřej Budai, Sanne Raymaekers, Tomáš Hozza — Somewhere on the Internet, 2025-07-29 --- tag v0.167.0 Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> Changes with 0.167.0 ---------------- * RHEL/Azure: drop obsolete WAAgentConfig keys [RHEL-93894] and remove loglevel kernel option [RHEL-102372] (osbuild/image-builder#1611) * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Ondřej Budai, Sanne Raymaekers * Update dependencies 2025-07-27 (osbuild/image-builder#1699) * Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger * distro/rhel9: set default_kernel to kernel-uki-virt (osbuild/image-builder#1704) * Author: Achilleas Koutsou, Reviewers: Ondřej Budai, Simon de Vlieger * distro: drop legacy loaders and update tests (osbuild/image-builder#1687) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Tomáš Hozza * distro: fix issues with yaml distro definitions and enable yaml checks (osbuild/image-builder#1702) * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Ondřej Budai, Simon de Vlieger — Somewhere on the Internet, 2025-07-30 ---

tag v0.165.0 Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> Changes with 0.165.0 ---------------- * distro: move rhel9 into a generic distro (osbuild/image-builder#1645) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * Revert "distro: drop `ImageType.BasePartitionTable()`" (osbuild/image-builder#1691) * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza * Update dependencies 2025-07-20 (osbuild/image-builder#1675) * Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger * defs: add missing `bootstrap_containers` (osbuild/image-builder#1679) * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza * disk: handle adding `PReP` partition on PPC64/s390x (HMS-8884) (osbuild/image-builder#1681) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * distro: bring per-distro checkOptions back (osbuild/image-builder#1678) * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza * distro: cleanups in the pkg/distro/generic area (osbuild/image-builder#1686) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * distro: move rhel8 into a generic distro (osbuild/image-builder#1643) * Author: Michael Vogt, Reviewers: Nobody * distro: small followups for PR#1682 (osbuild/image-builder#1689) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger, Tomáš Hozza * distro: unify transform/match into a single concept (osbuild/image-builder#1682) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Tomáš Hozza * distros: de-duplicate runner build packages for centos10 (osbuild/image-builder#1680) * Author: Michael Vogt, Reviewers: Simon de Vlieger, Tomáš Hozza * github: disable Go dep updates through dependabot (osbuild/image-builder#1683) * Author: Achilleas Koutsou, Reviewers: Simon de Vlieger, Tomáš Hozza * repos: include almalinux 9.6 (osbuild/image-builder#1677) * Author: Simon de Vlieger, Reviewers: Lukáš Zapletal, Tomáš Hozza * rhel9: wsl distribution config (osbuild/image-builder#1694) * Author: Simon de Vlieger, Reviewers: Michael Vogt, Sanne Raymaekers * test/manifests/all-customizations: don't embed local file via URI (osbuild/image-builder#1684) * Author: Tomáš Hozza, Reviewers: Achilleas Koutsou, Brian C. Lane — Somewhere on the Internet, 2025-07-28 --- tag v0.166.0 Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> Changes with 0.166.0 ---------------- * customizations/subscription: conditionally enable semanage call (HMS-8866) (osbuild/image-builder#1673) * Author: Sanne Raymaekers, Reviewers: Achilleas Koutsou, Michael Vogt * distro/rhel-10: versionlock shim-x64 in the azure-cvm image (osbuild/image-builder#1697) * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Simon de Vlieger * manifestmock: move container/pkg/commit mocks into helper (osbuild/image-builder#1700) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * rhel9: `vagrant-libvirt`, `vagrant-virtualbox` (osbuild/image-builder#1693) * Author: Simon de Vlieger, Reviewers: Michael Vogt, Sanne Raymaekers * rhel{9,10}: centos WSL refinement (HMS-8922) (osbuild/image-builder#1690) * Author: Simon de Vlieger, Reviewers: Ondřej Budai, Sanne Raymaekers, Tomáš Hozza — Somewhere on the Internet, 2025-07-29 --- tag v0.167.0 Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> Changes with 0.167.0 ---------------- * RHEL/Azure: drop obsolete WAAgentConfig keys [RHEL-93894] and remove loglevel kernel option [RHEL-102372] (osbuild/image-builder#1611) * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Ondřej Budai, Sanne Raymaekers * Update dependencies 2025-07-27 (osbuild/image-builder#1699) * Author: SchutzBot, Reviewers: Achilleas Koutsou, Simon de Vlieger * distro/rhel9: set default_kernel to kernel-uki-virt (osbuild/image-builder#1704) * Author: Achilleas Koutsou, Reviewers: Ondřej Budai, Simon de Vlieger * distro: drop legacy loaders and update tests (osbuild/image-builder#1687) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Tomáš Hozza * distro: fix issues with yaml distro definitions and enable yaml checks (osbuild/image-builder#1702) * Author: Achilleas Koutsou, Reviewers: Michael Vogt, Ondřej Budai, Simon de Vlieger — Somewhere on the Internet, 2025-07-30 --- tag v0.168.0 Tagger: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> Changes with 0.168.0 ---------------- * distro: fix bug in variable substitution for static distros (osbuild/image-builder#1710) * Author: Michael Vogt, Reviewers: Achilleas Koutsou, Simon de Vlieger * rhel{9,10}: azure for non-RHEL (HMS-8949) (osbuild/image-builder#1707) * Author: Simon de Vlieger, Reviewers: Achilleas Koutsou, Michael Vogt — Somewhere on the Internet, 2025-07-30 ---

croissanne changed the title ~~customizations/subscription: conditionally enable semanage call~~ customizations/subscription: conditionally enable semanage call (HMS-8866) Jul 18, 2025

lzap reviewed Jul 21, 2025

View reviewed changes

Comment thread pkg/customizations/subscription/subscription.go

croissanne force-pushed the subscriptions-semanage branch 3 times, most recently from 13b264c to 9844178 Compare July 25, 2025 14:15

croissanne marked this pull request as ready for review July 25, 2025 14:30

croissanne requested a review from a team as a code owner July 25, 2025 14:30

croissanne requested review from achilleas-k, supakeen and thozza July 25, 2025 14:30

lzap previously approved these changes Jul 25, 2025

View reviewed changes

supakeen reviewed Jul 25, 2025

View reviewed changes

mvo5 reviewed Jul 28, 2025

View reviewed changes

Comment thread internal/common/pointers.go Outdated

Comment thread internal/common/pointers.go Outdated

croissanne dismissed lzap’s stale review via 5eb956f July 28, 2025 08:43

croissanne force-pushed the subscriptions-semanage branch from 9844178 to 5eb956f Compare July 28, 2025 08:43

mvo5 previously approved these changes Jul 28, 2025

View reviewed changes

croissanne added 2 commits July 28, 2025 11:58

common: add ValueOrEmpty helper

875bae8

Derefs a pointer, if the pointer is nil returns the default value.

croissanne dismissed mvo5’s stale review via 41d5ec7 July 28, 2025 09:58

croissanne force-pushed the subscriptions-semanage branch from 5eb956f to 41d5ec7 Compare July 28, 2025 09:59

mvo5 approved these changes Jul 28, 2025

View reviewed changes

achilleas-k approved these changes Jul 28, 2025

View reviewed changes

achilleas-k added this pull request to the merge queue Jul 28, 2025

Merged via the queue into osbuild:main with commit de6472e Jul 28, 2025
22 checks passed

achilleas-k mentioned this pull request Jul 30, 2025

go.mod: update osbuild/images to v0.168.0 osbuild/osbuild-composer#4799

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

customizations/subscription: conditionally enable semanage call (HMS-8866)#1673

customizations/subscription: conditionally enable semanage call (HMS-8866)#1673
achilleas-k merged 2 commits into
osbuild:mainfrom
croissanne:subscriptions-semanage

croissanne commented Jul 18, 2025 •

edited

Loading

Uh oh!

supakeen commented Jul 19, 2025 •

edited

Loading

Uh oh!

Uh oh!

croissanne commented Jul 24, 2025

Uh oh!

supakeen left a comment •

edited

Loading

Uh oh!

mvo5 left a comment

Uh oh!

Uh oh!

Uh oh!

schutzbot commented Jul 28, 2025 •

edited

Loading

Uh oh!

croissanne commented Jul 28, 2025

Uh oh!

mvo5 left a comment

Uh oh!

supakeen commented Jul 28, 2025

Uh oh!

croissanne commented Jul 28, 2025

Uh oh!

achilleas-k left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

croissanne commented Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

supakeen commented Jul 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

croissanne commented Jul 24, 2025

Uh oh!

supakeen left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mvo5 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

schutzbot commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

croissanne commented Jul 28, 2025

Uh oh!

mvo5 left a comment

Choose a reason for hiding this comment

Uh oh!

supakeen commented Jul 28, 2025

Uh oh!

croissanne commented Jul 28, 2025

Uh oh!

achilleas-k left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

croissanne commented Jul 18, 2025 •

edited

Loading

supakeen commented Jul 19, 2025 •

edited

Loading

supakeen left a comment •

edited

Loading

schutzbot commented Jul 28, 2025 •

edited

Loading