-
Notifications
You must be signed in to change notification settings - Fork 260
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
RKE2 install script appends additional fapolicyd rules every time it is run #6335
Comments
No backports necessary, as install script is served off master. |
Validated with single server install on the latest v1.27.16-rc4+rke2r1, re-ran the v1.27 installation, upgraded using the latest v1.28.12-rc4+rke2r1 which logs to stdout no fapolicyd changes, all confirmed by comparing the file before and after. $ cat /etc/os-release | grep -i pretty
$ sudo INSTALL_RKE2_VERSION=$VERSION INSTALL_RKE2_EXEC=server INSTALL_RKE2_METHOD=rpm INSTALL_RKE2_CHANNEL=testing ./install-rke2.sh
$ sudo cat /etc/fapolicyd/compiled.rules
$ VERSION=v1.28.12-rc4+rke2r1 //manually upgrading to try and get different behavior exposed
$ sudo cat /etc/fapolicyd/compiled.rules
$ sudo INSTALL_RKE2_VERSION=$VERSION INSTALL_RKE2_EXEC=server INSTALL_RKE2_METHOD=rpm INSTALL_RKE2_CHANNEL=testing ./install-rke2.sh
$ sudo cat /etc/fapolicyd/compiled.rules
|
from @bordenit in #6309
If fapolicyd is enabled, the install script appends duplicate rules every time it is run.
The install script should not duplicate the fapolicyd rules in the rules file if install.sh script is ran more than once. It should be unlikely that anyone would use this rules file for anything other than RKE2, as the naming of it is specifically for RKE2. This should be a total replacement and not an append.
The text was updated successfully, but these errors were encountered: