order of file contexts

[Heidistein]

Hi,
I am puzzling with an issue that the order of file-context entries matters, where the last has precedence.
Because environments are constant in flux it happened that contexts are added in the 'wrong' order. For example, I added an fcontext for /data/log/mysql before /data/log. The effect is that the /data/log/mysql directory is getting the wrong context.
If I manually change the ordering, the context is applied correctly.

The puzzle is how do I puppet-fix this correct. Is am thinking in the direction of an Exec[] which (reverse) sorts the file /etc/selinux/targeted/contexts/files/file_contexts.local. However, this feels dirty and wrong. Any sugestions?

[Heidistein]

I could make a pullrequest creating the following Exec in init.pp (is this the place?) and notify it from within the fcontext definition.

exec { 'sort_file_contexts':
  command => '/bin/sort -r -o /etc/selinux/targeted/contexts/files/file_contexts.local /etc/selinux/targeted/contexts/files/file_contexts.local',
  unless  => '/bin/sort -cr /etc/selinux/targeted/contexts/files/file_contexts.local',
  refreshonly => true,
}

[vinzent]

reading File Contexts Sort Ordering (FedoraProject) I would suspect that if you add them as regex /data/log/mysql(/.*)? and /data/log(/.*)? the order of adding the rules should not matter.

please be more specific what distribution and version you are using.

please provide a sample manifest with the 2 fcontext resources.

please describe who and what (puppet, manual, a daemon, ...) creates the directories with wrong selinux fcontext.

[vinzent]

there is an Redhat Bugzilla which seems to be related: https://bugzilla.redhat.com/show_bug.cgi?id=803846

[vinzent]

and another bugzilla with no solution: https://bugzilla.redhat.com/show_bug.cgi?id=678577

IMHO the "real" workaround for this problem would be to use a module with filecontext included.

[vinzent]

@Heidistein do you still think this module should fix the selinux bug/problem?

I think the selinux module way is the only real solution here.

[vinzent]

the behaviour is now documented in the README.md. Also no follow up comment from author within the last 11 days.