diff --git a/changelog/66779.fixed.md b/changelog/66779.fixed.md new file mode 100644 index 000000000000..04d96003f255 --- /dev/null +++ b/changelog/66779.fixed.md @@ -0,0 +1 @@ +Fix the SELinux context for Salt Minion service to "unconfined_t" diff --git a/pkg/common/salt-minion.service b/pkg/common/salt-minion.service index 69aff18c5835..696d0263c39a 100644 --- a/pkg/common/salt-minion.service +++ b/pkg/common/salt-minion.service @@ -9,6 +9,7 @@ Type=notify NotifyAccess=all LimitNOFILE=8192 ExecStart=/usr/bin/salt-minion +SELinuxContext=system_u:system_r:unconfined_t:s0 [Install] WantedBy=multi-user.target diff --git a/pkg/old/deb/salt-minion.service b/pkg/old/deb/salt-minion.service index 7e6cf1465495..b0ad82c13347 100644 --- a/pkg/old/deb/salt-minion.service +++ b/pkg/old/deb/salt-minion.service @@ -8,6 +8,7 @@ KillMode=process NotifyAccess=all LimitNOFILE=8192 ExecStart=/usr/bin/salt-minion +SELinuxContext=system_u:system_r:unconfined_t:s0 [Install] WantedBy=multi-user.target diff --git a/pkg/old/suse/salt-minion.service b/pkg/old/suse/salt-minion.service index 12f28314cb1b..b99ef063522a 100644 --- a/pkg/old/suse/salt-minion.service +++ b/pkg/old/suse/salt-minion.service @@ -10,6 +10,7 @@ ExecStart=/usr/bin/salt-minion KillMode=process Restart=on-failure RestartSec=15 +SELinuxContext=system_u:system_r:unconfined_t:s0 [Install] WantedBy=multi-user.target diff --git a/pkg/old/suse/salt-minion.service.rhel7 b/pkg/old/suse/salt-minion.service.rhel7 index 691726771400..92cc66d32f44 100644 --- a/pkg/old/suse/salt-minion.service.rhel7 +++ b/pkg/old/suse/salt-minion.service.rhel7 @@ -9,6 +9,7 @@ ExecStart=/usr/bin/salt-minion KillMode=process Restart=on-failure RestartSec=15 +SELinuxContext=system_u:system_r:unconfined_t:s0 [Install] WantedBy=multi-user.target diff --git a/tests/pytests/pkg/integration/test_systemd_config.py b/tests/pytests/pkg/integration/test_systemd_config.py index 828e4413ad77..14c292705874 100644 --- a/tests/pytests/pkg/integration/test_systemd_config.py +++ b/tests/pytests/pkg/integration/test_systemd_config.py @@ -43,3 +43,18 @@ def test_system_config(grains): "systemctl show -p ${config} salt-minion.service", shell=True ) assert ret == expected_retcode + + +@pytest.mark.usefixtures("salt_minion") +def test_systemd_selinux_config(grains): + """ + Test systemd selinux config + """ + if grains["init"] == "systemd": + ret = subprocess.run( + "systemctl show -p SELinuxContext salt-minion.service", + shell=True, + check=False, + capture_output=True, + ) + assert "system_u:system_r:unconfined_t:s0" in ret.stdout.decode()