| We observe similar problems on Ubuntu 14.04 and 16.04 using Puppet 5.4.0. SELinux properties are set on every Puppet agent run for the .k5login files we manage. The output of a typical Puppet agent run looks like this:
Notice: /Stage[main]/Profile::K5login/K5login[/root/.k5login]/seluser: seluser changed to 'user_u' |
Notice: /Stage[main]/Profile::K5login/K5login[/root/.k5login]/selrole: selrole changed to 'object_r' |
Notice: /Stage[main]/Profile::K5login/K5login[/root/.k5login]/seltype: seltype changed to 'krb5_home_t' |
Notice: /Stage[main]/Profile::K5login/K5login[/root/.k5login]/selrange: selrange changed to 's0' |
Notice: Applied catalog in 22.20 seconds
|
We manage the .k5login files using a profile that looks like this:
class profile::k5login { |
$k5login_defaults = lookup('profile::k5login::k5login_defaults', Hash, 'deep', {}) |
$k5logins = lookup('profile::k5login::k5logins', Hash, 'deep', {}) |
create_resources('k5login', $k5logins, $k5login_defaults) |
}
|
We never set any SELinux-specific properties; in fact SELinux is not even active on our Ubuntu nodes. The output of ls -laZ /root/.k5login looks like this:
-rw-r--r-- 1 root root ? 21 Sep 4 19:10 /root/.k5login
|
Note the ? which means there are not security contexts active for the file. |
