Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-90842

[BZ#2365614] setroubleshoot-server: call systemctl instead of /sbin/service in scriptlets

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • setroubleshoot-3.3.35-3.el10
    • No
    • Moderate
    • 1
    • rhel-security-selinux
    • ssg_security
    • 13
    • 2
    • QE ack
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • SELINUX 250604: 7
    • Enhancement
    • Hide
      .`setroubleshoot-server` no longer requires initscripts

      Before this update, the `%post` and `%postun` scriptlets for the `setroubleshoot-server` SELinux diagnostic tool called `/sbin/service`. With this update, the scriptlets now directly call `auditctl` for reloading the `auditd` service, and bypass the use of `/sbin/service`. This enhancement simplifies the dependency structure and streamlines the execution of the scriptlets.
      Show
      .`setroubleshoot-server` no longer requires initscripts Before this update, the `%post` and `%postun` scriptlets for the `setroubleshoot-server` SELinux diagnostic tool called `/sbin/service`. With this update, the scriptlets now directly call `auditctl` for reloading the `auditd` service, and bypass the use of `/sbin/service`. This enhancement simplifies the dependency structure and streamlines the execution of the scriptlets.
    • Done
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      0) commit ea0d9634 ("Update scriptlets to reload auditd service") made the %post and %postun scriptlets for setroubleshoot-server call /sbin/service.

      1) commit 2c88c3ce ("Require initscripts-service - /sbin/service") added a dependency on /sbin/service in setroubleshoot.spec.

      2) However, if my reading of /sbin/service is correct, calling
      /sbin/service auditd reload

      is currently equivalent to calling
      /bin/systemctl reload auditd.service

      This suggests that the scriptlets could call systemctl directly and that the dependency on /sbin/service could be dropped.

      3) I'm happy to open a pull-request for the trivial change to accomplish this. But I don't have setroubleshoot-server installed and have no clue how to test this change. So that pull request will be of little value.

              rhn-engineering-plautrba Petr Lautrbach
              jira-bugzilla-migration RH Bugzilla Integration
              Unassigned Unassigned
              Milos Malik Milos Malik
              Jan Fiala Jan Fiala
              Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

                Created:
                Updated: