Resolve "Investigate including policycoreutils as a runtime dependency in order to be able to use semanage"

Closes #1485 (closed).

This change replaces chcon with semanage in the gitlab-shell recipe, which makes the fcontext change permanent and brings the setup more in line with current SELinux best practices. As a result, the security context shouldn't get messed up anymore.

The documentation and test descriptions have been updated to reflect the change.

This change requires policycoreutils-python as a runtime dependency. The sort of counterintuitively-named restorecon -R -v is necessary to apply the new ssh_home_t context.

The dependencies required are in the base repos for all supported RHEL flavors.

cc: @twk3

I've been testing the runtime dependency to try and ensure it won't cause issues with some of our packages.

So far I have tested CentOS 6 and 7, which have been fine. (Tested using the minimal install, sestatus reporting selinux enabled and enforced) Both needed to pull in the package.

Still need to test OpenSuSE and SLES 12

assigned to @twk3

Tested on OpenSuse 42.3, selinux is not included by default, and our runtime dependency is not listed in our package for this one. So this one is also looks fine.

Just SLES left.

Nice! Glad to hear it. Thanks for the updates, @twk3.

assigned to @baroncharlus

added 1 commit

• f6976d4f - applying selinux changes specifically to authorized_keys as well.

Compare with previous version

resolved all discussions

approved this merge request

changed milestone to %10.0

added Pick into Stable label

added Community Contribution SELinux labels

mentioned in commit 45abda5f

merged

Thanks for the contribution @baroncharlus . I've finished reviewing it today, and have merged it for our upcoming 10.0 release of GitLab.

mentioned in issue #1106

Awesome! Thanks @twk3!

Picked into 10-0-stable and 10-0-stable-ee, will go into 10.0 RC4.

removed Pick into Stable label

mentioned in commit 0f8825e9

mentioned in commit aafc910e

It doesn't look like policycoreutils-python is installed on RHEL6 by default and should be added to installation instructions at https://about.gitlab.com/installation/

mentioned in issue gitlab-com/www-gitlab-com#1671 (closed)