Enforce SELinux in acceptance tests

[ekohl]

This attempts to unify SELinux handling in the tests. It moves the package installation to the acceptance spec helper to reduce duplication. It then makes the set_apache_defaults line idempotent and restorecon_apache correctly chained. This works around PUP-10548 which is that Puppet doesn't reload file contexts within a run. That means it must first create the file(s) and then run restorecon to get correct contexts.

I'm not entirely sure if this will work.

[github-actions]

This PR has been marked as stale because it has been open for a while and has had no recent activity. If this PR is still important to you please drop a comment below and we will add this to our backlog to complete. Otherwise, it will be closed in 7 days.

[david22swan]

@ekohl Apologies for the late review.
Anyway this look's like a good change to me but was wondering if you had more work that you intended to add to it as it has been left a draft?

[ekohl]

I'm unable to run tests locally, so I pushed this to see the results. They are red but rotated by now. I'll rebase to see if that's still the case.

[github-actions]

Hello! 👋

This pull request has been open for a while and has had no recent activity. We've labelled it with attention-needed so that we can get a clear view of which PRs need our attention.

If you are waiting on a response from us we will try and address your comments on a future Community Day.

Alternatively, if it is no longer relevant to you please close the PR with a comment.

Please note that if a pull request receives no update for 7 after it has been labelled, it will be closed. We are always happy to re-open pull request if they have been closed in error.

[ekohl]

I've rebased it and split it into two commits. First one that cleans things up (which I think should already be good to merge), then one that makes it enforcing. If the enforcing one fails and we can't quickly figure out why it fails I think we should merge the first commit for now.

[david22swan]

@ekohl Look's like your getting some failures across the Redhat OSs
Though they don't look fully consistent, some variance across the failures

[ekohl]

To properly debug this I need the logs from /var/log/audit to see the real AVCs. What would be the best way to retrieve those if I can't run the tests locally?

[david22swan]

There's not really an easy answer for that. Since the environment is cleaned up at the end of every run, the machines and any log's are all wiped from existence.

Off the top of my head, you could comment out the unnecessary test's and then add a run_shell command after the failing one's that cat's said log, allowing you to see it.

If that doesn't work, you could disable the cleanup and I could manually retrieve the log's for you. We would need to coordinate though.

[github-actions]

Hello! 👋

This pull request has been open for a while and has had no recent activity. We've labelled it with attention-needed so that we can get a clear view of which PRs need our attention.

If you are waiting on a response from us we will try and address your comments on a future Community Day.

Alternatively, if it is no longer relevant to you please close the PR with a comment.

Please note that if a pull request receives no update for 7 after it has been labelled, it will be closed. We are always happy to re-open pull request if they have been closed in error.

[ekohl]

I split off #2320 which at least cleans some things up. Let's try to get that merged since I don't have time to finish this for now.

[github-actions]

Hello! 👋

This pull request has been open for a while and has had no recent activity. We've labelled it with attention-needed so that we can get a clear view of which PRs need our attention.

If you are waiting on a response from us we will try and address your comments on a future Community Day.

Alternatively, if it is no longer relevant to you please close the PR with a comment.

Please note that if a pull request receives no update for 7 after it has been labelled, it will be closed. We are always happy to re-open pull request if they have been closed in error.

[ekohl]

Rebased to resolve conflicts. Includes #2320 so that should be merged first.

[david22swan]

@ekohl Hey, sorry to bother but just checking in on how this is proceeding so I can update our records?

[ekohl]

@david22swan I need to do some work on this, but I really struggle to find the time for it. Luckily all the preparation work went in, so I'll rebase this to show that.

[LukasAud]

Hey @ekohl, are you still interested in working on this project? Perhaps this PR should be closed until work is resumed. Mostly to avoid stale PRs.

[ekohl]

I don't have time for it right now. Perhaps convert it to an issue so it isn't lost?