[Community fork] Honor semanage fcontext equivalences when labeling GitLab paths (EL10)

Adam Churequested to merge
gitlab-community/gitlab-org/omnibus-gitlab:ramereth/9940-selinux-fcontext-equivalence-el10 into master

What does this MR do and why?

This is a re-submission of !9517 (closed), authored by @ramereth (Lance Albertson), opened from the community fork (https://gitlab.com/gitlab-community/gitlab-org/omnibus-gitlab) because that fork could not be rebased against origin/master, so the change had to be moved there and re-opened against canonical master from here instead of the original branch.

Original problem: on AlmaLinux/RHEL/CentOS Stream 10, gitlab-ctl reconfigure aborts in gitlab::selinux:

bash[Set proper security context on ssh files for selinux] (gitlab::selinux line 88) had an error
STDERR: ValueError: File spec /var/opt/gitlab/.ssh(/.*)? conflicts with equivalency rule
'/var/opt /opt'; Try adding '/opt/gitlab/.ssh(/.*)?' instead

EL10's selinux-policy ships a /var/opt = /opt file-context equivalency in file_contexts.subs_dist. semanage refuses to register an fcontext spec that falls under an equivalency source, so SELinuxHelper.commands fails on the first semanage fcontext -a -t gitlab_shell_t '/var/opt/gitlab/.ssh(/.*)?'. context_set? also looked for the literal /var/opt/gitlab/... patterns, which can never be registered on EL10, so the step could neither succeed nor be detected as already done, and ran (and failed) on every reconfigure.

Fix: SELinuxHelper now honors semanage equivalencies:

  • Parses the equivalence pairs from semanage fcontext -l.
  • When a GitLab path falls under an equivalency source, registers and checks the substituted (target) path (e.g. /opt/gitlab/.ssh(/.*)?), exactly what semanage's own error message suggests.
  • restorecon still runs against the real on-disk path; the equivalency makes the label apply there.
  • On distros without the equivalency (EL8/EL9), the parsed list never matches the GitLab paths, so generated commands are unchanged.

Closes #9940 (closed).

Attribution

All credit for this fix goes to @ramereth. Original merge request: !9517 (closed) (commit c8ef5464a2f51b623b34f0928188265566568529). Commit metadata (author name/email) has been preserved to reflect the original authorship. The change itself is unmodified from the original; only its route to master differs, via the community fork, because that fork's branch could not be rebased against origin/master.

Testing

bundle exec rspec spec/chef/cookbooks/package/libraries/helpers/selinux_helper_spec.rb per the original MR: 24 examples, 0 failures.

Checklist

  • Tests added for new functionality (carried over from original MR)
  • Existing tests still pass
  • Documentation (no user-facing config change)

Merge request reports