Issues during installation of rsyslog example role on fedora 28

[linux-system-roles]

Issues during installation of rsyslog example role on fedora 28

[richm]

The problem was that the package was missing when running the role. When I manually installed it is was available in Fedora repo. So we probably need to add it to the packages list to install no?

Ok, but that is a workaround, not a fix. The fix is to identify the package that depends on it, and update the Requires in the rpm spec for that package, so that libselinux-python is properly pulled in.

[nhosoi]

Regarding 1:
I already had libselinux-python on my test host, which is needed by multiple packages [1]. I forced to remove libselinux-python, then I could reproduce the problem. If I add libselinux-python in rsyslog__base_packages as in [2], we won't run into the failure. But I have an impression there could be more appropriate package(s) to be there which would install all the necessary packages including 'libselinux-python'... Do you have any good idea for such candidates? For instance, libselinux-python has these direct dependencies in my test env... [3]

# rpm -q libselinux-python
libselinux-python-2.5-14.1.el7.x86_64

[1]

# rpm -e libselinux-python
error: Failed dependencies:
    libselinux-python is needed by (installed) openshift-ansible-3.9.1-1.git.0.f99af1f.el7.centos.noarch
    libselinux-python is needed by (installed) python-slip-0.4.0-4.el7.noarch
    libselinux-python >= 2.1.5-1 is needed by (installed) setroubleshoot-server-3.2.29-3.el7.x86_64
    libselinux-python is needed by (installed) anaconda-core-21.48.22.134-1.el7.centos.x86_64
    libselinux-python is needed by (installed) policycoreutils-python-2.5-29.el7.x86_64

[2]

# diff --git a/roles/rsyslog/defaults/main.yaml b/roles/rsyslog/defaults/main.yaml
index c91694e..fcbefed 100644
--- a/roles/rsyslog/defaults/main.yaml
+++ b/roles/rsyslog/defaults/main.yaml
@@ -61,7 +61,7 @@ rsyslog__message_reduction: False
 # .. envvar:: rsyslog__base_packages
 #
 # List of default rpm packages to install.
-rsyslog__base_packages: [ 'rsyslog' ]
+rsyslog__base_packages: [ 'rsyslog', 'libselinux-python' ]
 
 # .. envvar:: rsyslog__logging_packages
 #

[3]

# rpm -e libselinux-python
error: Failed dependencies:
    libselinux-python is needed by (installed) openshift-ansible-3.9.1-1.git.0.f99af1f.el7.centos.noarch
    libselinux-python is needed by (installed) python-slip-0.4.0-4.el7.noarch
    libselinux-python is needed by (installed) anaconda-core-21.48.22.134-1.el7.centos.x86_64
    libselinux-python is needed by (installed) policycoreutils-python-2.5-29.el7.x86_64
    libselinux-python >= 2.1.5-1 is needed by (installed) setroubleshoot-server-3.2.30-3.el7.x86_64

[nhosoi]

@sradco, could you take a look at #20 ?
Thanks!

[sradco]

Regarding 1:
I already had libselinux-python on my test host, which is needed by multiple packages [1]. I forced to remove libselinux-python, then I could reproduce the problem. If I add libselinux-python in rsyslog__base_packages as in [2], we won't run into the failure. But I have an impression there could be more appropriate package(s) to be there which would install all the necessary packages including 'libselinux-python'... Do you have any good idea for such candidates? For instance, libselinux-python has these direct dependencies in my test env... [3]

# rpm -q libselinux-python
libselinux-python-2.5-14.1.el7.x86_64

[1]

# rpm -e libselinux-python
error: Failed dependencies:
    libselinux-python is needed by (installed) openshift-ansible-3.9.1-1.git.0.f99af1f.el7.centos.noarch
    libselinux-python is needed by (installed) python-slip-0.4.0-4.el7.noarch
    libselinux-python >= 2.1.5-1 is needed by (installed) setroubleshoot-server-3.2.29-3.el7.x86_64
    libselinux-python is needed by (installed) anaconda-core-21.48.22.134-1.el7.centos.x86_64
    libselinux-python is needed by (installed) policycoreutils-python-2.5-29.el7.x86_64

[2]

# diff --git a/roles/rsyslog/defaults/main.yaml b/roles/rsyslog/defaults/main.yaml
index c91694e..fcbefed 100644
--- a/roles/rsyslog/defaults/main.yaml
+++ b/roles/rsyslog/defaults/main.yaml
@@ -61,7 +61,7 @@ rsyslog__message_reduction: False
 # .. envvar:: rsyslog__base_packages
 #
 # List of default rpm packages to install.
-rsyslog__base_packages: [ 'rsyslog' ]
+rsyslog__base_packages: [ 'rsyslog', 'libselinux-python' ]
 
 # .. envvar:: rsyslog__logging_packages
 #

[3]

# rpm -e libselinux-python
error: Failed dependencies:
    libselinux-python is needed by (installed) openshift-ansible-3.9.1-1.git.0.f99af1f.el7.centos.noarch
    libselinux-python is needed by (installed) python-slip-0.4.0-4.el7.noarch
    libselinux-python is needed by (installed) anaconda-core-21.48.22.134-1.el7.centos.x86_64
    libselinux-python is needed by (installed) policycoreutils-python-2.5-29.el7.x86_64
    libselinux-python >= 2.1.5-1 is needed by (installed) setroubleshoot-server-3.2.30-3.el7.x86_64

In Fedora the Fedora-28_updates repo includes this package , but we dont install it anywhere in the code ... I only needed to do yum install libselinux-python to get it.

@nhosoi

[richm]

I don't understand what the problem is. We don't have any direct dependencies on libselinux-python. If anything, it is a dependency of ansible, the selinux module perhaps. A bug should be opened against Fedora 28 ansible or maybe ansible-selinux if there is a separate package for the selinux functionality in ansible.

[sradco]

The problem was that the package was missing when running the role. When I manually installed it is was available in Fedora repo. So we probably need to add it to the packages list to install no?
@richm

[nhosoi]

Ok, but that is a workaround, not a fix.

Let me confirm...
ToDo: We should revert this patch and find out the package which requires libselinux-python, then file a bug against the package. Correct?

commit a6c10abb26c2146bc1cebec4cc99734c96db63e6
    Adding 'libselinux-python' to rsyslog__base_packages to avoid the installation
    failure due to the missing package.  But still not clear this is the right
    package to be in the list.

[richm]

ToDo: We should revert this patch and find out the package which requires libselinux-python, then file a bug against the package. Correct?

Correct, although we may have to leave the libselinux-python in the list until we can fix the problem with the package.

[nhosoi]

@richm ,
Sadly, it's already done in bz and it was closed with NOTABUG... :(
https://bugzilla.redhat.com/show_bug.cgi?id=1505083#c3
(and we could find lots of "issues" in the ansible github...)
For us, it'd be safer to have it in rsyslog_base_packages...?

[richm]

I don't understand the reasoning in the bz, but ok - let's just add the package in rsyslog_base_packages

[nhosoi]

@sradco, can we consider this "issue" was solved in pr/#20?