<commit_before>CLIP for RHEL 6 Frequently Asked Questions

1. How do I roll an installation ISO?
   Run "make clip-rhel6-installation-iso"

2. What other things can I make?
   Run "make help"

3a. What is the default username and password for CLIP?
    The username is "clipuser" and the password is "<PASSWORD>".  You can 
    change this in the %post of the kickstart
    (./kickstarts/ciip-rhel6/clip-rhel6.ks).

3b. What is the default bootloader password for GRUB?
    The default password for GRUB is "<PASSWORD>".  You can change this in 
    the kickstart (./kickstarts/ciip-rhel6/clip-rhel6.ks).

4. How do I clone yum repos?
   Setup a machine that has all the appropriate yum repos in /etc/yum/repos.d.
   Ensure the yum-utils package is installed.  If it is a RHEL machine you must
   visit RHN and ensure the system is associated with the channel you wish to 
   clone.  Now run these commands changing the paths and repoids as
   appropriate.

   # reposync --norepopath -m -p /opt/rhel-6-2-x86_64/rhel-x86_64-server-6 --repoid=rhel-x86_64-server-6.2.z -l
   # createrepo -d -g /opt/rhel-6-2-x86_64/rhel-x86_64-server-6/comps.xml /opt/rhel-6-2-x86_64/rhel-x86_64-server-6/getPackage
   # reposync --norepopath -m -p /opt/rhel-6-2-x86_64/rhel-x86_64-server-optional-6 --repoid=rhel-x86_64-server-optional-6 -l
   # createrepo -d -g /opt/rhel-6-2-x86_64/rhel-x86_64-server-optional-6/getPackages/repodata/comps.xml /opt/rhel-6-2-x86_64/rhel-x86_64-server-optional-6/getPackage

5. Why do I get prompted for so many passwords the first time I login?
   The default user's password is immediately expired when the account is 
   created.  This means you have to login and choose a new password.

6a. How do I add a user?
   Use these commands (change <USERNAME> to the appropriate username): 
     # semanage user -a -R staff_r -R sysadm_r <USERNAME>_u
     # useradd -Z <USERNAME>_u -m <USERNAME> -G wheel
     # restorecon -RF /home/<USERNAME>
     # passwd foo
     # chage -d 0
   Note: The first command will have to be adjusted as appropriate to match the 
         defined SELinux roles. The restorecon is required due to a bug in
         useradd where it doesn't honor login mappings when creating and
         populating user home directories.

7b. Walk me through 5a again?
   CLIP for RHEL 6 uses user-based access controls in SELinux.  The first 
   command, semanage, adds an SELinux user facilitating this separation and
   provides a set of roles that user is authorized to assume.  The second 
   command, useradd, actually creates the account and binds the Linux user 
   ID to the SELinux user ID.  The third command is used to set the user's 
   password.  The fourth command causes the password to immediately expire 
   thus forcing the user to set a new password on their first login.

8. How do I become a privileged user?
   Use "sudo -s".  Make the user has a line in sudoers like this:
    echo "<USERNAME>        ALL=(ALL) ROLE=sysadm_r TYPE=sysadm_t      ALL" >> /etc/sudoers
   Note: You will have to adjust the ROLE and TYPE fields as appropriate. For
         example, ROLE=auditadm_r TYPE=auditadm_t. 

9. Why am I getting "permission denied" when adding a user?
   You probably removed user_u from your SELinux policy.  Due to a bug in
   useradd this SELinux user *must* be present.  CLIP uses SELinux constraints 
   to strip all access from that user ID so leaving it present isn't a real
   issue.

9. An EXCEPTION was thrown during the build.  What do I do?
   The likely culprit is an RPM that failed to roll properly. Open 
   ./repos/my-repo/build.log.  A good option for debugging the issue
   is to roll the RPM outside of mock.  Go into packages/<PACKAGENAME>
   and run "make rpm".  It should fail to build again.  This time go into
   ./tmp/src/redhat/BUILD/<PACKAGENAME>-<PACKAGEVERSION>.  This is where the 
   build occurred.  You can now poke around in this directory to see what 
   went wrong.

10. Why do I have to have local yum repos?
    One of the reasons we wrote this new build and integration system is to
    ensure consistency across builds.  That is, we wanted to ensure that an ISO
    generated in 2012 could be re-generated in 2014 without any functional
    differences.  Pointing to a remote repo makes this difficult to ensure.
    mock would roll RPMs using the packages available when mock was run.  
    However, the ISOs would be built using packages available when the ISO was 
    rolled.  This is exacerbated if you refer to HTTP/FTP yum repos from the
    kickstart may lead to inconsistencies between the RPMs and the ISO.  Could
    we solve this by "wget'ing" RPMs from an HTTP/FTP repo?  Sure.  But why not
    just use SMB/NFS mounts to get access to your central yum repo server.  At
    Tresys we have dedicated repo servers for each distro variant.  They share
    those repos via NFS.  Each build system NFS mounts those servers.  It is a
    relatively painless process that has proven to lead to consistency across
    builds.  All of this said, we're open to accepting patches from the
    community that implement support for remote repos but do so in a way to still
    meets the goal of reproducable builds.

11. Why do I see a series of question marks in the output of "ls -l"?
    This is SELinux enforcing a mandatory access control security policy that
    prevents a given subject (eg sysadm) from querying the security attributes of
    a file or directory.  Assuming you have search and read permissions on the
    directory you will be able to view the filename, but that is it.
<commit_msg>Add FAQ entry to setfiles/semodule error<commit_after>CLIP for RHEL 6 Frequently Asked Questions

1. How do I roll an installation ISO?
   Run "make clip-rhel6-installation-iso"

2. What other things can I make?
   Run "make help"

3a. What is the default username and password for CLIP?
    The username is "clipuser" and the password is "<PASSWORD>".  You can 
    change this in the %post of the kickstart
    (./kickstarts/ciip-rhel6/clip-rhel6.ks).

3b. What is the default bootloader password for GRUB?
    The default password for GRUB is "<PASSWORD>".  You can change this in 
    the kickstart (./kickstarts/ciip-rhel6/clip-rhel6.ks).

4. How do I clone yum repos?
   Setup a machine that has all the appropriate yum repos in /etc/yum/repos.d.
   Ensure the yum-utils package is installed.  If it is a RHEL machine you must
   visit RHN and ensure the system is associated with the channel you wish to 
   clone.  Now run these commands changing the paths and repoids as
   appropriate.

   # reposync --norepopath -m -p /opt/rhel-6-2-x86_64/rhel-x86_64-server-6 --repoid=rhel-x86_64-server-6.2.z -l
   # createrepo -d -g /opt/rhel-6-2-x86_64/rhel-x86_64-server-6/comps.xml /opt/rhel-6-2-x86_64/rhel-x86_64-server-6/getPackage
   # reposync --norepopath -m -p /opt/rhel-6-2-x86_64/rhel-x86_64-server-optional-6 --repoid=rhel-x86_64-server-optional-6 -l
   # createrepo -d -g /opt/rhel-6-2-x86_64/rhel-x86_64-server-optional-6/getPackages/repodata/comps.xml /opt/rhel-6-2-x86_64/rhel-x86_64-server-optional-6/getPackage

5. Why do I get prompted for so many passwords the first time I login?
   The default user's password is immediately expired when the account is 
   created.  This means you have to login and choose a new password.

6a. How do I add a user?
   Use these commands (change <USERNAME> to the appropriate username): 
     # semanage user -a -R staff_r -R sysadm_r <USERNAME>_u
     # useradd -Z <USERNAME>_u -m <USERNAME> -G wheel
     # restorecon -RF /home/<USERNAME>
     # passwd foo
     # chage -d 0
   Note: The first command will have to be adjusted as appropriate to match the 
         defined SELinux roles. The restorecon is required due to a bug in
         useradd where it doesn't honor login mappings when creating and
         populating user home directories.

7b. Walk me through 5a again?
   CLIP for RHEL 6 uses user-based access controls in SELinux.  The first 
   command, semanage, adds an SELinux user facilitating this separation and
   provides a set of roles that user is authorized to assume.  The second 
   command, useradd, actually creates the account and binds the Linux user 
   ID to the SELinux user ID.  The third command is used to set the user's 
   password.  The fourth command causes the password to immediately expire 
   thus forcing the user to set a new password on their first login.

8. How do I become a privileged user?
   Use "sudo -s".  Make the user has a line in sudoers like this:
    echo "<USERNAME>        ALL=(ALL) ROLE=sysadm_r TYPE=sysadm_t      ALL" >> /etc/sudoers
   Note: You will have to adjust the ROLE and TYPE fields as appropriate. For
         example, ROLE=auditadm_r TYPE=auditadm_t. 

9. Why am I getting "permission denied" when adding a user?
   You probably removed user_u from your SELinux policy.  Due to a bug in
   useradd this SELinux user *must* be present.  CLIP uses SELinux constraints 
   to strip all access from that user ID so leaving it present isn't a real
   issue.

9. An EXCEPTION was thrown during the build.  What do I do?
   The likely culprit is an RPM that failed to roll properly. Open 
   ./repos/my-repo/build.log.  A good option for debugging the issue
   is to roll the RPM outside of mock.  Go into packages/<PACKAGENAME>
   and run "make rpm".  It should fail to build again.  This time go into
   ./tmp/src/redhat/BUILD/<PACKAGENAME>-<PACKAGEVERSION>.  This is where the 
   build occurred.  You can now poke around in this directory to see what 
   went wrong.

10. Why do I have to have local yum repos?
    One of the reasons we wrote this new build and integration system is to
    ensure consistency across builds.  That is, we wanted to ensure that an ISO
    generated in 2012 could be re-generated in 2014 without any functional
    differences.  Pointing to a remote repo makes this difficult to ensure.
    mock would roll RPMs using the packages available when mock was run.  
    However, the ISOs would be built using packages available when the ISO was 
    rolled.  This is exacerbated if you refer to HTTP/FTP yum repos from the
    kickstart may lead to inconsistencies between the RPMs and the ISO.  Could
    we solve this by "wget'ing" RPMs from an HTTP/FTP repo?  Sure.  But why not
    just use SMB/NFS mounts to get access to your central yum repo server.  At
    Tresys we have dedicated repo servers for each distro variant.  They share
    those repos via NFS.  Each build system NFS mounts those servers.  It is a
    relatively painless process that has proven to lead to consistency across
    builds.  All of this said, we're open to accepting patches from the
    community that implement support for remote repos but do so in a way to still
    meets the goal of reproducable builds.

11. Why do I see a series of question marks in the output of "ls -l"?
    This is SELinux enforcing a mandatory access control security policy that
    prevents a given subject (eg sysadm) from querying the security attributes of
    a file or directory.  Assuming you have search and read permissions on the
    directory you will be able to view the filename, but that is it.

12. I get errors running semodule and/or semanage.  What is going on here?
    The likely culprit is libsemanage being configured to validate fc entries
    prior to rolling a transaction forward.  The following is the error
    message emitted when this occurs:
        /etc/selinux/clip/contexts/files/file_contexts: Multiple same specifications ...
        libsemanage.semanage_install_active: setfiles returned error code 1.
	semodule:  Failed!

    The fix for this is to disable the setfiles check in samange.conf:
        echo -e "module-store = direct\n[setfiles]\npath=/bin/true\n[end]\n" > /etc/selinux/semanage.conf
     
    If you're using a CLIP kickstart the ks handles this in response to the
    CONFIG_BUILD_ENFORCING_MODE flag.  In permissive mode this check is disabled.
    Note: I would recommend doing this only when doing development.  Errors
    like this are a sign of a policy problem that needs to be fixed.
{'fraction_non_alphanumeric': 0.056464206460096984, 'fraction_numerical': 0.018163885920933674, 'mean_word_length': 3.072289156626506, 'pattern_counts': {'":': 0, '<': 25, '<?xml version=': 0, '>': 30, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 4}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7605462', 'n_tokens_mistral': 3839, 'n_tokens_neox': 3579, 'n_words': 1756}