Re: certbot letsencrypt renewal selinux borkage

2017-02-10 Thread Konstantin Olchanski
On Fri, Feb 10, 2017 at 05:51:37PM -0500, Eric Dyer wrote: > > What do you think about the option of "reverting" from Linux to UNIX > (e.g. FreeBSD ) ? > Not theoretical. We have people in the electronics group who already use/always did use FreeBSD. For historical reasons we (I) have been with

Re: certbot letsencrypt renewal selinux borkage

2017-02-10 Thread David Sommerseth
On 10/02/17 23:42, Konstantin Olchanski wrote: > On Fri, Feb 10, 2017 at 10:40:43PM +0100, David Sommerseth wrote: >> >> So if you put your system into permissive mode (setenforce 0), run the >> certbot stuff via cron ... and grep out the denied lines, and I'll help. >> >> That is my offer. >> >

Re: certbot letsencrypt renewal selinux borkage

2017-02-10 Thread Eric Dyer
Konstantin, What do you think about the option of "reverting" from Linux to UNIX (e.g. FreeBSD ) ? Eric Dyer, ericfd...@gmail.com On Fri, Feb 10, 2017 at 5:42 PM, Konstantin Olchanski wrote: > On Fri, Feb 10, 2017 at 10:40:43PM +0100, David Sommerseth wrote: >> >> So if you put your system into

Re: certbot letsencrypt renewal selinux borkage

2017-02-10 Thread Konstantin Olchanski
On Fri, Feb 10, 2017 at 10:40:43PM +0100, David Sommerseth wrote: > > So if you put your system into permissive mode (setenforce 0), run the > certbot stuff via cron ... and grep out the denied lines, and I'll help. > > That is my offer. > I appreciate your offer and I say "thank you". But the

Re: certbot letsencrypt renewal selinux borkage

2017-02-10 Thread David Sommerseth
On 10/02/17 18:12, Konstantin Olchanski wrote: > On Fri, Feb 10, 2017 at 01:51:40PM +0100, David Sommerseth wrote: >> On 09/02/17 19:01, Konstantin Olchanski wrote: >>> Since I will learn selinux after I learn ldap after our current >>> high-priority >>> project ships to CERN in September, I do no

Re: certbot letsencrypt renewal selinux borkage

2017-02-10 Thread Konstantin Olchanski
On Fri, Feb 10, 2017 at 01:51:40PM +0100, David Sommerseth wrote: > > Manipulating the SELinux policy can be hard if you haven't done it > before - but once you know the tools and understands the concept, it is > fairly simple. > Everything is easy, but there is only 24 hours in the day. I am no

Re: certbot letsencrypt renewal selinux borkage

2017-02-10 Thread Konstantin Olchanski
On Fri, Feb 10, 2017 at 01:51:40PM +0100, David Sommerseth wrote: > On 09/02/17 19:01, Konstantin Olchanski wrote: > > Since I will learn selinux after I learn ldap after our current > > high-priority > > project ships to CERN in September, I do not see any solution other than > > disabling > > s

Re: certbot letsencrypt renewal selinux borkage

2017-02-10 Thread David Sommerseth
On 09/02/17 19:01, Konstantin Olchanski wrote: > Since I will learn selinux after I learn ldap after our current high-priority > project ships to CERN in September, I do not see any solution other than > disabling > selinux until this is fixed (presumably by the EPEL package certbot incuding > cor

Re: certbot letsencrypt renewal selinux borkage

2017-02-09 Thread Steven Haigh
On 2017-02-10 05:01, Konstantin Olchanski wrote: Reporting more selinux borkage. (to remember main selinux feature is commands executed from root shell work differently from commands run by cron or sshd & co. Clearly this is introduced to simplify testing stuff). This time, broken is letsencryp

certbot letsencrypt renewal selinux borkage

2017-02-09 Thread Konstantin Olchanski
Reporting more selinux borkage. (to remember main selinux feature is commands executed from root shell work differently from commands run by cron or sshd & co. Clearly this is introduced to simplify testing stuff). This time, broken is letsencrypt certificate renewal using certbot. "certbot renew