Resolve selinux installation issues

pkg-new/hostutils/initialize.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 
 	"github.com/replicatedhq/embedded-cluster/pkg/runtimeconfig"
@@ -39,6 +40,26 @@ func (h *HostUtils) ConfigureHost(ctx context.Context, rc runtimeconfig.RuntimeC
 		}
 	}
 
+	h.logger.Debugln("checking for semanage binary in $PATH")
+	if _, err := exec.LookPath("semanage"); err != nil {
+		h.logger.Debugln("semanage not found")
+	} else {
+
+		// Set selinux fcontext for embedded-cluster binary directory to bin_t
+		out, err := exec.Command("semanage", "fcontext", "-a", "-s", "system_u", "-t", "bin_t", rc.EmbeddedClusterBinsSubDir()+"(/.*)?").CombinedOutput()
+		if err != nil {
+			h.logger.Debugf("unable to set contexts on binary directory: %v", err)
+			h.logger.Debugln(out)
+		}
+
+		// Relabel whole embedded-cluster data directory since it's created with unconfined_u
+		out, err = exec.Command("restorecon", "-RvF", rc.EmbeddedClusterHomeDirectory()).CombinedOutput()
+		if err != nil {
+			h.logger.Debugf("unable to run restorecon: %v", err)
+			h.logger.Debugln(out)
+		}
+	}
+
 	h.logger.Debugf("configuring sysctl")
 	if err := h.ConfigureSysctl(); err != nil {
 		h.logger.Debugf("unable to configure sysctl: %v", err)

pkg-new/preflights/host-preflight.yaml

@@ -1180,23 +1180,6 @@ spec:
               when: "connected"
               message: "Successful TCP connection to {{ $element }}."
 {{- end}}
-    - textAnalyze:
-        checkName: SELinux Mode
-        fileName: host-collectors/run-host/selinux-mode.txt
-        regexGroups: '(?P<Mode>Enforcing|Permissive|Disabled|Missing)'
-        outcomes:
-          - fail:
-              when: "Mode == Enforcing"
-              message: SELinux must be disabled or run in permissive mode. To run SELinux in permissive mode, edit /etc/selinux/config, change the line 'SELINUX=enforcing' to 'SELINUX=permissive', save the file, and reboot. You can run getenforce to verify the change."
-          - pass:
-              when: "Mode == Permissive"
-              message: SELinux is running in permissive mode.
-          - pass:
-              when: "Mode == Disabled"
-              message: SELinux is disabled.
-          - pass:
-              when: "Mode == Missing"
-              message: SELinux is not installed.
     - textAnalyze:
         checkName: Data Directory Permissions
         fileName: host-collectors/run-host/check-data-dir-permissions.txt