From d8a94c288f8bf31525f2634d432efdb0376b2d04 Mon Sep 17 00:00:00 2001
From: William Brown <william@blackhats.net.au>
Date: Feb 06 2019 00:16:42 +0000
Subject: Ticket 50195 - improve selinux error messages in interactive


Bug Description: During an interactive install, the selinux
module if not found would produce many error messages that
were not necessary.

Fix Description: Warn the user at the start of the install
that selinux isn't found, and allow them to continue

https://pagure.io/389-ds-base/issue/50195

Author: William Brown <william@blackhats.net.au>

Review by: spichugi (Thanks!)

---

diff --git a/src/lib389/lib389/__init__.py b/src/lib389/lib389/__init__.py
index fb987e0..46e8b9d 100644
--- a/src/lib389/lib389/__init__.py
+++ b/src/lib389/lib389/__init__.py
@@ -1230,7 +1230,8 @@ class DirSrv(SimpleLDAPObject, object):
                 self.log.debug("DEBUG: starting with %s" % cmd)
                 output = subprocess.check_output(*cmd, env=env, stderr=subprocess.STDOUT)
             except subprocess.CalledProcessError:
-                self.log.error(output)
+                self.log.error('Failed to start ns-slapd: "%s"' % output)
+                raise ValueError('Failed to start DS')
             count = timeout
             pid = pid_from_file(self.ds_paths.pid_file)
             while (pid is None) and count > 0:
diff --git a/src/lib389/lib389/instance/setup.py b/src/lib389/lib389/instance/setup.py
index 2ff6476..c0aa608 100644
--- a/src/lib389/lib389/instance/setup.py
+++ b/src/lib389/lib389/instance/setup.py
@@ -35,7 +35,8 @@ from lib389.utils import (
     normalizeDN,
     socket_check_open,
     selinux_label_port,
-    selinux_restorecon)
+    selinux_restorecon,
+    selinux_present)
 
 ds_paths = Paths()
 
@@ -271,6 +272,12 @@ class SetupDs(object):
                  'log_dir': ds_paths.log_dir,
                  'schema_dir': ds_paths.schema_dir}
 
+        # Let them know about the selinux status
+        if not selinux_present():
+            val = input('\nSelinux support will be disabled, continue? [yes]: ')
+            if val.strip().lower().startswith('n'):
+                return
+
         # Start asking questions, beginning with the hostname...
         val = input('\nEnter system\'s hostname [{}]: '.format(general['full_machine_name'])).rstrip()
         if val != "":
diff --git a/src/lib389/lib389/utils.py b/src/lib389/lib389/utils.py
index 987176b..de3c5b7 100644
--- a/src/lib389/lib389/utils.py
+++ b/src/lib389/lib389/utils.py
@@ -172,6 +172,36 @@ _chars = {
 # Utilities
 #
 
+def selinux_present():
+    """
+    Determine if selinux libraries are on a system, and if so, if we are in
+    a state to consume them (enabled, disabled).
+
+    :returns: bool
+    """
+    status = False
+
+    try:
+        import selinux
+        if selinux.is_selinux_enabled():
+            # We have selinux, continue.
+            status = True
+        else:
+            # We have the module, but it's disabled.
+            log.error('selinux is disabled, will not relabel ports or files.' )
+    except ImportError:
+        # No python module, so who knows what state we are in.
+        log.error('selinux python module not found, will not relabel files.' )
+
+    try:
+        if status:
+            # Only if we know it's enabled, check if we can manage ports too.
+            import sepolicy
+    except ImportError:
+        log.error('sepolicy python module not found, will not relabel ports.' )
+
+    return status
+
 
 def selinux_restorecon(path):
     """
@@ -184,11 +214,11 @@ def selinux_restorecon(path):
     try:
         import selinux
     except ImportError:
-        log.error('selinux python module not found, skipping relabel path %s' % path)
+        log.debug('selinux python module not found, skipping relabel path %s' % path)
         return
 
     if not selinux.is_selinux_enabled():
-        log.error('selinux is disabled, skipping relabel path %s' % path)
+        log.debug('selinux is disabled, skipping relabel path %s' % path)
         return
 
     try:
@@ -210,17 +240,17 @@ def selinux_label_port(port, remove_label=False):
     try:
         import selinux
     except ImportError:
-        log.error('selinux python module not found, skipping port labeling.')
+        log.debug('selinux python module not found, skipping port labeling.')
         return
 
     try:
         import sepolicy
     except ImportError:
-        log.error('sepolicy python module not found, skipping port labeling.')
+        log.debug('sepolicy python module not found, skipping port labeling.')
         return
 
     if not selinux.is_selinux_enabled():
-        log.error('selinux is disabled, skipping port relabel')
+        log.debug('selinux is disabled, skipping port relabel')
         return
 
     # We only label ports that ARE NOT in the default policy that comes with