Update the systemd service, to use kmscon instead of fbcon

[kdj0c]

On Fedora rawhide, kmscon is now the default, and the initial setup script is hidden behind the kmscon console.

Fix #160

It's a draft, I wasn't able to test it yet.

[AdamWill]

Ping? This is still broken in current Rawhide, and it's a blocker most likely.

[kdj0c]

I have merged the --oneshot argument in kmscon v10.0.1, which is now released in Fedora rawhide.

There is however still a selinux issue.

I tried to fix it with fedora-selinux/selinux-policy#3247
but selinux rules are very complex, and I will need some help to have that merged.

As it's currently broken anyway, we can merge this part, and fix selinux later.

[M4rtinK]

@AdamWill @kdj0c I did merge #156 - will do one more smoke test with both & if all is fine, will merge this as well and do a new release :)

[kdj0c]

@M4rtinK Did you have time to run the smoke tests ?

Merging this will help to make the selinux changes with fedora-selinux/selinux-policy#3247

Also initial-setup don't have specific selinux rules, and runs with the generic bin_t label.
This makes it difficult to start from kmscon.
Are you planning to write a proper selinux policy ?

[M4rtinK]

@M4rtinK Did you have time to run the smoke tests ?
Sorry, got sidetracked by other stuff - again. :P

Anyway, back on this now & I will make it happen today. :)

Merging this will help to make the selinux changes with fedora-selinux/selinux-policy#3247

Also initial-setup don't have specific selinux rules, and runs with the generic bin_t label.
This makes it difficult to start from kmscon.
Are you planning to write a proper selinux policy ?

I am not really sure this would be that simple or even doable - Initial Setup is basically just a launcher for Anaconda configuration screens, which in turn interact with the Anaconda backend, which does some significant system configuration operations (unlike Anaconda runnin of boot.iso or Live image, it does not do storage, but still a lot of stuff).

On the other hand, the UI itself already runs in a separate process, so maybe there could be a SELinux policy for that & that would help ?

[kdj0c]

@M4rtinK Did you have time to run the smoke tests ?
Sorry, got sidetracked by other stuff - again. :P

Anyway, back on this now & I will make it happen today. :)

Thanks ;)

Merging this will help to make the selinux changes with fedora-selinux/selinux-policy#3247

Also initial-setup don't have specific selinux rules, and runs with the generic bin_t label.
This makes it difficult to start from kmscon.
Are you planning to write a proper selinux policy ?

I am not really sure this would be that simple or even doable - Initial Setup is basically just a launcher for Anaconda configuration screens, which in turn interact with the Anaconda backend, which does some significant system configuration operations (unlike Anaconda runnin of boot.iso or Live image, it does not do storage, but still a lot of stuff).

So if most of the things requiring permission is done by the anaconda backend, maybe the rules I sent in the selinux ticket might be enough.
Unfortunately from what I understand, selinux don't allow kmscon which has policy, to start a process with a generic bin_t policy.

On the other hand, the UI itself already runs in a separate process, so maybe there could be a SELinux policy for that & that would help ?

Maybe that can help to build the required selinux policy. I'm a complete beginner in selinux, so I hope someone with knowledge will help us.

[M4rtinK]

So got as far a COPR build but that failed on an apparently unrelated issue. :P

https://copr.fedorainfracloud.org/coprs/m4rtink/Test_Initial_Setup_PR_161/build/10807170/

I've seen that happen sporadically in the past, so might as well finally fix it. :)