Manage selinux context of tftp directory

- Fixes: #1997

Signed-off-by: Jonathon Anderson <janderson@ciq.com>

internal/app/wwctl/configure/main.go

@@ -24,6 +24,12 @@ func CobraRunE(cmd *cobra.Command, args []string) error {
 		if err != nil {
 			return err
 		}
+
+		err = configure.TFTP()
+		if err != nil {
+			return err
+		}
+
 		err = configure.DHCP()
 		if err != nil {
 			return err
@@ -39,10 +45,6 @@ func CobraRunE(cmd *cobra.Command, args []string) error {
 			return err
 		}
 
-		err = configure.TFTP()
-		if err != nil {
-			return err
-		}
 		err = configure.Hostfile()
 		if err != nil {
 			return err

internal/pkg/configure/tftp.go

@@ -13,9 +13,22 @@ import (
 
 func TFTP() (err error) {
 	controller := warewulfconf.Get()
-	var tftpdir string = path.Join(controller.TFTP.TftpRoot, "warewulf")
 	oldMask := unix.Umask(0)
 	defer unix.Umask(oldMask)
+
+	// Check if TftpRoot exists, create and restore context if needed
+	if _, err := os.Stat(controller.TFTP.TftpRoot); err != nil {
+		err = os.MkdirAll(controller.TFTP.TftpRoot, 0755)
+		if err != nil {
+			return err
+		}
+		if err := util.RestoreSELinuxContext(controller.TFTP.TftpRoot); err != nil {
+			wwlog.Warn("failed to restore SELinux context for %s: %s", controller.TFTP.TftpRoot, err)
+		}
+	}
+
+	// Create tftpdir if needed
+	var tftpdir string = path.Join(controller.TFTP.TftpRoot, "warewulf")
 	err = os.MkdirAll(tftpdir, 0755)
 	if err != nil {
 		return
@@ -43,6 +56,7 @@ func TFTP() (err error) {
 			}
 		}
 	}
+
 	if !controller.TFTP.Enabled() {
 		wwlog.Warn("Warewulf does not auto start TFTP services due to disable by warewulf.conf")
 		return nil

internal/pkg/util/selinux.go

@@ -0,0 +1,34 @@
+package util
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"github.com/opencontainers/selinux/go-selinux"
+	"github.com/warewulf/warewulf/internal/pkg/wwlog"
+)
+
+// RestoreSELinuxContext restores the SELinux context for a path and all its children
+// based on the system's SELinux policy, equivalent to running restorecon -R
+func RestoreSELinuxContext(rootPath string) error {
+	if !selinux.GetEnabled() {
+		wwlog.Debug("SELinux not enabled, skipping context restoration")
+		return nil
+	}
+
+	wwlog.Info("Restoring SELinux contexts for: %s", rootPath)
+
+	cmd := exec.Command("restorecon", "-vR", rootPath)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("restorecon failed: %w: %s", err, string(output))
+	}
+
+	for _, line := range strings.Split(strings.TrimSpace(string(output)), "\n") {
+		if line != "" {
+			wwlog.Debug("restorecon output: %s", line)
+		}
+	}
+	return nil
+}