Ceph » Orchestrator

The _fetch_selinux function inside kernel_security in cephadm is not checking the actual selinux mode in which the kernel is running but the one configured in /etc/selinux/config, but the configured and the actual modes can be different.

For example, the mode in the configuration file and the actual mode will defer if the server has not been rebooted since the change in the config file. They will also differ if the mode was changed after boot using setenforce.

This leads to a wrong assumption of the selinux mode when launching docker commands like `inventory` that causes the command to fail.

The actual selinux mode should be checked looking at the output of the getenforce command, this will get the current selinux mode in which the kernel is running.