puppetlabs/puppet · error · Puppet::Error

Could not open SELinux category translation file %{path}.

Error message

Could not open SELinux category translation file %{path}.

What it means

selinux_category_to_label (selinux.rb:187-207) opens the SELinux category translation file at Selinux.selinux_translations_path (setrans.conf) to map a category like 'SystemLow' to its numeric label (e.g., 's0'). If opening/reading raises SystemCallError (ENOENT, EACCES), it logs the exception and raises Puppet::Error 'Could not open SELinux category translation file %{path}.'. Ground-truth caveat in this source: the format string uses %{path} but the hash supplies { context: context } (selinux.rb:206), and `context` is not even in scope (the parameter is `category`), so the rescue path actually dies with NameError/KeyError before producing the intended Puppet::Error on this Puppet version.

Source

Thrown at lib/puppet/util/selinux.rb:206

    # We don't cache this, but there's already a ton of duplicate work
    # in the selinux handling code.

    path = Selinux.selinux_translations_path
    begin
      File.open(path).each do |line|
        line.strip!
        next if line.empty?
        next if line[0] == "#" # skip comments

        line.gsub!(/[[:space:]]+/m, '')
        mapping = line.split("=", 2)
        if category == mapping[1]
          return mapping[0]
        end
      end
    rescue SystemCallError => ex
      log_exception(ex)
      raise Puppet::Error, _("Could not open SELinux category translation file %{path}.") % { context: context }
    end

    category
  end

  ########################################################################
  # Internal helper methods from here on in, kids.  Don't fiddle.
  private

  # Check filesystem a path resides on for SELinux support against
  # whitelist of known-good filesystems.
  # Returns true if the filesystem can support SELinux labels and
  # false if not.
  def selinux_label_support?(file)
    fstype = find_fs(file)
    return false if fstype.nil?

    filesystems = %w[ext2 ext3 ext4 gfs gfs2 xfs jfs btrfs tmpfs zfs]

View on GitHub (pinned to e227c27540)

Solutions

1. Install/restore the translation file: ensure the selinux-policy and policycoreutils packages are present and /etc/selinux/$(selinuxconfig -p)/setrans.conf exists.
2. Fix permissions/ownership so the puppet user can read the file.
3. Pre-check File.readable?(Selinux.selinux_translations_path) before invoking category handling and skip selrange management when absent.
4. Upgrade Puppet: the rescue branch references an undefined `context` instead of `path`, so on this version the failure mode is a NameError/KeyError rather than the intended Puppet::Error.

Example fix

// before
label = selinux_category_to_label('SystemLow') # setrans.conf missing -> rescue path -> NameError

// after
path = Selinux.selinux_translations_path
unless path && File.readable?(path)
  Puppet.debug("skipping category translation; #{path} unreadable")
  return nil
end
label = selinux_category_to_label('SystemLow')

path = defined?(Selinux) ? Selinux.selinux_translations_path : nil
translatable = path.is_a?(String) && File.readable?(path)
return default unless translatable

begin
  selinux_category_to_label(category)
rescue Puppet::Error, NameError, KeyError => e
  Puppet.err("SELinux translation file unavailable: #{e.message}")
  category
end

When it happens

Trigger: Managing SELinux categories/ranges (selrange) on a host where /etc/selinux/<policy>/setrans.conf is missing (policycoreutils / selinux-policy not installed) or unreadable (wrong ownership, EACCES under a confined puppet agent); containers with SELinux tooling stripped out.

Common situations: Minimal RHEL/CentOS images without the selinux-policy package; containers where /etc/selinux is an empty mount; MCS category management (svirt, docker selinux labels) on hosts whose translations file was removed during hardening.

Related errors

• Invalid context to parse: %{context}
• Could not read #{ftype} #{resource.title}: #{detail}
• PathPatterns cannot be created with a zero byte.
• Request to Puppet Forge failed. Detail: %{detail}.
• Unable to verify the SSL certificate at %{uri}

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/15d2585f29bcf717. Report an issue: GitHub.