teuthology 1.0.0__py3-none-any.whl → 1.2.0__py3-none-any.whl

teuthology/task/kernel.py

@@ -2,6 +2,7 @@
 Kernel installation task
 """
 
+import contextlib
 import logging
 import os
 import re
@@ -28,10 +29,11 @@ from teuthology.packaging import (
     get_koji_task_result,
     get_builder_project,
 )
+from teuthology.task.install.deb import install_dep_packages
 
 log = logging.getLogger(__name__)
 
-CONFIG_DEFAULT = {'branch': 'master'}
+CONFIG_DEFAULT = {'branch': 'main'}
 TIMEOUT_DEFAULT = 300
 
 VERSION_KEYS = ['branch', 'tag', 'sha1', 'deb', 'rpm', 'koji', 'koji_task']
@@ -76,9 +78,10 @@ def normalize_config(ctx, config):
     :param ctx: Context
     :param config: Configuration
     """
+    log.info(f'normalize config orig: {config}')
     if not config or \
             len([x for x in config.keys() if x in
-                VERSION_KEYS + ['kdb', 'flavor']]) == len(config.keys()):
+                VERSION_KEYS + ['kdb', 'flavor', 'hwe']]) == len(config.keys()):
         new_config = {}
         if not config:
             config = CONFIG_DEFAULT
@@ -98,6 +101,7 @@ def normalize_config(ctx, config):
                 # specific overrides generic
                 if name not in config:
                     new_config[name] = role_config.copy()
+    log.info(f'normalize config final: {new_config}')
     return new_config
 
 
@@ -117,7 +121,6 @@ def normalize_and_apply_overrides(ctx, config, overrides):
     if 'timeout' in config:
         timeout = config.pop('timeout')
     config = normalize_config(ctx, config)
-    log.debug('normalized config %s' % config)
 
     if 'timeout' in overrides:
         timeout = overrides.pop('timeout')
@@ -286,7 +289,7 @@ def install_firmware(ctx, config):
                 run.Raw('&&'),
                 'sudo', 'git', 'fetch', 'origin',
                 run.Raw('&&'),
-                'sudo', 'git', 'reset', '--hard', 'origin/master'
+                'sudo', 'git', 'reset', '--hard', 'origin/main'
                 ],
             )
 
@@ -479,7 +482,7 @@ def update_rh_kernel(remote):
             log.info("Latest version already installed on %s", remote.shortname)
 
 
-def install_and_reboot(ctx, config):
+def install_and_reboot(ctx, need_install, config):
     """
     Install and reboot the kernel.  This mostly performs remote
     installation operations.   The code does check for Arm images
@@ -489,15 +492,16 @@ def install_and_reboot(ctx, config):
     it expects kernel entries to be present under submenu entries.
 
     :param ctx: Context
+    :param need_install: map from caller
     :param config: Configuration
     """
     procs = {}
     kernel_title = ''
-    for role, src in config.items():
+    for role, src in need_install.items():
         (role_remote,) = ctx.cluster.only(role).remotes.keys()
         if isinstance(src, str) and src.find('distro') >= 0:
             log.info('Installing distro kernel on {role}...'.format(role=role))
-            install_kernel(role_remote, version=src)
+            install_kernel(role_remote, config[role], version=src)
             continue
 
         log.info('Installing kernel {src} on {role}...'.format(src=src,
@@ -514,7 +518,7 @@ def install_and_reboot(ctx, config):
                     '--replacepkgs',
                     remote_pkg_path(role_remote),
                 ])
-            install_kernel(role_remote, remote_pkg_path(role_remote))
+            install_kernel(role_remote, config[role], path=remote_pkg_path(role_remote))
             continue
 
         # TODO: Refactor this into install_kernel() so that it handles all
@@ -658,7 +662,7 @@ def enable_disable_kdb(ctx, config):
                         'sudo', 'tee', '/sys/module/kgdboc/parameters/kgdboc'
                         ])
             except run.CommandFailedError:
-                log.warn('Kernel does not support kdb')
+                log.warning('Kernel does not support kdb')
         else:
             log.info('Disabling kdb on {role}...'.format(role=role))
             # Add true pipe so command doesn't fail on kernel without kdb support.
@@ -672,10 +676,10 @@ def enable_disable_kdb(ctx, config):
                         'true',
                         ])
             except run.CommandFailedError:
-                log.warn('Kernel does not support kdb')
+                log.warning('Kernel does not support kdb')
 
 
-def wait_for_reboot(ctx, need_install, timeout, distro=False):
+def wait_for_reboot(ctx, need_install, timeout, config, distro=False):
     """
     Loop reconnecting and checking kernel versions until
     they're all correct or the timeout is exceeded.
@@ -691,15 +695,15 @@ def wait_for_reboot(ctx, need_install, timeout, distro=False):
     time.sleep(30)
     starttime = time.time()
     while need_install:
-        teuthology.reconnect(ctx, timeout)
         for client in list(need_install.keys()):
             if 'distro' in str(need_install[client]):
                  distro = True
             log.info('Checking client {client} for new kernel version...'.format(client=client))
             try:
+                (remote,) = ctx.cluster.only(client).remotes.keys()
+                remote.reconnect(timeout=timeout)
                 if distro:
-                    (remote,) = ctx.cluster.only(client).remotes.keys()
-                    assert not need_to_install_distro(remote), \
+                    assert not need_to_install_distro(remote, config[client]), \
                             'failed to install new distro kernel version within timeout'
 
                 else:
@@ -733,7 +737,7 @@ def get_version_of_running_kernel(remote):
     return current
 
 
-def need_to_install_distro(remote):
+def need_to_install_distro(remote, role_config):
     """
     Installing kernels on rpm won't setup grub/boot into them.  This installs
     the newest kernel package and checks its version and compares against
@@ -783,7 +787,7 @@ def need_to_install_distro(remote):
         newest = get_latest_image_version_rpm(remote)
 
     if package_type == 'deb':
-        newest = get_latest_image_version_deb(remote, dist_release)
+        newest = get_latest_image_version_deb(remote, dist_release, role_config)
 
     if current in newest or current.replace('-', '_') in newest:
         log.info('Newest distro kernel installed and running')
@@ -820,7 +824,7 @@ def maybe_generate_initrd_rpm(remote, path, version):
         ])
 
 
-def install_kernel(remote, path=None, version=None):
+def install_kernel(remote, role_config, path=None, version=None):
     """
     A bit of misnomer perhaps - the actual kernel package is installed
     elsewhere, this function deals with initrd and grub.  Currently the
@@ -855,7 +859,7 @@ def install_kernel(remote, path=None, version=None):
         return
 
     if package_type == 'deb':
-        newversion = get_latest_image_version_deb(remote, dist_release)
+        newversion = get_latest_image_version_deb(remote, dist_release, role_config)
         if 'ubuntu' in dist_release:
             grub2conf = teuthology.get_file(remote,
                 '/boot/grub/grub.cfg', sudo=True).decode()
@@ -979,14 +983,14 @@ def generate_legacy_grub_entry(remote, newversion):
         if re.match('^title', line):
             titleline = line
             titlelinenum = linenum
-        if re.match('(^\s+)root', line):
+        if re.match(r'(^\s+)root', line):
             rootline = line
-        if re.match('(^\s+)kernel', line):
+        if re.match(r'(^\s+)kernel', line):
             kernelline = line
             for word in line.split(' '):
                 if 'vmlinuz' in word:
                     kernelversion = word.split('vmlinuz-')[-1]
-        if re.match('(^\s+)initrd', line):
+        if re.match(r'(^\s+)initrd', line):
             initline = line
         if (kernelline != '') and (initline != ''):
             break
@@ -1029,8 +1033,9 @@ def get_image_version(remote, path):
         raise UnsupportedPackageTypeError(remote)
 
     for file in files.split('\n'):
-        if '/boot/vmlinuz-' in file:
-            version = file.split('/boot/vmlinuz-')[1]
+        match = re.search(r'/lib/modules/(.*)/modules\.order$', file)
+        if match:
+            version = match.group(1)
             break
 
     log.debug("get_image_version: %s", version)
@@ -1049,9 +1054,9 @@ def get_latest_image_version_rpm(remote):
         kernel_pkg_name = "kernel-default"
     else:
         kernel_pkg_name = "kernel"
-    # get tip of package list ordered by install time
+    # get tip of package list ordered by descending version
     newest_package = remote.sh(
-        'rpm -q %s --last | head -n 1' % kernel_pkg_name).strip()
+        'rpm -q %s | sort -rV | head -n 1' % kernel_pkg_name).strip()
     for kernel in newest_package.split():
         if kernel.startswith('kernel'):
             if 'ceph' not in kernel:
@@ -1062,7 +1067,7 @@ def get_latest_image_version_rpm(remote):
     return version
 
 
-def get_latest_image_version_deb(remote, ostype):
+def get_latest_image_version_deb(remote, ostype, role_config):
     """
     Get kernel image version of the newest kernel deb package.
     Used for distro case.
@@ -1078,8 +1083,8 @@ def get_latest_image_version_deb(remote, ostype):
     # Note that a dependency list may have multiple comma-separated entries,
     # but also each entry may be an alternative (pkg1 | pkg2)
     if 'debian' in ostype:
-        remote.run(args=['sudo', 'apt-get', '-y', 'install',
-                         'linux-image-amd64'], stdout=output)
+        args=['sudo', 'apt-get', '-y', 'install', 'linux-image-amd64']
+        install_dep_packages(remote, args)
         remote.run(args=['dpkg', '-s', 'linux-image-amd64'], stdout=output)
         for line in output.getvalue().split('\n'):
             if 'Depends:' in line:
@@ -1088,26 +1093,16 @@ def get_latest_image_version_deb(remote, ostype):
                 return newest
     # Ubuntu is a depend in a depend.
     if 'ubuntu' in ostype:
-        try:
-            remote.run(args=['sudo', 'DEBIAN_FRONTEND=noninteractive',
-                             'apt-get', '-y', 'install',
-                             'linux-image-current-generic'])
-            remote.run(args=['dpkg', '-s', 'linux-image-current-generic'],
-                       stdout=output)
-            for line in output.getvalue().split('\n'):
-                if 'Depends:' in line:
-                    depends = line.split('Depends: ')[1]
-                    remote.run(args=['sudo', 'apt-get', '-y', 'install',
-                                     depends])
-            remote.run(args=['dpkg', '-s', depends], stdout=output)
-        except run.CommandFailedError:
-            # Non precise ubuntu machines (like trusty) don't have
-            # linux-image-current-generic so use linux-image-generic instead.
-            remote.run(args=['sudo', 'DEBIAN_FRONTEND=noninteractive',
-                             'apt-get', '-y', 'install',
-                             'linux-image-generic'], stdout=output)
-            remote.run(args=['dpkg', '-s', 'linux-image-generic'],
-                       stdout=output)
+        name = 'linux-image-generic'
+        if role_config.get('hwe'):
+            name = f'linux-image-generic-hwe-{remote.os.version}'
+
+        args=['sudo', 'DEBIAN_FRONTEND=noninteractive',
+              'apt-get', '-y', 'install', name]
+        install_dep_packages(remote, args)
+        remote.run(args=['dpkg', '-s', name],
+                   stdout=output)
+
         for line in output.getvalue().split('\n'):
             if 'Depends:' in line:
                 newest = line.split('linux-image-')[1]
@@ -1137,13 +1132,14 @@ def get_sha1_from_pkg_name(path):
     return sha1
 
 
+@contextlib.contextmanager
 def task(ctx, config):
     """
     Make sure the specified kernel is installed.
     This can be a branch, tag, or sha1 of ceph-client.git or a local
     kernel package.
 
-    To install ceph-client.git branch (default: master)::
+    To install ceph-client.git branch (default: main)::
 
         kernel:
           branch: testing
@@ -1212,7 +1208,7 @@ def task(ctx, config):
           client.1:
             branch: more_specific
           osd.3:
-            branch: master
+            branch: main
 
     To wait 3 minutes for hosts to reboot (default: 300)::
 
@@ -1237,105 +1233,117 @@ def task(ctx, config):
     validate_config(ctx, config)
     log.info('config %s, timeout %d' % (config, timeout))
 
-    need_install = {}  # sha1 to dl, or path to rpm or deb
-    need_version = {}  # utsrelease or sha1
-    kdb = {}
+    with parallel() as p:
+        for role, role_config in config.items():
+            p.spawn(process_role, ctx, config, timeout, role, role_config)
 
-    for role, role_config in config.items():
-        # gather information about this remote
-        (role_remote,) = ctx.cluster.only(role).remotes.keys()
-        system_type = role_remote.os.name
-        if role_config.get('rpm') or role_config.get('deb'):
-            # We only care about path - deb: vs rpm: is meaningless,
-            # rpm: just happens to be parsed first.  Nothing is stopping
-            # 'deb: /path/to/foo.rpm' and it will work provided remote's
-            # os.package_type is 'rpm' and vice versa.
-            path = role_config.get('rpm')
-            if not path:
-                path = role_config.get('deb')
-            sha1 = get_sha1_from_pkg_name(path)
-            assert sha1, "failed to extract commit hash from path %s" % path
-            if need_to_install(ctx, role, sha1):
-                need_install[role] = path
-                need_version[role] = sha1
-        elif role_config.get('sha1') == 'distro':
-            version = need_to_install_distro(role_remote)
-            if version:
-                need_install[role] = 'distro'
-                need_version[role] = version
-        elif role_config.get("koji") or role_config.get('koji_task'):
-            # installing a kernel from koji
-            build_id = role_config.get("koji")
-            task_id = role_config.get("koji_task")
-            if role_remote.os.package_type != "rpm":
-                msg = (
-                    "Installing a kernel from koji is only supported "
-                    "on rpm based systems. System type is {system_type}."
-                )
-                msg = msg.format(system_type=system_type)
-                log.error(msg)
-                ctx.summary["failure_reason"] = msg
-                ctx.summary["status"] = "dead"
-                raise ConfigError(msg)
-
-            # FIXME: this install should probably happen somewhere else
-            # but I'm not sure where, so we'll leave it here for now.
-            install_package('koji', role_remote)
-
-            if build_id:
-                # get information about this build from koji
-                build_info = get_koji_build_info(build_id, role_remote, ctx)
-                version = "{ver}-{rel}.x86_64".format(
-                    ver=build_info["version"],
-                    rel=build_info["release"]
-                )
-            elif task_id:
-                # get information about results of this task from koji
-                task_result = get_koji_task_result(task_id, role_remote, ctx)
-                # this is not really 'build_info', it's a dict of information
-                # about the kernel rpm from the task results, but for the sake
-                # of reusing the code below I'll still call it that.
-                build_info = get_koji_task_rpm_info(
-                    'kernel',
-                    task_result['rpms']
-                )
-                # add task_id so we can know later that we're installing
-                # from a task and not a build.
-                build_info["task_id"] = task_id
-                version = build_info["version"]
-
-            if need_to_install(ctx, role, version):
-                need_install[role] = build_info
-                need_version[role] = version
-        else:
-            builder = get_builder_project()(
-                "kernel",
-                role_config,
-                ctx=ctx,
-                remote=role_remote,
-            )
-            sha1 = builder.sha1
-            log.debug('sha1 for {role} is {sha1}'.format(role=role, sha1=sha1))
-            ctx.summary['{role}-kernel-sha1'.format(role=role)] = sha1
+    try:
+        yield
+    finally:
+        pass
 
-            if need_to_install(ctx, role, sha1):
-                if teuth_config.use_shaman:
-                    version = builder.scm_version
-                else:
-                    version = builder.version
-                if not version:
-                    raise VersionNotFoundError(builder.base_url)
-                need_install[role] = sha1
-                need_version[role] = version
 
-        # enable or disable kdb if specified, otherwise do not touch
-        if role_config.get('kdb') is not None:
-            kdb[role] = role_config.get('kdb')
+def process_role(ctx, config, timeout, role, role_config):
+    need_install = None  # sha1 to dl, or path to rpm or deb
+    need_version = None  # utsrelease or sha1
 
-    if need_install:
-        install_firmware(ctx, need_install)
-        download_kernel(ctx, need_install)
-        install_and_reboot(ctx, need_install)
-        wait_for_reboot(ctx, need_version, timeout)
+    # gather information about this remote
+    (role_remote,) = ctx.cluster.only(role).remotes.keys()
+    system_type = role_remote.os.name
+    if role_remote.is_container:
+        log.info(f"Remote f{role_remote.shortname} is a container; skipping kernel installation")
+        return
+    if role_config.get('rpm') or role_config.get('deb'):
+        # We only care about path - deb: vs rpm: is meaningless,
+        # rpm: just happens to be parsed first.  Nothing is stopping
+        # 'deb: /path/to/foo.rpm' and it will work provided remote's
+        # os.package_type is 'rpm' and vice versa.
+        path = role_config.get('rpm')
+        if not path:
+            path = role_config.get('deb')
+        sha1 = get_sha1_from_pkg_name(path)
+        assert sha1, "failed to extract commit hash from path %s" % path
+        if need_to_install(ctx, role, sha1):
+            need_install = path
+            need_version = sha1
+    elif role_config.get('sha1') == 'distro':
+        version = need_to_install_distro(role_remote, role_config)
+        if version:
+            need_install = 'distro'
+            need_version = version
+    elif role_config.get("koji") or role_config.get('koji_task'):
+        # installing a kernel from koji
+        build_id = role_config.get("koji")
+        task_id = role_config.get("koji_task")
+        if role_remote.os.package_type != "rpm":
+            msg = (
+                "Installing a kernel from koji is only supported "
+                "on rpm based systems. System type is {system_type}."
+            )
+            msg = msg.format(system_type=system_type)
+            log.error(msg)
+            ctx.summary["failure_reason"] = msg
+            ctx.summary["status"] = "dead"
+            raise ConfigError(msg)
+
+        # FIXME: this install should probably happen somewhere else
+        # but I'm not sure where, so we'll leave it here for now.
+        install_package('koji', role_remote)
+
+        if build_id:
+            # get information about this build from koji
+            build_info = get_koji_build_info(build_id, role_remote, ctx)
+            version = "{ver}-{rel}.x86_64".format(
+                ver=build_info["version"],
+                rel=build_info["release"]
+            )
+        elif task_id:
+            # get information about results of this task from koji
+            task_result = get_koji_task_result(task_id, role_remote, ctx)
+            # this is not really 'build_info', it's a dict of information
+            # about the kernel rpm from the task results, but for the sake
+            # of reusing the code below I'll still call it that.
+            build_info = get_koji_task_rpm_info(
+                'kernel',
+                task_result['rpms']
+            )
+            # add task_id so we can know later that we're installing
+            # from a task and not a build.
+            build_info["task_id"] = task_id
+            version = build_info["version"]
+
+        if need_to_install(ctx, role, version):
+            need_install = build_info
+            need_version = version
+    else:
+        builder = get_builder_project()(
+            "kernel",
+            role_config,
+            ctx=ctx,
+            remote=role_remote,
+        )
+        sha1 = builder.sha1
+        log.debug('sha1 for {role} is {sha1}'.format(role=role, sha1=sha1))
+        ctx.summary['{role}-kernel-sha1'.format(role=role)] = sha1
 
-    enable_disable_kdb(ctx, kdb)
+        if need_to_install(ctx, role, sha1):
+            if teuth_config.use_shaman:
+                version = builder.scm_version
+            else:
+                version = builder.version
+            if not version:
+                raise VersionNotFoundError(builder.base_url)
+            need_install = sha1
+            need_version = version
+
+    if need_install:
+        install_firmware(ctx, {role: need_install})
+        download_kernel(ctx, {role: need_install})
+        install_and_reboot(ctx, {role: need_install}, config)
+        wait_for_reboot(ctx, {role: need_version}, timeout, config)
+
+    # enable or disable kdb if specified, otherwise do not touch
+    if role_config.get('kdb') is not None:
+        kdb = role_config.get('kdb')
+        enable_disable_kdb(ctx, {role: kdb})
+            

teuthology/task/lockfile.py

@@ -94,7 +94,7 @@ def task(ctx, config):
                     'wget',
                     '-nv',
                     '--no-check-certificate',
-                    'https://raw.github.com/gregsfortytwo/FileLocker/master/sclockandhold.cpp',
+                    'https://raw.github.com/gregsfortytwo/FileLocker/main/sclockandhold.cpp',
                     '-O', '{tdir}/lockfile/sclockandhold.cpp'.format(tdir=testdir),
                     run.Raw('&&'),
                     'g++', '{tdir}/lockfile/sclockandhold.cpp'.format(tdir=testdir),

teuthology/task/mpi.py

@@ -18,7 +18,7 @@ def _check_mpi_version(remotes):
     for remote in remotes:
         version_str = remote.sh("mpiexec --version")
         try:
-            version = re.search("^\s+Version:\s+(.+)$", version_str, re.MULTILINE).group(1)
+            version = re.search(r"^\s+Version:\s+(.+)$", version_str, re.MULTILINE).group(1)
         except AttributeError:
             raise RuntimeError("Malformed MPI version output: {0}".format(version_str))
         else:
@@ -89,7 +89,7 @@ def task(ctx, config):
     mpiexec = config['exec'].replace('$TESTDIR', testdir)
     hosts = []
     remotes = []
-    master_remote = None
+    main_remote = None
     if 'nodes' in config:
         if isinstance(config['nodes'], str) and config['nodes'] == 'all':
             for role in  teuthology.all_roles(ctx.cluster):
@@ -97,17 +97,17 @@ def task(ctx, config):
                 ip,port = remote.ssh.get_transport().getpeername()
                 hosts.append(ip)
                 remotes.append(remote)
-            (master_remote,) = ctx.cluster.only(config['nodes'][0]).remotes.keys()
+            (main_remote,) = ctx.cluster.only(config['nodes'][0]).remotes.keys()
         elif isinstance(config['nodes'], list):
             for role in config['nodes']:
                 (remote,) = ctx.cluster.only(role).remotes.keys()
                 ip,port = remote.ssh.get_transport().getpeername()
                 hosts.append(ip)
                 remotes.append(remote)
-            (master_remote,) = ctx.cluster.only(config['nodes'][0]).remotes.keys()
+            (main_remote,) = ctx.cluster.only(config['nodes'][0]).remotes.keys()
     else:
         roles = ['client.{id}'.format(id=id_) for id_ in teuthology.all_roles_of_type(ctx.cluster, 'client')]
-        (master_remote,) = ctx.cluster.only(roles[0]).remotes.keys()
+        (main_remote,) = ctx.cluster.only(roles[0]).remotes.keys()
         for role in roles:
             (remote,) = ctx.cluster.only(role).remotes.keys()
             ip,port = remote.ssh.get_transport().getpeername()
@@ -121,17 +121,17 @@ def task(ctx, config):
     if 'workdir' in config:
         workdir = ['-wdir', config['workdir'].replace('$TESTDIR', testdir) ]
 
-    log.info('mpi rank 0 is: {name}'.format(name=master_remote.name))
+    log.info('mpi rank 0 is: {name}'.format(name=main_remote.name))
 
     # write out the mpi hosts file
     log.info('mpi nodes: [%s]' % (', '.join(hosts)))
-    teuthology.write_file(remote=master_remote,
+    teuthology.write_file(remote=main_remote,
                           path='{tdir}/mpi-hosts'.format(tdir=testdir),
                           data='\n'.join(hosts))
-    log.info('mpiexec on {name}: {cmd}'.format(name=master_remote.name, cmd=mpiexec))
+    log.info('mpiexec on {name}: {cmd}'.format(name=main_remote.name, cmd=mpiexec))
     args=['mpiexec', '-f', '{tdir}/mpi-hosts'.format(tdir=testdir)]
     args.extend(workdir)
     args.extend(mpiexec.split(' '))
-    master_remote.run(args=args, )
+    main_remote.run(args=args, )
     log.info('mpi task completed')
-    master_remote.run(args=['rm', '{tdir}/mpi-hosts'.format(tdir=testdir)])
+    main_remote.run(args=['rm', '{tdir}/mpi-hosts'.format(tdir=testdir)])

teuthology/task/pcp.py

@@ -163,7 +163,7 @@ class GraphiteGrapher(PCPGrapher):
             )
             resp = requests.get(url, timeout=GRAPHITE_DOWNLOAD_TIMEOUT)
             if not resp.ok:
-                log.warn(
+                log.warning(
                     "Graph download failed with error %s %s: %s",
                     resp.status_code,
                     resp.reason,

teuthology/task/selinux.py

@@ -24,7 +24,7 @@ class SELinux(Task):
     fail for other denials one can add the overrides with appropriate escapes
     overrides:
        selinux:
-         whitelist:
+         allowlist:
          - 'name="cephtest"'
          - 'dmidecode'
          - 'comm="logrotate"'
@@ -53,6 +53,9 @@ class SELinux(Task):
             if remote.is_vm:
                 msg = "Excluding {host}: VMs are not yet supported"
                 log.info(msg.format(host=remote.shortname))
+            elif remote.is_container:
+                msg = "Excluding {host}: containers are not yet supported"
+                log.info(msg.format(host=remote.shortname))
             elif remote.os.name in ['opensuse', 'sle']:
                 msg = "Excluding {host}: \
                         SELinux is not supported for '{os}' os_type yet"
@@ -130,16 +133,22 @@ class SELinux(Task):
             'comm="setroubleshootd"',
             'comm="rpm"',
             'tcontext=system_u:object_r:container_runtime_exec_t:s0',
+            'comm="ksmtuned"',
+            'comm="sssd"',
+            'comm="sss_cache"',
+            'context=system_u:system_r:NetworkManager_dispatcher_t:s0',
+            'context=system_u:system_r:getty_t:s0',
         ]
-        se_whitelist = self.config.get('whitelist', [])
-        if se_whitelist:
-            known_denials.extend(se_whitelist)
-        ignore_known_denials = '\'\(' + str.join('\|', known_denials) + '\)\''
+        se_allowlist = self.config.get('allowlist', [])
+        if se_allowlist:
+            known_denials.extend(se_allowlist)
+        get_denials_cmd = ['sudo', 'grep', '-a', 'avc: .*denied', '/var/log/audit/audit.log']
+        filter_denials_cmd = ['grep', '-av']
+        for known_denial in known_denials:
+            filter_denials_cmd.extend(['-e', known_denial])
         for remote in self.cluster.remotes.keys():
             proc = remote.run(
-                args=['sudo', 'grep', '-a', 'avc: .*denied',
-                      '/var/log/audit/audit.log', run.Raw('|'), 'grep', '-av',
-                      run.Raw(ignore_known_denials)],
+                args = get_denials_cmd + [run.Raw('|')] + filter_denials_cmd,
                 stdout=StringIO(),
                 check_status=False,
             )