Skip to content

install: Add final SELinux relabel of the physical root filesystem #2035

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jeckersb wants to merge 1 commit into
base: main
Choose a base branch
from
Open

install: Add final SELinux relabel of the physical root filesystem #2035

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions crates/lib/src/install.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1970,6 +1970,32 @@ async fn install_to_filesystem_impl(
ostree_install(state, rootfs, cleanup).await?;
}

// As the very last step before filesystem finalization, do a full SELinux
// relabel of the physical root filesystem. We skip ostree/deploy because
Copy link
Collaborator

@cgwalters cgwalters Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think (but there's $details here) we actually need to precisely skip deployment roots not just all of ostree/deploy.

However...can't we also drop the current ostree-only relabeling step with this? That would really prove things out.

Copy link
Collaborator Author

@jeckersb jeckersb Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a difference in the labeling between ostree-with-composefs vs ostree-without-composefs? In the composefs case I don't think it matters too much how accurate the labels are since the source of truth ends up in the erofs (but does it populate the erofs from the underlying files? I admit I haven't looked too much into that before now...).

But in the non-composefs case (do we even use that anywhere?) the labels are the final labels.

Copy link
Collaborator

@cgwalters cgwalters Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a difference in the labeling between ostree-with-composefs vs ostree-without-composefs? In the composefs case I don't think it matters too much how accurate the labels are since the source of truth ends up in the erofs (but does it populate the erofs from the underlying files? I admit I haven't looked too much into that before now...).

There's not a difference AFAIK no, but a problem is that in the ostree code path we still sometimes for legacy reasons operate directly on a deployment root without the EROFS (running semodule e.g.) and so the labels need to be correct on the underlying files still too.

Anyways though what we're trying to solve here is the labeling of everything else; ostree should be getting labels of the deployment root correct.

// the contents there are already correctly labeled as part of the
// container image deployment.
if let Some(policy) = state.load_policy()? {
tracing::info!("Performing final SELinux relabeling of physical root");
let skip_devino =
if let Some(deploy_dir) = rootfs.physical_root.open_dir_optional("ostree/deploy")? {
let deploy_meta = deploy_dir.dir_metadata()?;
Some((deploy_meta.dev(), deploy_meta.ino()))
} else {
tracing::debug!("No ostree/deploy directory found; relabeling everything");
None
};
let mut path = Utf8PathBuf::from("");
crate::lsm::ensure_dir_labeled_recurse(
&rootfs.physical_root,
&mut path,
&policy,
skip_devino,
)
.context("Final SELinux relabeling of physical root")?;
} else {
tracing::debug!("Skipping final SELinux relabel (SELinux is disabled)");
}

// Finalize mounted filesystems
if !rootfs.skip_finalize {
let bootfs = rootfs.boot.as_ref().map(|_| ("boot", "boot"));
Expand Down
Loading