I don't exactly know where to post this, but I guess I have everyone's
attention on this thread.
Attached are patches which work for me. They could really do with
review from someone who knows what they're doing. They also need much
more testing than I've done, but I'll be doing that myself later.
The first patch (against libselinux) sets SELinux to Permissive mode
early in boot if the /.autorelabel file is found (or autorelabel on
the command line).
The second patch (against policycoreutils in Fedora) implements the
generator itself.
Some problems I found:
- It would be nice if systemd defined a %{_generatorsdir} RPM macro.
- I couldn't get it to work only depending on local-fs.target. I had
to depend on sysinit.target. With local-fs.target, /boot could not
be mounted, so there may be something broken/missing in
local-fs.target.
- There seems to be no upstream for selinux-autorelabel* since it was
moved from systemd. It looks like the only upstream is Fedora's
policycoreutils itself. Maybe I missed something there.
Rich.
--
Richard Jones, Virtualization Group, Red Hat
http://people.redhat.com/~rjones
Read my programming and virtualization blog:
http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines. Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v