[PATCH] rpmostreepayload: Drop selinux-ensure-labeled call

Colin Walters walters at verbum.org
Tue Jul 8 19:16:36 UTC 2014


On Tue, Jul 8, 2014, at 12:00 PM, Colin Walters wrote:

> In contrast, Anaconda requires install ~= target, and boots with a
> loaded policy in permissive mode.  Any stray files we create will at
> least be labeled in some form.

Note the effect right now is that /sysroot (the physical root storage)
and hence /sysroot/ostree is root_t.  Which is actually odd, since if I
just "mkdir /blah" on a mainline rawhide system I get it as default_t.  

( One can't just mkdir /blah on an OSTree system since
https://bugzilla.gnome.org/show_bug.cgi?id=728006 )

I'll talk to the SELinux folks about what this should be, but the bottom
line is pretty much nothing except ostree should be touching the system
root directory, and it runs as install_exec_t with maximum privileges,
so the final label shouldn't matter much.

If it should be something else though, I'll figure out how to get
Anaconda to label it right.


More information about the anaconda-patches mailing list