mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2026-03-05 05:22:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

build_library: Relabel the whole filesystem

Browse Source 
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
This commit is contained in:
Krzesimir Nowak 2025-09-05 15:53:51 +02:00
parent 3c39115be8
commit 4de4fc23b1
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
build_library/build_image_util.sh
View File

@ -721,11 +721,19 @@ EOF
# The labeling has to be done before moving /etc to /usr/share/flatcar/etc to prevent wrong labels for these files and as
# the relabeling on boot would cause upcopies in the overlay.
if pkg_use_enabled coreos-base/coreos selinux; then
# TODO: Breaks the system:
# sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"
# sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"/usr
# For now we only try it with /etc
sudo setfiles -Dv -r "${root_fs_dir}" "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}"/etc
# -D - set or update any directory SHA1 digests
# -E - treat conflicting specifications as errors
# -F - force reset of context to match file_context
# -r path - set root path
# -v - show changes in file labels
# -T 0 - use as many threads as there are cores
info "Relabeling the filesystem at ${root_fs_dir@Q}"
local path
# We do not run relabeling on /boot, it's FAT anyway, so no
# support for xattrs there.
for path in / /usr /oem; do
sudo setfiles -D -E -F -r "${root_fs_dir}" -v -T 0 "${root_fs_dir}"/etc/selinux/mcs/contexts/files/file_contexts "${root_fs_dir}${path}"
done
fi
# Temporary hack: set group ownership of /etc/{g,}shadow to the