lsm: Forcibly relabel all initial state #294
Conversation
This is attempting to handle the "install selinux-enabled target from selinux-disabled host". We're kind of papering over effectively ostree design bugs here as in this case libostree itself should be setting the labels, but doing that is a bit hard and awkward right now. Signed-off-by: Colin Walters <[email protected]>
|
Skipping CI for Draft Pull Request. |
See containers/bootc#294 This is particularly motivated by CentOS/centos-bootc-dev#27 because with that suddenly `dnf` will appear to start working but trying to do anything involving the kernel (i.e. mutating `/boot`) will end in sadness, and this puts a stop to that. (This also relates of course to ye olde osbuild#18 where we want the partitioning setup in the default case to come from the container) Signed-off-by: Colin Walters <[email protected]>
See containers/bootc#294 This is particularly motivated by CentOS/centos-bootc-dev#27 because with that suddenly `dnf` will appear to start working but trying to do anything involving the kernel (i.e. mutating `/boot`) will end in sadness, and this puts a stop to that. (This also relates of course to ye olde osbuild#18 where we want the partitioning setup in the default case to come from the container) Signed-off-by: Colin Walters <[email protected]>
|
This seems like a good idea to me, but I'm not sure I have a good enough grasp of all the moving parts to ack it :) Also, is there any testing that would cover this, or does the current test suite passing inherently prove it doesn't break things? |
See containers/bootc#294 This is particularly motivated by CentOS/centos-bootc-dev#27 because with that suddenly `dnf` will appear to start working but trying to do anything involving the kernel (i.e. mutating `/boot`) will end in sadness, and this puts a stop to that. (This also relates of course to ye olde osbuild#18 where we want the partitioning setup in the default case to come from the container) Signed-off-by: Colin Walters <[email protected]>
See containers/bootc#294 This is particularly motivated by CentOS/centos-bootc-dev#27 because with that suddenly `dnf` will appear to start working but trying to do anything involving the kernel (i.e. mutating `/boot`) will end in sadness, and this puts a stop to that. (This also relates of course to ye olde #18 where we want the partitioning setup in the default case to come from the container) Signed-off-by: Colin Walters <[email protected]>
Just to explain this a bit...the (That said increasingly I'm thinking at least |
|
Actually forgot I'd started on this one here. This is obsoleted by #397 |
This is attempting to handle the "install selinux-enabled target from selinux-disabled host". We're kind of papering over effectively ostree design bugs here as in this case libostree itself should be setting the labels, but doing that is a bit hard and awkward right now.