lsm: treat unlabeled_t SELinux context as unlabeled for relabeling - #2368
Open
joelcapitao wants to merge 1 commit into
Open
lsm: treat unlabeled_t SELinux context as unlabeled for relabeling#2368joelcapitao wants to merge 1 commit into
unlabeled_t SELinux context as unlabeled for relabeling#2368joelcapitao wants to merge 1 commit into
Conversation
Modify `has_security_selinux()` to return `Unlabeled` when a file has the `unlabeled_t` SELinux type. This ensures files created in permissive mode (where the kernel does not apply type transitions) get properly relabeled during `bootc install to-filesystem`. Previously, files with `unlabeled_t` were considered "already labeled" and skipped during relabeling passes, causing SELinux policy mismatches on the final disk image. Note that `/sysroot/boot` cannot be relabeled when it is masked by a mounted filesystem (e.g., when osbuild pre-mounts the boot partition). This is acceptable because `/sysroot/boot` is primarily used as a potential mount point for the boot partition, created by `ostree admin init-fs`. In the final booted system, `/boot` is mounted separately and its contents are properly labeled. Assisted-by: OpenCode (Claude Opus 4.5)
cgwalters
reviewed
Aug 5, 2026
Comment on lines
+267
to
+268
| // This can happen when files are created with SELinux in permissive mode, | ||
| // where the kernel doesn't apply type transitions and assigns unlabeled_t. |
Collaborator
There was a problem hiding this comment.
I don't think it's true that permissive mode doesn't do type transitions
| // This can happen when files are created with SELinux in permissive mode, | ||
| // where the kernel doesn't apply type transitions and assigns unlabeled_t. | ||
| let label = std::str::from_utf8(&buf[..len]).unwrap_or(""); | ||
| if label.contains(":unlabeled_t:") { |
Collaborator
There was a problem hiding this comment.
I'm not happy about parsing security contexts like this, there's official APIs for this
I also don't want to hardcode unlabeled_t ideally.
Hmmmmmm...I think what's giong on here is the kernel returns this type when the xattr is missing - maybe ideally we can figure out a way to query that state. I bet the stock selinux userspace tooling has code for this.
| // Check if the label is unlabeled_t - treat it as unlabeled. | ||
| // This can happen when files are created with SELinux in permissive mode, | ||
| // where the kernel doesn't apply type transitions and assigns unlabeled_t. | ||
| let label = std::str::from_utf8(&buf[..len]).unwrap_or(""); |
Collaborator
There was a problem hiding this comment.
Silently discarding non-UTF8 security contexts feels odd, we can just scan bytes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Modify
has_security_selinux()to returnUnlabeledwhen a file has theunlabeled_tSELinux type. This ensures files created in permissive mode (where the kernel does not apply type transitions) get properly relabeled duringbootc install to-filesystem.Previously, files with
unlabeled_twere considered "already labeled" and skipped during relabeling passes, causing SELinux policy mismatches on the final disk image.Note that
/sysroot/bootcannot be relabeled when it is masked by a mounted filesystem (e.g., when osbuild pre-mounts the boot partition). This is acceptable because/sysroot/bootis primarily used as a potential mount point for the boot partition, created byostree admin init-fs. In the final booted system,/bootis mounted separately and its contents are properly labeled.Assisted-by: OpenCode (Claude Opus 4.5)