From 4b022384edc5ecafc3437fae7bab9045f554d19d Mon Sep 17 00:00:00 2001 From: Joel Capitao Date: Thu, 30 Jul 2026 11:32:52 +0200 Subject: [PATCH] lsm: treat `unlabeled_t` SELinux context as unlabeled for relabeling Modify `has_security_selinux()` to return `Unlabeled` when a file has the `unlabeled_t` SELinux type. This ensures files created in permissive mode (where the kernel does not apply type transitions) get properly relabeled during `bootc install to-filesystem`. Previously, files with `unlabeled_t` were considered "already labeled" and skipped during relabeling passes, causing SELinux policy mismatches on the final disk image. Note that `/sysroot/boot` cannot be relabeled when it is masked by a mounted filesystem (e.g., when osbuild pre-mounts the boot partition). This is acceptable because `/sysroot/boot` is primarily used as a potential mount point for the boot partition, created by `ostree admin init-fs`. In the final booted system, `/boot` is mounted separately and its contents are properly labeled. Assisted-by: OpenCode (Claude Opus 4.5) --- crates/lib/src/lsm.rs | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/crates/lib/src/lsm.rs b/crates/lib/src/lsm.rs index 2c059406df..766df5e8ba 100644 --- a/crates/lib/src/lsm.rs +++ b/crates/lib/src/lsm.rs @@ -262,7 +262,17 @@ pub(crate) fn has_security_selinux(root: &Dir, path: &Utf8Path) -> Result Ok(SELinuxLabelState::Labeled), + Ok(len) => { + // Check if the label is unlabeled_t - treat it as unlabeled. + // This can happen when files are created with SELinux in permissive mode, + // where the kernel doesn't apply type transitions and assigns unlabeled_t. + let label = std::str::from_utf8(&buf[..len]).unwrap_or(""); + if label.contains(":unlabeled_t:") { + Ok(SELinuxLabelState::Unlabeled) + } else { + Ok(SELinuxLabelState::Labeled) + } + } Err(rustix::io::Errno::OPNOTSUPP) => Ok(SELinuxLabelState::Unsupported), Err(rustix::io::Errno::NODATA) => Ok(SELinuxLabelState::Unlabeled), Err(e) => Err(e).with_context(|| format!("Failed to look up context for {path:?}")),