Commits on Nov 27, 2023

1. prepare.sh: label osbuild,setfiles "correctly" in the container …

   When running osbuild inside a container the selinux setup is slightly
   different from a non container setup:
   
   Inside the container all files under "/" in the overlayfs have the label
   `system_u:object_r:container_files_t`. This includes `/usr/bin/osbuild`
   and `/usr/sbin/setfiles`. Because the container is using an overlayfs
   the files cannot directly relabled under "/" with the correct selinux
   labels. This is why `prepare.sh` creates a tmpfs and relabels there
   and bind mounts back.
   
   This commit tweaks this mechanism now to create labels that are
   closer to a real selinux system. I.e. it will:
   1. label /usr/bin/osbuild as `osbuild_exec_t`
   2. label /usr/sbin/setfiles as `setfiles_exec_t`
   
   With that the normal transition rules work, i.e. osbuild_exec_t can
   transition to mount_t and when setfiles is called it will automatically
   use `setfiles_exec_t`.

   

   mvo5 committed Nov 27, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 8c5b97e
   • Browse repository at this point

   Copy the full SHA

   8c5b97e View commit details

   Browse the repository at this point in the history