Setting/fixind SELinux context in build time

[arturasb]

Hi.

I'd like to hear your advice on setting/fixing SELinux context on files in build time. I'm new to the subject, pardon my silly questions :)
I needed to fix SELinux contexts for systemd-homed executables. As Fedora haven't included those specific policies to the install yet, as a workaround I layered a RPM from my github and added a script snipped to the recipe file to execute restorecon command on required files in /usr/lib/systemd/. As layering and the restorecon were successful during the build, I assumed that systemd-homed files in the /usr/lib/systemd/ got proper SELinux contexts and all this will be copied to my installation during rebasing. Apparently it didn't happen and I wonder what would be the proper approach for such situation from build/recipe.yml perspective - to fix SElinux contexts of read-only portion of file system.

Thanks in advance.

Regards
ArtūrasB.

[xynydev]

I'm not terribly familiar with SELinux, unfortunately. I suggest asking on the Universal Blue Discourse forum or their Discord. Or maybe @fiftydinar knows something about this?

[fiftydinar]

I am not familiar with SeLinux too, maybe solution for selinux permissions on Cosmic Greeter can be looked up to for inspiration as a run-time solution:

https://github.com/ublue-os/cosmic/blob/38bc22518edf7f7673c8348b598e41c0908e9353/greetd-workaround.service

[arturasb]

Ok, that's something I'll try and report back here the result. Thanks !

[arturasb]

A workaround service helped, but I had to make it run once as it requires remounting /usr read-write and reboot is needed to mount read-only afterwards. So, it is a workaround.