libostree: write selinux xattr when on non-selinux systems

[mvo5]

Currently when writing data for selinux systems on a non-selinux system there will be no labels. This is because
ostree_sepolicy_setfscreatecon() just returns TRUE on non-selinux systems and xattr writing for security.seliux is filtered out.

This patches uses the suggestion of Colin Walters (thanks!) from #2804 and detects if the host has selinux enabled and if not just skips filtering the xattrs for selinux.

[draft as this will need a test (and validation of the basic approach by someone experienced) and I will need a hint how to best test this]

[openshift-ci]

Hi @mvo5. Thanks for your PR.

I'm waiting for a ostreedev member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[cgwalters]

/ok-to-test

[cgwalters]

[draft as this will need a test (and validation of the basic approach by someone experienced) and I will need a hint how to best test this]

I can help with a test case

[cgwalters]

#3152 will help verify this, though to make it work we'll want to add a "no really try to use selinux even on non-selinux" host arg to bootc install.

Alternatively we can just do a direct ubuntu deploy here too, I can look at that.

[mvo5]

#3152 will help verify this, though to make it work we'll want to add a "no really try to use selinux even on non-selinux" host arg to bootc install.

Alternatively we can just do a direct ubuntu deploy here too, I can look at that.

Thank you!, I really appreciate the quick reply here I have no opinion about the best approach here and will happily follow your lead. I will just need a few hints how to best approach this. Alternatively feel free to push directly to this PR or I can mark it ready and we test indirectly via the approaches outlined. I am happy either way :)

[cgwalters]

OK containers/bootc#293 helps us get farther here for testing.

And yes...trying this out I notice that yep, we are not handling the labeling for all of the "basic infrastructure dirs" here, like /ostree/deploy etc. I will look at that in the background, it's going to be a bit of a can of worms though.

[cgwalters]

I did containers/bootc#294 push this farther, but there's definitely still that can of worms.

[cgwalters]

I've updated this with a test, and this verifies that it improves things as we now correctly have labels for etc in the deployment root where we didn't before.

[mvo5]

I've updated this with a test, and this verifies that it improves things as we now correctly have labels for etc in the deployment root where we didn't before.

Thank you! Very nice how straightforward it was to add a small test for this.

[cgwalters]

@mvo5 just one more bug to fix here, we need to handle the build without selinux enabled, xref https://github.com/ostreedev/ostree/actions/runs/7809000169/job/21300094068?pr=3151

[cgwalters]

/ok-to-test