Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

repo: Don't try to perform labeling if SELinux is disabled #1667

Merged
merged 1 commit into from
Jun 24, 2024
Merged

repo: Don't try to perform labeling if SELinux is disabled #1667

merged 1 commit into from
Jun 24, 2024

Commits on Jun 19, 2024

  1. repo: Don't try to perform labeling if SELinux is disabled 

    The default for container execution is that `/sys/fs/selinux`
is not mounted, and the libselinux library function `is_selinux_enabled`
should be used to dynamically check if the system should attempt to perform SELinux labeling.

This is how it's done by rpm, ostree, and systemd for example.

But this code unconditionally tries to label if it finds a policy,
which breaks in an obscure corner case
when executed inside a container that includes policy files (e.g.
fedora/rhel-bootc) but when we're not using overlayfs for the backend
(with BUILDAH_BACKEND=vfs).
    @cgwalters @jan-kolarik
    cgwalters authored and jan-kolarik committed Jun 19, 2024
    Configuration menu
    Copy the full SHA
    5a838d7 View commit details
    Browse the repository at this point in the history