shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-03-08 08:58:27 +03:00
Code

mkosi: Disable selinux labelling and install policy in initramfs

Browse Source 
It is necessary to install the selinux policy in the initramfs
so that userland is entered with the correct label.

SELinuxRelabel defaults to auto, which will skip if the relabelling
command is not installed and will treat failure to relabel as non-fatal.

We can't force it on because root privileges are required if the labels
don't exist on the host system and we would like to be able to
cross-build from other distributions.

Since we are already committed to relabelling on first boot
there is no value in even trying to label.
This commit is contained in:
Richard Maw 2024-04-30 17:23:02 +01:00
parent a2a734e737
commit e26efe09f3
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
mkosi.images/system/mkosi.conf.d/10-centos-fedora/mkosi.conf.d/10-selinux.conf
View File

@ -10,3 +10,11 @@ Packages=
selinux-policy
selinux-policy-targeted
setools-console
# We relabel on first boot instead of at build time because it is only possible to label without root
# if the labels exist in the host system, and we want to be able to cross-build to other distributions.
SELinuxRelabel=no
InitrdPackages=
selinux-policy
selinux-policy-targeted