diff --git a/0004-Selinux-labelling-inside-chroot.patch b/0004-Selinux-labelling-inside-chroot.patch new file mode 100644 index 0000000..35b23f4 --- /dev/null +++ b/0004-Selinux-labelling-inside-chroot.patch @@ -0,0 +1,32 @@ +From a040d5571473f6266764c758835e71ecb301d10b Mon Sep 17 00:00:00 2001 +From: Mikhail Novosyolov +Date: Sat, 7 Sep 2019 15:13:45 +0300 +Subject: [PATCH] Selinux labelling inside chroot + +Label the fs according to selinux policy inside that fs instead of labeling from out side the target chroot. +In the second case the policy from the host was used instead of the policy from the target chroot. +--- + imgcreate/creator.py | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/imgcreate/creator.py b/imgcreate/creator.py +index 9a07f62..cb1c742 100644 +--- a/imgcreate/creator.py ++++ b/imgcreate/creator.py +@@ -459,10 +459,10 @@ class ImageCreator(object): + subprocess.call(arglist, close_fds = True) + + if kickstart.selinux_enabled(self.ks): +- # label the fs like it is a root before the bind mounting +- arglist = ["/sbin/setfiles", "-F", "-r", self._instroot, selinux.selinux_file_context_path(), self._instroot] ++ # label the fs according to selinux policy inside that fs ++ arglist = ["/sbin/setfiles", "-F", "-p", selinux.selinux_file_context_path(), "/"] + print("Running SELinux relabling: ", arglist) +- subprocess.call(arglist, close_fds = True) ++ subprocess.call(arglist, preexec_fn=self.chroot, close_fds = True) + # these dumb things don't get magically fixed, so make the user generic + # if selinux exists on the host we need to lie to the chroot + if selinux.is_selinux_enabled(): +-- +2.20.1 + diff --git a/livecd-tools.spec b/livecd-tools.spec index 7d1b4b1..f5bbd80 100644 --- a/livecd-tools.spec +++ b/livecd-tools.spec @@ -3,7 +3,7 @@ Summary: Tools for building live CDs Name: livecd-tools Version: 21.1 -Release: 60 +Release: 61 Epoch: 1 License: GPLv2+ Group: System/Base @@ -36,6 +36,7 @@ Patch23: livecd-tools-21.1-genisoimage.patch Patch24: 0001-Run-setfiles-after-chroot.patch Patch25: 0002-Get-system-architecture-by-bin-sh-executable-instead.patch Patch26: 0003-Debug-SELinux-relabling-print-arguements-of-setfiles.patch +Patch27: 0004-Selinux-labelling-inside-chroot.patch Requires: python-imgcreate = %{EVRD} Requires: dosfstools