From 8ecad12b2ccb612fdf4906392d26fa6bfae20460 Mon Sep 17 00:00:00 2001 From: George McCollister Date: Tue, 22 May 2018 09:47:12 -0500 Subject: selinux-image: fix labeling on non-seclabel mounts Use -m to prevent non-seclabel mounts from being excluded from labeling. After the following commit setfiles will no longer label files on a mount other than / if it doesn't have seclabel listed in /proc/mounts: https://github.com/SELinuxProject/selinux/commit/f2e77865e144ab2e1313aa78d99b969f8f48695e#diff-2de9aefdd8fc5bc6a8740533e5d1cc2e Signed-off-by: George McCollister Signed-off-by: Joe MacDonald --- classes/selinux-image.bbclass | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'classes') diff --git a/classes/selinux-image.bbclass b/classes/selinux-image.bbclass index 90ead2f..5174dc5 100644 --- a/classes/selinux-image.bbclass +++ b/classes/selinux-image.bbclass @@ -1,6 +1,6 @@ selinux_set_labels () { POL_TYPE=$(sed -n -e "s&^SELINUXTYPE[[:space:]]*=[[:space:]]*\([0-9A-Za-z_]\+\)&\1&p" ${IMAGE_ROOTFS}/${sysconfdir}/selinux/config) - if ! setfiles -r ${IMAGE_ROOTFS} ${IMAGE_ROOTFS}/${sysconfdir}/selinux/${POL_TYPE}/contexts/files/file_contexts ${IMAGE_ROOTFS} + if ! setfiles -m -r ${IMAGE_ROOTFS} ${IMAGE_ROOTFS}/${sysconfdir}/selinux/${POL_TYPE}/contexts/files/file_contexts ${IMAGE_ROOTFS} then echo WARNING: Unable to set filesystem context, setfiles / restorecon must be run on the live image. touch ${IMAGE_ROOTFS}/.autorelabel -- cgit v1.2.3-54-g00ecf