Repository navigation
composefs: Add selinux policy finalization #2511
Description
Something like ostreedev/ostree#2569 also cc ostreedev/ostree#3649
There's a lot of nontrivial code related to this in ostree using bwrap etc - would need some design discussion to apply here
Activity
cgwalters commentedon Sep 28, 2026
@cgwalters-bot take a look on a spike for this one
composefs: Rebuild SELinux policy when finalizing a staged deployment
cgwalters-bot commentedon Sep 28, 2026
Spike done: this ports cleanly and is simpler than ostree's. Right after the /etc merge in
composefs-finalize-staged, we mount the staged EROFS, chroot into it with the existingChrootCmd(no bwrap) with the merged /etc bound over it, and runsemodule -N --refresh. systemd loads the policy from the deployment's state /etc after switch-root, so nothing in the UKI or the sealed EROFS changes.PoC with a new tmt test (a local module plus a policy change in the new image, across a
bootc switch): it passes on composefs (grub/BLS, unsealed) and ostree, and fails on current main, where the new image's policy is silently dropped. cgwalters-forge#31Like ostree, the PoC treats a refresh failure as fatal, which is the ostree#3563 wedge risk. Design, options and open questions (mainly that failure policy and a stage-time check): https://gist.github.com/cgwalters-bot/7fa03dcf6c3866961aed7d5199366aaa
Generated-by: https://github.com/cgwalters/#llms
RoyalOughtness commentedon Oct 1, 2026
FYI for those running into issues caused by this: a quick
semodule -Bwill work around it it (until the next policy update)