setting the right selinux labels for sharing about coreos-assembler HOT 4 CLOSED

Don't use :z; set the file context ahead of time. (Or use :Z but it's saner IMO to set it ahead of time and don't relabel when running).

from coreos-assembler.

https://github.com/cgwalters/sysmgmt-personal/blob/1a80118b5928b16d3a5e2821893b776f52b20a75/vanadium/provision-root.sh#L43

from coreos-assembler.

Don't use :z; set the file context ahead of time.

yep that's what I've been doing. From the readme PR you can see that i propose to use

$ mkdir ./srv-coreos                         
$ setfacl -d -m u:1000:rwx ./srv-coreos      
$ chcon -Rt svirt_sandbox_file_t ./srv-coreos
$ cd ./srv-coreos                            

https://github.com/cgwalters/sysmgmt-personal/blob/1a80118b5928b16d3a5e2821893b776f52b20a75/vanadium/provision-root.sh#L43

cool I think that helps. I see you have chcon system_u:object_r:container_file_t:s0 /var/srv so I think maybe I'm missing the s0 part in my chcon command. Will test that out.

Thanks @cgwalters

from coreos-assembler.

so that didn't seem to help. I did some digging and it seems like the only file that gets the MCS labels are the actual qcows themselves. I wonder if virt-install/libvirt is adding them.

from coreos-assembler.