diff options
| author | Daan De Meyer <daan.j.demeyer@gmail.com> | 2024-07-09 12:26:11 +0200 |
|---|---|---|
| committer | Daan De Meyer <daan.j.demeyer@gmail.com> | 2024-07-10 18:52:29 +0200 |
| commit | dedd712dd9b4883678765b9bc1a8ac349cf24f3b (patch) | |
| tree | 583ad04649c6a0200c26b4fa363f70fe5406677f /mkosi.extra | |
| parent | mkosi: Don't fail if /var/log/journal does not exist (diff) | |
| download | systemd-dedd712dd9b4883678765b9bc1a8ac349cf24f3b.tar.xz systemd-dedd712dd9b4883678765b9bc1a8ac349cf24f3b.zip | |
TEST-06-SELINUX: Various fixes
- Stop installing the policy in the initramfs as it's not really
supported anyway (https://github.com/fedora-selinux/selinux-policy/issues/2221)
- Stop relabeling on first boot and prefer to do it at image build time
- Disable mkosi relabeling by default but enable it in CI
- Build image as root in CI so the SELinux relabeling works properly
Diffstat (limited to 'mkosi.extra')
| -rw-r--r-- | mkosi.extra/.autorelabel | 0 | ||||
| -rw-r--r-- | mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset | 6 |
2 files changed, 3 insertions, 3 deletions
diff --git a/mkosi.extra/.autorelabel b/mkosi.extra/.autorelabel deleted file mode 100644 index e69de29bb2..0000000000 --- a/mkosi.extra/.autorelabel +++ /dev/null diff --git a/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset b/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset index c3640585e5..5a15e6bcbb 100644 --- a/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset +++ b/mkosi.extra/usr/lib/systemd/system-preset/00-mkosi.preset @@ -32,10 +32,10 @@ disable auditd.service # systemd-timesyncd is not enabled by default in the default systemd preset so enable it here instead. enable systemd-timesyncd.service -# Skipped if selinux is not enabled, required for TEST-06-SELINUX. -enable autorelabel.service - # Enabled by default on OpenSUSE and not conditioned out in containers, so let's disable these here instead. disable iscsi.service disable iscsid.socket disable iscsiuio.socket + +# mkosi relabels the image itself so no need to do it on boot. +disable selinux-autorelabel-mark.service |