diff mbox series

[meta-selinux] selinux-image: Preserve SELinux contexts in tarballs

Message ID 20251127105115.1117972-1-quic_sasikuma@quicinc.com
State New
Headers show
Series [meta-selinux] selinux-image: Preserve SELinux contexts in tarballs | expand

Commit Message

Sasi Kumar Maddineni Nov. 27, 2025, 10:51 a.m. UTC 
From: Sasi Kumar Maddineni <sasikuma@qti.qualcomm.com>

Tarball images were created without SELinux context information,
causing loss of security labels during extraction while working with
features like:ostree. This breaks SELinux policy enforcement and requires
relabeling after deployment, adding runtime overhead.

Append "--selinux" to IMAGE_CMD_TAR to include SELinux file contexts
when generating tarball images. This ensures security labels are
preserved across image creation and deployment.

Signed-off-by: Sasi Kumar Maddineni <quic_sasikuma@quicinc.com>
---
 classes/selinux-image.bbclass | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/classes/selinux-image.bbclass b/classes/selinux-image.bbclass
index b4f9321..852db5f 100644
--- a/classes/selinux-image.bbclass
+++ b/classes/selinux-image.bbclass
@@ -26,4 +26,6 @@  python selinux_setlabels_handler() {
 addhandler selinux_setlabels_handler
 selinux_setlabels_handler[eventmask] = "bb.event.RecipePreFinalise"
 
+IMAGE_CMD_TAR:append = " --selinux"
+
 inherit core-image