diff mbox series

[wic] partition.py: restore selinux label for fstab

Message ID 20260417031417.583413-1-yi.zhao@windriver.com
State New
Headers show
Series [wic] partition.py: restore selinux label for fstab | expand

Commit Message

Yi Zhao April 17, 2026, 3:14 a.m. UTC 
When SELinux is enabled, all files within a wic image retain their
SELinux labels except for /etc/fstab, which is replaced by a newly
generated one during the build, causing its extended attributes to be
lost.

Restore the SELinux context on the new fstab using debugfs ea_get and
ea_set commands, ensuring all files are correctly labeled at build time
and avoiding a full SELinux relabel on first boot.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
---
 src/wic/partition.py | 11 +++++++++++
 1 file changed, 11 insertions(+)
diff mbox series

Patch

diff --git a/src/wic/partition.py b/src/wic/partition.py
index 435d31d..506ef2b 100644
--- a/src/wic/partition.py
+++ b/src/wic/partition.py
@@ -362,10 +362,21 @@  class Partition():
 
         if self.updated_fstab_path and self.has_fstab and not self.no_fstab_update:
             debugfs_script_path = os.path.join(cr_workdir, "debugfs_script")
+            fstab_label_path = os.path.join(cr_workdir, "fstab.selinuxlabel")
+            with open(debugfs_script_path, "w") as f:
+                f.write("cd etc\n")
+                # Retrieve fstab selinux label
+                f.write("ea_get -f %s fstab security.selinux\n" % (fstab_label_path))
+            debugfs_cmd = "debugfs -w -f %s %s" % (debugfs_script_path, rootfs)
+            exec_native_cmd(debugfs_cmd, native_sysroot)
+
             with open(debugfs_script_path, "w") as f:
                 f.write("cd etc\n")
                 f.write("rm fstab\n")
                 f.write("write %s fstab\n" % (self.updated_fstab_path))
+                if os.path.isfile(fstab_label_path) and os.path.getsize(fstab_label_path) > 0:
+                    # Restore fstab selinux label
+                    f.write("ea_set -f %s fstab security.selinux\n" % (fstab_label_path))
             debugfs_cmd = "debugfs -w -f %s %s" % (debugfs_script_path, rootfs)
             exec_native_cmd(debugfs_cmd, native_sysroot)