diff mbox series

[meta-selinux] selinux-image.bbclass: fix selinux_set_labels

Message ID 20260819060857.274091-1-chenqi_hycx@cetc.com.cn
State New
Headers show
Series [meta-selinux] selinux-image.bbclass: fix selinux_set_labels | expand

Commit Message

chenqi_hycx@cetc.com.cn Aug. 19, 2026, 6:08 a.m. UTC 
From: Chen Qi <chenqi_hycx@cetc.com.cn>

1. The selinux_set_labels needs to be run before reproducible_final_image_task.
2. The ';' needs to be removed, as it's useless and it will prevent
   selinux_set_labels to have the correct function contents value,
   causing signature calculation not depending on the function's
   contents.
3. Add a bbnote to give users more information. The command is a
   key one, and it's useful that users know what is running.

Signed-off-by: Chen Qi <chenqi_hycx@cetc.com.cn>
---
 classes/selinux-image.bbclass | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/classes/selinux-image.bbclass b/classes/selinux-image.bbclass
index 852db5f..97ff99e 100644
--- a/classes/selinux-image.bbclass
+++ b/classes/selinux-image.bbclass
@@ -1,6 +1,7 @@ 
 selinux_set_labels() {
     if [ -f ${IMAGE_ROOTFS}/${sysconfdir}/selinux/config ]; then
         POL_TYPE=$(sed -n -e "s&^SELINUXTYPE[[:space:]]*=[[:space:]]*\([0-9A-Za-z_]\+\)&\1&p" ${IMAGE_ROOTFS}/${sysconfdir}/selinux/config)
+	bbnote "Running setfiles -m -r ${IMAGE_ROOTFS} ${IMAGE_ROOTFS}/${sysconfdir}/selinux/${POL_TYPE}/contexts/files/file_contexts ${IMAGE_ROOTFS}"
         if ! setfiles -m -r ${IMAGE_ROOTFS} ${IMAGE_ROOTFS}/${sysconfdir}/selinux/${POL_TYPE}/contexts/files/file_contexts ${IMAGE_ROOTFS}
         then
             bbwarn "Failed to set security contexts. Restoring security contexts will run on first boot."
@@ -19,7 +20,7 @@  python selinux_setlabels_handler() {
     if d.getVar('FIRST_BOOT_RELABEL') == '1':
         return
 
-    d.appendVar('IMAGE_PREPROCESS_COMMAND', ' selinux_set_labels; ')
+    d.prependVar('IMAGE_PREPROCESS_COMMAND', ' selinux_set_labels ')
     d.appendVarFlag('do_image', 'depends', ' policycoreutils-native:do_populate_sysroot')
 }