root filesystem label is container_file_t when it should be root_t #149
Description
Migrating this back from CentOS/centos-bootc#184
Because we want to be able to add a proper Closes in this repository.
One thing I notice here...and I'm not yet certain if it's a bib regression or not, but looking at the disk image before it's booted:
$ guestfish --ro -a disk.qcow2
><fs> run
list-filesystems
><fs> list-filesystems
/dev/sda1: unknown
/dev/sda2: vfat
/dev/sda3: ext4
/dev/sda4: ext4
><fs> mount /dev/sda4 /
><fs> getxattrs /
[0] = {
attrname: security.selinux
attrval: system_u:object_r:container_file_t:s0\x00
}
><fs>
That's just really broken, we shouldn't end up with a physical disk image root labeled container_file_t! It looks like actually all of the labels up to the deployment root are similarly broken (they should be something like root_t or usr_t).
However once we get to the deployment things are fine:
><fs> getxattrs /ostree/deploy/default/deploy/3ef1290eacdb05e50127ed5a920e264f228dae248addb10d98224a2e04918c2c.0/etc/fstab
[0] = {
attrname: security.selinux
attrval: system_u:object_r:etc_t:s0\x00
}
><fs> getxattrs /ostree/deploy/default/deploy/3ef1290eacdb05e50127ed5a920e264f228dae248addb10d98224a2e04918c2c.0/etc/passwd
[0] = {
attrname: security.selinux
attrval: system_u:object_r:passwd_file_t:s0\x00
}
><fs>
And it's specifically that /ostree/deploy/default/backing is also container_file_t, and the overlayfs picks up that context and that breaks everything.