export: Add --warn-unlabeled flag for SELinux label handling - #2446
Open
gursewak1997 wants to merge 1 commit into
Open
export: Add --warn-unlabeled flag for SELinux label handling#2446gursewak1997 wants to merge 1 commit into
gursewak1997 wants to merge 1 commit into
Conversation
cgwalters
reviewed
Sep 9, 2026
cgwalters
left a comment
cgwalters
left a comment
Collaborator
There was a problem hiding this comment.
Files with no matching policy rule cause a hard error, forcing users to pass --disable-selinux which loses all labels. Customers then need external scripts to reapply labels after extraction.
Wait but did this customer not know that one can add custom file paths?
Like this for example:
RUN semanage fcontext -a --equal /etc /extra-etc
This should ensure that any files in the container dropped into /extra-etc have the same label as /etc.
Or in short I think the fix almost always should be to add labels for the files, not to ignore unlabeled...
gursewak1997
force-pushed
the
export-warn-unlabeled
branch
from
September 9, 2026 20:59
8d2679f to
cb610b4
Compare
Contributor
Author
|
Also, working on the root cause. I am running a workflow right now. |
gursewak1997
force-pushed
the
export-warn-unlabeled
branch
from
September 10, 2026 05:37
cb610b4 to
1e3b07e
Compare
cgwalters
reviewed
Sep 10, 2026
Replace the boolean --disable-selinux with a --selinux flag supporting three modes: enabled (default, current behavior), warn-on-missing (label every file the policy covers, skip the rest with a summary count), and disabled (no labeling). This provides a safety net for custom images with files outside the SKIP_PATHS list that lack file_contexts coverage. Without it, the only option is --selinux=disabled which loses all labels. Introduce a SepolicyState enum that mirrors the CLI enum, a maybe_add_selinux_label helper that consolidates labeling across all four call sites, and optional_label() in lsm.rs as a non-failing companion to require_label(). Assisted-by: AI Signed-off-by: gursewak1997 <gursmangat@gmail.com>
gursewak1997
force-pushed
the
export-warn-unlabeled
branch
from
September 10, 2026 18:07
1e3b07e to
596021d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Align SKIP_PATHS with ostree-ext's FORCE_CLEAN_PATHS (add
run,var/cache) and replace--disable-selinuxwith a--selinux=enabled|warn-on-missing|disabledflag so users can preserve labels for files the policy covers while skipping unmatched ones.