In the bootc distro path, the root fillesystem mount points are not labelled before bootc install is called. This result in all the files in the ostree repository to be unlabelled.
The /boot hierarchy also end up unlabelled.
The fix is to simply apply labels to the root and /boot mount point before running the bootc install stage.
See how we do this in COSA : https://github.com/coreos/coreos-assembler/blob/a2b4dd6c901c074fb36e6d61df114b4386c4bc74/src/osbuild-manifests/build.raw-image-bootc.ipp.yaml#L115-L172
Of course we have a test for that :)
https://github.com/coreos/fedora-coreos-config/blob/testing-devel/tests/kola/selinux/file-context-policy-match
In the bootc distro path, the root fillesystem mount points are not labelled before
bootc installis called. This result in all the files in the ostree repository to be unlabelled.The
/boothierarchy also end up unlabelled.The fix is to simply apply labels to the
rootand/bootmount point before running thebootc installstage.See how we do this in COSA : https://github.com/coreos/coreos-assembler/blob/a2b4dd6c901c074fb36e6d61df114b4386c4bc74/src/osbuild-manifests/build.raw-image-bootc.ipp.yaml#L115-L172
Of course we have a test for that :)
https://github.com/coreos/fedora-coreos-config/blob/testing-devel/tests/kola/selinux/file-context-policy-match