Incorrect SELinux labels when building sysexts

[alcarney]

Recently, I figured out that I could use mkosi to build a sysext containing a custom Emacs build for my system.

It worked fine, until I restarted my machine. The machine would boot, but then hang on a black screen. Luckily I could get to a tty, login and disable my custom sysext. After which the machine boots again as normal.

I think I have identified the underlying issue. However, I'm not sure if this is a bug in mkosi or if I'm just holding it wrong.

Looking in journalctl in the affected boots I get 100s-1000s of SELinux denials after the stage where my sysexts are enabled

2:26 aurora (sd-merge)[1606]: Using extensions 'emacs.raw', 'erofs-utils.raw'.
Sep 09 18:42:26 aurora kernel: erofs (device loop1): mounted with root inode @ nid 41.
Sep 09 18:42:26 aurora (sd-merge)[1606]: Merged extensions into '/usr'.
Sep 09 18:42:26 aurora systemd[1]: Finished systemd-sysext.service - Merge System Extension Images into /usr/ and /opt/.
Sep 09 18:42:26 aurora audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-sysext comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Sep 09 18:42:26 aurora systemd[1]: Starting systemd-tmpfiles-setup.service - Create System Files and Directories...
Sep 09 18:42:26 aurora audit[1623]: AVC avc:  denied  { search } for  pid=1623 comm="(sd-worker)" name="systemd" dev="overlay" ino=5 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
Sep 09 18:42:26 aurora audit[1623]: SYSCALL arch=c000003e syscall=59 success=no exit=-13 a0=55658d650778 a1=7ffd93ebdfa0 a2=5565b395ce10 a3=1 items=0 ppid=1029 pid=1623 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(sd-worker)" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Sep 09 18:42:26 aurora audit: PROCTITLE proctitle="(sd-worker)"
Sep 09 18:42:26 aurora (sd-worker)[1623]: Failed to start worker process: Permission denied
Sep 09 18:42:26 aurora audit[1624]: AVC avc:  denied  { search } for  pid=1624 comm="(sd-worker)" name="systemd" dev="overlay" ino=5 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
Sep 09 18:42:26 aurora audit[1624]: SYSCALL arch=c000003e syscall=59 success=no exit=-13 a0=55658d650778 a1=7ffd93ebdfa0 a2=5565b395ce10 a3=1 items=0 ppid=1029 pid=1624 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(sd-worker)" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Sep 09 18:42:26 aurora audit: PROCTITLE proctitle="(sd-worker)"
Sep 09 18:42:26 aurora systemd-userdbd[1029]: Worker 1623 died with a failure exit status 1, ignoring.
Sep 09 18:42:26 aurora audit[1625]: AVC avc:  denied  { search } for  pid=1625 comm="(sd-worker)" name="systemd" dev="overlay" ino=5 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=unconfined_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
Sep 09 18:42:26 aurora audit[1625]: SYSCALL arch=c000003e syscall=59 success=no exit=-13 a0=55658d650778 a1=7ffd93ebdfa0 a2=5565b395ce10 a3=1 items=0 ppid=1029 pid=1625 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(sd-worker)" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Sep 09 18:42:26 aurora audit: PROCTITLE proctitle="(sd-worker)"
Sep 09 18:42:26 aurora (sd-worker)[1624]: Failed to start worker process: Permission denied

I don't understand SELinux, but I think tcontext=unconfined_u:object_r:unlabeled_t:s0 means it doesn't like something being unlabelled.

After seeing the discussion in #130 and discovering SELinuxRelabel= I added the selinux-polcy Fedora package to the base image, and mkosi was able to relabel the files ok. However, when the sysext is enabled, some of my directories are still unlabelled.

   $ ls -lZ /usr/
   total 52
   drwxr-xr-x.   1 root root system_u:object_r:bin_t:s0            137 Aug 26 02:15 bin/
   drwxr-xr-x. 166 root root system_u:object_r:etc_t:s0           6067 Jan  1  1970 etc/
   drwxr-xr-x.   2 root root system_u:object_r:usr_t:s0             27 Jan  1  1970 games/
   drwxr-xr-x.   1 root root unconfined_u:object_r:unlabeled_t:s0   53 Sep  9 13:50 include/
   drwxr-xr-x.   1 root root system_u:object_r:lib_t:s0             79 Aug 26 02:15 lib/
   drwxr-xr-x.   1 root root system_u:object_r:lib_t:s0            104 Aug 26 02:15 lib64/
   drwxr-xr-x.   1 root root unconfined_u:object_r:unlabeled_t:s0   44 Sep  9 13:50 libexec/
   lrwxrwxrwx.   1 root root system_u:object_r:usr_t:s0             15 Jan  1  1970 local -> ../var/usrlocal/
   lrwxrwxrwx.   1 root root system_u:object_r:bin_t:s0              3 Jan  1  1970 sbin -> bin/
   drwxr-xr-x.   1 root root system_u:object_r:usr_t:s0             77 Aug 26 02:15 share/
   drwxr-xr-x.   4 root root system_u:object_r:usr_t:s0             63 Jan  1  1970 src/
   lrwxrwxrwx.   1 root root system_u:object_r:usr_t:s0             10 Jan  1  1970 tmp -> ../var/tmp/

   $ sudo systemd-sysext unmerge

   $ ls -lZ /usr/
   total 240
   drwxr-xr-x.   2 root root system_u:object_r:bin_t:s0  73728 Jan  1  1970 bin/
   drwxr-xr-x. 166 root root system_u:object_r:etc_t:s0   6067 Jan  1  1970 etc/
   drwxr-xr-x.   2 root root system_u:object_r:usr_t:s0     27 Jan  1  1970 games/
   drwxr-xr-x.  52 root root system_u:object_r:usr_t:s0   4096 Jan  1  1970 include/
   drwxr-xr-x.  57 root root system_u:object_r:lib_t:s0   1259 Jan  1  1970 lib/
   drwxr-xr-x. 142 root root system_u:object_r:lib_t:s0 118784 Jan  1  1970 lib64/
   drwxr-xr-x.  61 root root system_u:object_r:bin_t:s0   8192 Jan  1  1970 libexec/
   lrwxrwxrwx.   1 root root system_u:object_r:usr_t:s0     15 Jan  1  1970 local -> ../var/usrlocal/
   lrwxrwxrwx.   1 root root system_u:object_r:bin_t:s0      3 Jan  1  1970 sbin -> bin/
   drwxr-xr-x. 324 root root system_u:object_r:usr_t:s0   8192 Jan  1  1970 share/
   drwxr-xr-x.   4 root root system_u:object_r:usr_t:s0     63 Jan  1  1970 src/
   lrwxrwxrwx.   1 root root system_u:object_r:usr_t:s0     10 Jan  1  1970 tmp -> ../var/tmp/

If I mount the image with systemd-dissect all the directories appear to be unlabeled - basically the opposite issue seen in #3148 😅

Here is my current config

mkosi.conf

[Output]
OutputDirectory=mkosi.output
[Build]

CacheDirectory=mkosi.cache

BuildSources=/var/home/alex/Projects/gnu/emacs/master:emacs

BuildSourcesEphemeral=true

mkosi.images/base/mkosi.conf

[Output]
Format=directory
[Content]

CleanPackageMetadata=no

Packages=# Build tools

autoconf

awk

make

man

gcc

git

pkgconf-pkg-config

rpm

tar

texinfo

# Emacs build dependencies

gnutls-devel

gtk3-devel

libjpeg-turbo-devel

libpng-devel

librsvg2-devel

libselinux-devel

libtiff-devel

libwebp-devel

libxml2-devel

ncurses-devel

sqlite-devel

# Needed to fix SE Linux labelling

selinux-policy

# Needed for mkosi?

systemd

udev

mkosi.images/emacs/mkosi.conf

[Output]
Format=sysext
Overlay=yes
[Content]

BaseTrees=%O/base

Packages=libgccjit,libotf,libtree-sitter

BuildPackages=libgccjit-devel,libotf-devel,libtree-sitter-devel

SELinuxRelabel=enabled

mkosi.images/emacs/mkosi.build.chroot

#!/bin/bash
set -euo pipefail
pushd emacs
./autogen.sh

./configure --prefix=/usr 

--disable-gc-mark-trace 

--with-pgtk 

--with-native-compilation=aot 

--without-x

make -j $(nproc)

make install

I did some poking around with a mkosi.finalise script and some of the directories appear to have a label, but they seem to lose it by the time they make it to the erofs image.

If anyone has any thoughts/suggestions it would be much appreciated :)

[kaminagakur4]

I asked Claude to lay out my solution in a straightforward, step-by-step manner, so this should be pretty easy to follow. Let me know if you need any extra help.

Neither a bug nor holding it wrong — a sysext falls straight through the condition that decides whether to relabel, and because the default is auto it does so silently.

1. The check looks for the policy inside the image. want_selinux_relabel() in mkosi/config.py:

selinux = root / "etc/selinux/config"
if not selinux.exists():
    if fatal and config.selinux_relabel == ConfigFeature.enabled:
        die("SELinux relabel is requested but could not find selinux config at /etc/selinux/config")
    return None

and, further down, it reads SELINUXTYPE out of that file and uses root/etc/selinux/<policy>/contexts/files/file_contexts plus the image's binary policy. A sysext carries only /usr — your Emacs build — so there is no /etc/selinux/config in it, the function returns None, and run_selinux_relabel() returns immediately without running setfiles.

2. Why you got no warning. SELinuxRelabel= defaults to auto, and the fatal branch above only fires when it is set to yes. So on the default the skip is silent. Your files reach the image with no security.selinux xattr, systemd-sysext overlays them onto /usr, and everything that touches them sees unlabeled_t — which is exactly what your denials say:

tcontext=unconfined_u:object_r:unlabeled_t:s0

3. Setting SELinuxRelabel=yes will not fix it, and it is worth knowing before you try: it turns the silent skip into die("SELinux relabel is requested but could not find selinux config at /etc/selinux/config"), because the built-in path is designed for full images that ship their own policy. Installing a policy into a sysext just to get labels would be the wrong shape.

4. Relabel against the host policy in a finalize script instead. mkosi.finalize runs as root, as the last step of preparing the image, and — per the build order in the man page — after the SELinux relabel step, which is exactly where you want to slot in:

#!/bin/sh
# mkosi.finalize
[ "$1" = "final" ] || exit 0
setfiles -m -F -r "$BUILDROOT" \
    /etc/selinux/targeted/contexts/files/file_contexts \
    "$BUILDROOT/usr"

That is the same setfiles invocation mkosi itself uses (setfiles -mFr <root> …), pointed at your host's file_contexts rather than the image's. Since the sysext is merged into the running system's /usr, the host policy is the correct one to label against.

5. Two things to keep in mind. Build as root — the man page notes that unprivileged setfiles cannot set labels absent from the host policy. And check the result before rebooting, because a sysext that hangs the boot is an unpleasant way to find out:

unsquashfs -l emacs.raw | head        # or the erofs equivalent
getfattr -n security.selinux -d <a file from the merged /usr>

6. If this is deemed worth changing upstream, the small version is making the auto skip loud for non-directory outputs — a single "skipping SELinux relabel: no policy in image" line would have saved you the black screen. The larger version is a way to relabel against the host policy, which is what a sysext structurally needs.