When building packages within mock/livecd. We really want the processes running within the chroot to not do SELinux stuff. We want libselinux to tell them that SELinux is disabled. For example if we install selinux-policy package within a mock chroot or livecd we do not want it to try to load_policy. Other rpms try chcon or restorecon in post installs. These are get turned off if the tools think SELinux is disabled. We are not doing this for security reasons. We have been hacking this out, but replaceing $CHROOT/proc/filesystem with a version that does not include filesystem, but we have found this to require large privs for mock. (mount -o bind /tmp/filesystem $CHROOT/proc/filesystem; requires mock_t to read /dev/loop which is labeled fixed_disk_device_t) We have considered playing tricks with libselinux.so but those seem a little dangerous. Eric has come up with an idea of adding a field to $CHROOT/etc/selinux/config to tell is_selinux_enabled() to return false. SPECIAL_ENABLED=force_off Then mock could just set this flag in the config file and all apps would think SELinux is disabled. Does this seem reasonable? -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
