diff --git a/CHANGELOG.md b/CHANGELOG.md index 8efcb914..eaed83f5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -48,6 +48,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). - Replace reference to docusaurus with Sphinx - `wwctl container import` now only runs syncuser if explicitly requested. #1212 - wwinit now configures NetworkManager to not retain configurations from dracut. #1115 +- Improved detection of SELinux capable root fs #1093 ### Fixed diff --git a/overlays/wwinit/rootfs/warewulf/init.d/90-selinux b/overlays/wwinit/rootfs/warewulf/init.d/90-selinux index 73ad892d..2b910b2e 100644 --- a/overlays/wwinit/rootfs/warewulf/init.d/90-selinux +++ b/overlays/wwinit/rootfs/warewulf/init.d/90-selinux @@ -2,11 +2,6 @@ . /warewulf/config -if test -z "$WWROOT"; then - echo "Skipping SELinux configuration: Warewulf Root device not set" - exit -fi - if test -f "/etc/sysconfig/selinux"; then . /etc/sysconfig/selinux else @@ -14,22 +9,25 @@ else exit fi -if test "$WWROOT" == "initramfs"; then - echo "Skipping SELinux configuration: 'Root=initramfs'" - if test "$SELINUX" != "disabled"; then - echo "WARNING: SELinux prep is being skipped, but SELinux is enabled on host! This may" - echo "WARNING: cause the system to not work properly. Try setting 'Root=tmpfs'" - sleep 5 - fi +if test "$SELINUX" == "disabled"; then + echo "Skipping SELinux setup per /etc/sysconfig/selinux" exit fi -if test "$SELINUX" == "disabled"; then - echo "Skipping SELinux setup per /etc/sysconfig/selinux" -elif grep -q "selinux=0" /proc/cmdline; then +if grep -q "selinux=0" /proc/cmdline; then echo "Skipping SELinux setup per kernel command line" -else - echo "Setting up SELinux" - /sbin/load_policy -i - /sbin/restorecon -r / + exit fi + +if [ $(findmnt / --noheadings --output SOURCE) == 'rootfs' ]; then + echo "Skipping SELinux configuration: rootfs does not support SELinux contexts" + echo + echo "WARNING: SELinux prep is being skipped, but SELinux is enabled on host! This may" + echo "WARNING: cause the system to not work properly. Try setting 'Root=tmpfs'" + sleep 5 + exit +fi + +echo "Setting up SELinux" +/sbin/load_policy -i +/sbin/restorecon -e /sys -r /