init: selinux: don't relabel virtual filesystems
authorDaniel Golle <daniel@makrotopia.org>
Sat, 7 May 2022 12:15:30 +0000 (13:15 +0100)
committerDaniel Golle <daniel@makrotopia.org>
Wed, 1 Jun 2022 19:40:23 +0000 (20:40 +0100)
Attempting to relabel /dev/console, /proc or /sys results in an error
message. Avoid that by excluding them when relabeling rootfs on boot.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
initd/init.c

index 29e441d36189c4bd704a40447ca5245088e07869..7b1a37f2fb694a38b5e730fdb72bef8298c752bc 100644 (file)
@@ -88,7 +88,9 @@ selinux(char **argv)
                        return 0;
                }
                /* Second call: restore filesystem labels */
-               ret = selinux_restorecon("/", SELINUX_RESTORECON_RECURSE);
+               const char *exclude_list[] = { "/dev/console", "/proc", "/sys", 0 };
+               selinux_restorecon_set_exclude_list(exclude_list);
+               ret = selinux_restorecon("/", SELINUX_RESTORECON_RECURSE | SELINUX_RESTORECON_MASS_RELABEL);
                putenv("SELINUX_RESTORECON=1");
        } else {
                /* First call: load policy */