Label /sys before selinux-autorelabel units run (bsc#1232709)

[ca-hu]

No description provided.

[ca-hu]

what i was wondering is, if it makes sense to only execute the selinux config file:

# SYSTEMD_LOG_LEVEL=debug systemd-tmpfiles --dry-run  --create --boot selinux-policy.conf  
Looking for configuration files in (higher priority first):
	/etc/tmpfiles.d
	/run/tmpfiles.d
	/usr/local/lib/tmpfiles.d
	/usr/lib/tmpfiles.d
Successfully loaded SELinux database in 4.357ms, size on heap is 10469K.
Reading config file "/usr/lib/tmpfiles.d/selinux-policy.conf"…
Running create action for entry z /sys/devices/system/cpu/online
Running create action for entry Z /sys/class/net
Running create action for entry z /sys/kernel/uevent_helper

what do you think?

[Vogtinator]

I don't really mind either way, it won't make a difference in practice I think.

One benefit of using --prefix=/sys is that it does not have to hardcode the filename from the selinux-policy package.

[Vogtinator]

/usr/lib/tmpfiles.d/tpm2-tss-fapi.conf also touches /sys, but might not be relevant during early boot:

#Type   Path                                           Mode User Group Age         Argument
d       /var/lib/tpm2-tss/system/keystore   2775 tss  tss   -           -
a+      /var/lib/tpm2-tss/system/keystore   -    -    -     -           default:group:tss:rwx
d       /run/tpm2-tss/eventlog                2775 tss  tss   -           -
a+      /run/tpm2-tss/eventlog                -    -    -     -           default:group:tss:rwx
z-      /sys/kernel/security/tpm[0-9]/binary_bios_measurements  0440  root tss  -           -
z-      /sys/kernel/security/ima/binary_runtime_measurements    0440  root tss  -           -

[ca-hu]

yeah that is why i am not so sure if this should be done twice, once with our service and once with the regular tmpfiles setup.... i kinda tend to the hardcoding option, but not sure

[Vogtinator]

yeah that is why i am not so sure if this should be done twice, once with our service and once with the regular tmpfiles setup.... i kinda tend to the hardcoding option, but not sure

That's fine, tmpfiles is meant to be idempotent.