[PATCH v2 05/15] base_image: set selinux to permissive for fedora on debian hosts

From: Daniel Gomez <[email protected]>

When building Fedora guest images on Debian hosts, SELinux contexts
cannot be properly set because Debian lacks SELinux kernel support.
Libguestfs cannot persist security.selinux extended attributes to
filesystems when mounting from non-SELinux hosts, causing all files to
have unlabeled_t context.

This creates a boot failure where SELinux blocks all binary execution
(195 AVC denials, 211 exit 127 errors), including the autorelabel
service itself.

Configure Fedora images to use SELinux permissive mode instead of
enforcing when built on Debian/Ubuntu hosts. This allows guests to boot
successfully while still loading SELinux policy for development and
testing.

Add --no-selinux-relabel to virt-sysprep to prevent it from creating
.autorelabel files that would trigger failed relabeling attempts on
first boot.

Generated-by: Claude AI
Signed-off-by: Daniel Gomez <[email protected]>
---
 playbooks/roles/base_image/tasks/base-image.yml | 34 +++++++++++++++++++++++++
 playbooks/roles/guestfs/tasks/bringup/main.yml  |  4 +++
 2 files changed, 38 insertions(+)

diff --git a/playbooks/roles/base_image/tasks/base-image.yml b/playbooks/roles/base_image/tasks/base-image.yml
index fc022649..a7f2da2d 100644
--- a/playbooks/roles/base_image/tasks/base-image.yml
+++ b/playbooks/roles/base_image/tasks/base-image.yml
@@ -52,6 +52,7 @@
     creates: "{{ base_image_pathname }}"
   when:
     - libvirt_uri_system|bool
+  register: virt_builder_result_system
 
 - name: Generate a new base image for {{ base_image_os_version }}
   ansible.builtin.command:
@@ -71,6 +72,39 @@
     creates: "{{ base_image_pathname }}"
   when:
     - not libvirt_uri_system|bool
+  register: virt_builder_result_user
+
+- name: Set SELinux to permissive mode for Fedora images on non-SELinux hosts (system libvirt)
+  become: true
+  become_method: ansible.builtin.sudo
+  ansible.builtin.command:
+    argv:
+      - "virt-customize"
+      - "-a"
+      - "{{ base_image_pathname }}"
+      - "--run-command"
+      - "sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config"
+  when:
+    - libvirt_uri_system|bool
+    - guestfs_fedora is defined
+    - guestfs_fedora|bool
+    - ansible_distribution|lower in ['debian', 'ubuntu']
+    - virt_builder_result_system is changed
+
+- name: Set SELinux to permissive mode for Fedora images on non-SELinux hosts (user libvirt)
+  ansible.builtin.command:
+    argv:
+      - "virt-customize"
+      - "-a"
+      - "{{ base_image_pathname }}"
+      - "--run-command"
+      - "sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config"
+  when:
+    - not libvirt_uri_system|bool
+    - guestfs_fedora is defined
+    - guestfs_fedora|bool
+    - ansible_distribution|lower in ['debian', 'ubuntu']
+    - virt_builder_result_user is changed
 
 - name: Set proper ownership on base image for rcloud access (system libvirt)
   become: true
diff --git a/playbooks/roles/guestfs/tasks/bringup/main.yml b/playbooks/roles/guestfs/tasks/bringup/main.yml
index 510e1a7d..f3645b90 100644
--- a/playbooks/roles/guestfs/tasks/bringup/main.yml
+++ b/playbooks/roles/guestfs/tasks/bringup/main.yml
@@ -91,6 +91,10 @@
                 "--firstboot-command", "if command -v ufw >/dev/null 2>&1 && systemctl is-active ufw >/dev/null 2>&1; then ufw allow " + (ansible_cfg_ssh_port | string) + "/tcp; fi"
               ]
               if ansible_cfg_ssh_port | int != 22 else []
+            ) + (
+              ["--no-selinux-relabel"]
+              if (guestfs_fedora is defined and guestfs_fedora|bool and ansible_distribution|lower in ['debian', 'ubuntu'])
+              else []
             )
           }}
 

-- 
2.51.0