Re: [yocto-patches] [wic][PATCH] partition.py: restore selinux label for fstab

Hi,

Thanks for the patch.

On Fri 2026-04-17 @ 11:14:17 AM, Yi Zhao via lists.yoctoproject.org wrote:
> When SELinux is enabled, all files within a wic image retain their
> SELinux labels except for /etc/fstab, which is replaced by a newly
> generated one during the build, causing its extended attributes to be
> lost.
> 
> Restore the SELinux context on the new fstab using debugfs ea_get and
> ea_set commands, ensuring all files are correctly labeled at build time
> and avoiding a full SELinux relabel on first boot.
> 
> Signed-off-by: Yi Zhao <[email protected]>
> ---
>  src/wic/partition.py | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/src/wic/partition.py b/src/wic/partition.py
> index 435d31d..506ef2b 100644
> --- a/src/wic/partition.py
> +++ b/src/wic/partition.py
> @@ -362,10 +362,21 @@ class Partition():
>  
>          if self.updated_fstab_path and self.has_fstab and not self.no_fstab_update:
>              debugfs_script_path = os.path.join(cr_workdir, "debugfs_script")
> +            fstab_label_path = os.path.join(cr_workdir, "fstab.selinuxlabel")
> +            with open(debugfs_script_path, "w") as f:
> +                f.write("cd etc\n")
> +                # Retrieve fstab selinux label
> +                f.write("ea_get -f %s fstab security.selinux\n" % (fstab_label_path))
> +            debugfs_cmd = "debugfs -w -f %s %s" % (debugfs_script_path, rootfs)
> +            exec_native_cmd(debugfs_cmd, native_sysroot)

This debugfs call is only *reading* an xattr (ea_get), so it does not
need the -w flag; please remove.

Also, if the rootfs is non-SELinux, this call will print "xattr
security.selinux not found" or something like that which ends up in the
wic log. Can you arrange so this doesn't happen otherwise users will be
confused by this line appearing in the log and might waste time trying
to figure out why.

> +
>              with open(debugfs_script_path, "w") as f:
>                  f.write("cd etc\n")
>                  f.write("rm fstab\n")
>                  f.write("write %s fstab\n" % (self.updated_fstab_path))
> +                if os.path.isfile(fstab_label_path) and os.path.getsize(fstab_label_path) > 0:
> +                    # Restore fstab selinux label
> +                    f.write("ea_set -f %s fstab security.selinux\n" % (fstab_label_path))
>              debugfs_cmd = "debugfs -w -f %s %s" % (debugfs_script_path, rootfs)
>              exec_native_cmd(debugfs_cmd, native_sysroot)
>  
> -- 
> 2.43.0
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#3726): https://lists.yoctoproject.org/g/yocto-patches/message/3726
> Mute This Topic: https://lists.yoctoproject.org/mt/118870524/900817
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/yocto-patches/leave/13168745/900817/63955952/xyzzy [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
> 
>