initramfs: Inherit SELinux label on transient root tmpfs by andrewdunndev · Pull Request #2071 · bootc-dev/bootc

andrewdunndev · 2026-03-16T13:41:08Z

Summary

When root.transient is enabled, the overlay root at / gets SELinux label
tmpfs_t instead of root_t, causing services like systemd-networkd to crash.

This PR fixes the composefs backend by reading the SELinux label from the lower
(composefs) filesystem and setting it as rootcontext on the tmpfs used for
the overlay upper layer.

What changed

New mount_tmpfs_for_overlay() that reads security.selinux xattr from the
base filesystem and sets rootcontext on the tmpfs before overlay creation
Uses the two-call fgetxattr pattern (query size → allocate → read) for
correct handling of arbitrarily long MLS/MCS contexts
Uses CString (not str) to avoid requiring UTF-8 labels
Gracefully handles SELinux-disabled systems (fgetxattr error → no context set)
overlay_transient() passes the base fd through to inherit the correct label
Removed the now-unused mount_tmpfs() wrapper

Design decisions

rootcontext= over context=: rootcontext sets only the root inode's
label, letting new files inherit labels from SELinux policy. context= would
force a uniform label on all inodes in the tmpfs, which is too broad.
(systemd uses context= in nspawn and has had issues with it — see
nspawn volatile=overlay tmpfs labeled with "selinux-context" instead of "selinux-apifs-context" systemd/systemd#12292.)
Read from lower layer, not hardcode: The label is read from the composefs
base filesystem rather than hardcoding root_t. This works regardless of the
SELinux policy in use.
Silent fallback: If SELinux is not enabled or the xattr read fails, no
context is set and behavior is unchanged from before this patch.

Related issues

ostree backend: The ostree backend (otcore-prepare-root.c) has the same
issue but uses /run as the tmpfs backing store. That fix would go through
lcfs_mount_options_s in libcomposefs or the ostree repo. Happy to file a
follow-up issue on ostreedev/ostree.
systemd: systemd.volatile=overlay has the same unfixed bug
(nspawn volatile=overlay tmpfs labeled with "selinux-context" instead of "selinux-apifs-context" systemd/systemd#12292). Dan Walsh's fix attempt (Fix the labeling within an nspawn container systemd/systemd#26141) has
been stalled since 2023.

Testing

This runs in the initramfs before the real root is mounted, so testing requires
a VM with SELinux enforcing and root.transient enabled. Verification:

# Before fix: / has tmpfs_t
ls -Zd /
# system_u:object_r:tmpfs_t:s0 /

# After fix: / has root_t
ls -Zd /
# system_u:object_r:root_t:s0 /

Closes #1992

Signed-off-by: Andrew Dunn andrew@dunn.dev

gemini-code-assist

Code Review

This pull request correctly addresses an issue with SELinux labels on transient root filesystems by inheriting the label from the base filesystem. The implementation is well-structured, introducing a new function mount_tmpfs_for_overlay to handle the logic. My review includes a suggestion to refactor the extended attribute reading logic to be more robust and idiomatic by avoiding hardcoded buffer sizes.

crates/initramfs/src/lib.rs

gursewak1997

lgtm

cgwalters

I think this is all OK, however...and this is not something you need to fix as part of this PR, but we are missing testing transient root at all I believe as part of gating CI here by default.

It's tricky because it would be another entry in our ever-growing matrix, I'll try to write something up for this.

cgwalters · 2026-03-17T22:57:42Z

crates/initramfs/src/lib.rs

    let tmpfs = FsHandle::open("tmpfs")?;
+
+    if let Some(base_fd) = base {
+        // Read the SELinux label from the base filesystem root using the


This could probably use https://docs.rs/cap-std-ext/latest/cap_std_ext/dirext/trait.CapStdExtDirExt.html#tymethod.getxattr

Switched to cap-std-ext::getxattr via Dir::reopen_dir. Force-pushed.

cgwalters · 2026-03-17T22:58:55Z

crates/initramfs/src/lib.rs

+            // Construct a CString for fsconfig_set_string. This avoids
+            // requiring the label to be valid UTF-8 (per maintainer feedback).


To me this is a perfect example of a "very obvious" LLM generated (I'm sure) comment that's just unnecessary. I'll try to update our AGENTS.md and such to try to suppress some of this, I have it in my personal one.

Noted, will keep replies terse going forward (and we adjusted our harness, you're detecting LLM assist correctly).

cgwalters · 2026-03-17T22:59:29Z

crates/initramfs/src/lib.rs

 };
+
+/// The SELinux extended attribute name.
+const SELINUX_XATTR: &str = "security.selinux";


We also have this const elsewhere

Removed. Using the string literal inline since the existing consts in lsm.rs aren't reachable from initramfs.

cgwalters · 2026-03-17T23:00:56Z

crates/initramfs/src/lib.rs

+            // The kernel may return a null-terminated byte string; strip it
+            // before constructing a CString (which adds its own terminator).
+            if label.last() == Some(&0) {
+                label.pop();
+            }


Yeah, here be some 🐉 - we messed something up like this in ostree IIRC

cap-std-ext::getxattr handles the buffer management now, so the manual null-terminator stripping is gone.

When root.transient is enabled, the tmpfs used as the overlay upper layer has no SELinux context set, so its root directory gets the default tmpfs_t label. This propagates to the overlay mountpoint at /, causing services like systemd-networkd to refuse to start because they expect root_t. Fix this by reading the SELinux label from the composefs lower layer via fgetxattr(security.selinux) and setting it as rootcontext on the tmpfs before creating the overlay. This ensures the overlay root inherits the correct label from the base filesystem. The rootcontext mount option sets only the root inode's label, preserving per-file labeling from SELinux policy via type_transition rules. This is preferable to context= which would force a uniform label on all inodes. When SELinux is not enabled, fgetxattr returns an error and no context is set, preserving the existing behavior. Note: the ostree backend (otcore-prepare-root.c in ostreedev/ostree) has the same issue but uses /run as the tmpfs backing store rather than creating its own tmpfs. That fix would need to go through libcomposefs mount options or the ostree repo directly. Closes: bootc-dev#1992 AI-Assisted: yes AI-Tools: GitLab Duo, OpenCode Signed-off-by: Andrew Dunn <andrew@dunn.dev>

andrewdunndev · 2026-03-18T01:03:36Z

Happy to help wire up a transient-root test or file an issue to track.

bootc-bot bot requested a review from gursewak1997 March 16, 2026 13:41

gemini-code-assist bot reviewed Mar 16, 2026

View reviewed changes

crates/initramfs/src/lib.rs Outdated Show resolved Hide resolved

andrewdunndev force-pushed the fix/selinux-transient-root-context branch 3 times, most recently from 25092c4 to 0c64f52 Compare March 16, 2026 14:30

gursewak1997 previously approved these changes Mar 17, 2026

View reviewed changes

cgwalters reviewed Mar 17, 2026

View reviewed changes

andrewdunndev dismissed gursewak1997’s stale review via 9607e46 March 18, 2026 01:01

andrewdunndev force-pushed the fix/selinux-transient-root-context branch from 0c64f52 to 9607e46 Compare March 18, 2026 01:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

initramfs: Inherit SELinux label on transient root tmpfs#2071

initramfs: Inherit SELinux label on transient root tmpfs#2071
andrewdunndev wants to merge 1 commit intobootc-dev:mainfrom
andrewdunndev:fix/selinux-transient-root-context

andrewdunndev commented Mar 16, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

gursewak1997 left a comment

Uh oh!

cgwalters left a comment

Uh oh!

cgwalters Mar 17, 2026

Uh oh!

andrewdunndev Mar 18, 2026

Uh oh!

cgwalters Mar 17, 2026

Uh oh!

andrewdunndev Mar 18, 2026

Uh oh!

cgwalters Mar 17, 2026

Uh oh!

andrewdunndev Mar 18, 2026

Uh oh!

cgwalters Mar 17, 2026

Uh oh!

andrewdunndev Mar 18, 2026

Uh oh!

andrewdunndev commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// Construct a CString for fsconfig_set_string. This avoids
		// requiring the label to be valid UTF-8 (per maintainer feedback).

Conversation

andrewdunndev commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Design decisions

Related issues

Testing

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

gursewak1997 left a comment

Choose a reason for hiding this comment

Uh oh!

cgwalters left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andrewdunndev commented Mar 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

andrewdunndev commented Mar 16, 2026 •

edited

Loading