On Tuesday 13 May 2008, Daniel J Walsh wrote:
I don't have a problem with calling restorecon on every single file,
since this is a limited number of files. The goal is to allow the
chroot to run without mucking around with the host security. So I don't
have to run permissive or disabled if I use mock/livecd. If mock/livecd
have to relabel when they complete that is fine.
I would really like to enable selinux on the actual builders. Right now it
has to be disabled. If not alot of things build ok but certain packages will
switch to enforcing inside the chroot when the host is in permissive mode.
and it causes all sorts of fun and failed builds. for the builders i think
that calling restorecon will slow down builds too much. A new chroot is
created for each and every build.
This is a seperate issue from having machines for doing composes.