Some additional experimental findings: One may consider labeling these overlay directories during the initramfs phase of boot to avoid the post switch-root service. This would involve using load-policy -i and setting the SELinux mode to Permissive, as the current Fedora policy is not suitable for the initramfs phase of operation.
However, this approach would still require a post switch-root directive to `setenforce` to the `Enforcing` default. This is because the kernel only interprets the `enforcing={0|1}` parameter or the `/etc/selinux/config SELINUX={permissive|enforcing}` setting *once* and very early during each boot.
Consequently, even if `setenforce Permissive` or `echo 0 > /sys/fs/selinux/enforcing` is issued during the initramfs phase, certain critical components will still suffer denials that lead to failed boots. Permissive mode must be set from the very beginning to enable successful initramfs labeling of the directories within the context of an unsuitable policy.
Please consider this a continuation of this thread: https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.or...
selinux@lists.fedoraproject.org
-
Frederick Grose