selinux relabel doesn't work anymore

[Joe Average]

selinux-policy-42.4-1.fc42

bootparameter "autorelabel=1" 
or 
sudo touch /.autorelabel;

does nothing !

only me ?
do I miss something ?

[Jeffrey Walton]

On Thu, Aug 7, 2025 at 11:32 AM Joe Average  wrote:
> selinux-policy-42.4-1.fc42
>
> bootparameter "autorelabel=1"
> or
> sudo touch /.autorelabel;
>
> does nothing !
>
> only me ?
> do I miss something ?

How do you know it does nothing?

The DNF System Upgrade page says to use `sudo fixfiles -B onboot`. See <
https://docs.fedoraproject.org/en-US/quick-docs/upgrading-fedora-offline/#se...
> .

Jeff

[Joe Average]

Jeffrey Walton wrote:
> On Thu, Aug 7, 2025 at 11:32 AM Joe Average [e-mail] wrote:
> > selinux-policy-42.4-1.fc42
> > bootparameter "autorelabel=1"
> > or
> > sudo touch /.autorelabel;
> > does nothing !
> > only me ?
> > do I miss something ?
> > How do you know it does nothing?

1. /.autorelabel is still there, after an reboot (normal it's removed after relabel)
2. I don't see anthing that relabeling is active during boot. Box bootes just as normal (only once). 
no counter (10...20..100 %) is running anymore

all not what I've seen in the past

Questions:
- does relabeling do nothing, when filesytem is already relabeled ?
- is there a marker set somewhere indicating "filesystem is already proper relabeled" ?

[Joe Average]

Joe Average wrote:
> Jeffrey Walton wrote:
> > On Thu, Aug 7, 2025 at 11:32 AM Joe Average [e-mail] wrote:
> > selinux-policy-42.4-1.fc42
> > bootparameter "autorelabel=1"
> > or
> > sudo touch /.autorelabel;
> > does nothing !
> > only me ?
> > do I miss something ?
> > How do you know it does nothing?
> > /.autorelabel is still there, after an reboot (normal it's removed after relabel)
> I don't see anthing that relabeling is active during boot. Box bootes just as normal (only once).
>
> no counter (10...20..100 %) is running anymore
> all not what I've seen in the past
> Questions:
> does relabeling do nothing, when filesytem is already relabeled ?
> is there a marker set somewhere indicating "filesystem is already proper relabeled" ?

running
sudo fixfiles -B onboot
puts out "System will relabel on next boot"

reboot
=> peanuts (NO relabeling !)

[Tim]

On Thu, 2025-08-07 at 16:11 +0000, Joe Average wrote:
> is there a marker set somewhere indicating "filesystem is already
>
> proper relabeled" ?

Yes...  But only in as much as "/.autorelabel" is deleted by the
process when it's finished.  There's no other **the drive is fine at
the moment** flag that disappears when things have gone wrong.

The "/.autorelabel" file that gets created to signal the drive needs
relabelling at next boot can be set by you, or other processes.  I
don't know of any that do, but admins could create some failsafe
scripts for automating things.

[Barry Scott]

> On 7 Aug 2025, at 16:32, Joe Average  wrote:
>
> selinux-policy-42.4-1.fc42
>
> bootparameter "autorelabel=1"

It's "autorelabel" only the =1 is not looked for.
> or 
> sudo touch /.autorelabel;

I can confirm that this does not work on f42, but my f41 does relabel.
What I know is that the systemd service and generator that makes this all work are installed.

FYI the generator script is /usr/lib/systemd/system-generators/selinux-autorelabel-generator.sh
if you want to read the logic.

Can you raise a bug in the Fedora bugtracker for this?

Barry
> does nothing !
>
> only me ?
> do I miss something ?
> -- 
> _______________________________________________
> users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Joe Average]

Barry Scott wrote:
> >

...
> Can you raise a bug in the Fedora bugtracker for this?
> Barry

yup 
done:
https://bugzilla.redhat.com/show_bug.cgi?id=2387134

[Jeffrey Walton]

On Thu, Aug 7, 2025 at 11:32 AM Joe Average  wrote:
> selinux-policy-42.4-1.fc42
>
> bootparameter "autorelabel=1"
> or
> sudo touch /.autorelabel;
>
> does nothing !
>
> only me ?
> do I miss something ?

It looks like it is a regression. According to Zdenek Pytela at <
https://bugzilla.redhat.com/show_bug.cgi?id=2387134#c8%3E:

It really is a regression since reworking generators policy in v42.1,
    the generator does not make the relabel service start, thanks for
    reporting.

You can now try copr build from
    https://github.com/fedora-selinux/selinux-policy/pull/2826
    Checks -> rawhide build

Jeff

[Joe Average]

Jeffrey Walton wrote:
> On Thu, Aug 7, 2025 at 11:32 AM Joe Average [e-mail] wrote:

...
> > It looks like it is a regression. According to Zdenek Pytela at <

yup. I noticed that already
thanks