selinux breaks revisor

[Douglas McClendon]

Daniel P. Berrange wrote:

> If you really don't trust the RPMs you're about to compose, then run the
> compose on a throw away host - just re-kickstart it after execution.

Forgot to reply to this piece, which is quite relevant.

What I'm doing is precisely that- but much less, and 100% automated. 
Instead of using a throwaway kickstarted host, I'm using a throwaway 
initramfs that has the minimal files needed to 
losetup/loadpolicy/mkfs/chroot.  (and seperately boot rescue iso and do 
an http install from an http server running as the same user running qemu)

And by doing it in qemu, I can do all of this with a command-line, run 
as non-root, perhaps on a headless remote server running centos/rhel, 
that if it had a soul, would feel slightly dirty having had hundreds of 
fedora rpms installed as root under a chroot.

No doubt xen can be coaxed to do the same thing, but again, I love the 
simplicity and flexibility of qemu.

-dmc