Full SELinux re-label after every DNF update

Ask Fedora
1

Nearly every time I’ve updated my system using DNF in the last 6 months, either nbdkit or passt gets updated and forces a full SELinux relabel of the entire filesystem:

selinux-2

selinux
selinux2541×125 115 KB

At first, I thought this was a bug w/ packagekit (and opened an issue), but after talking w/ the maintainers they mentioned this is likely a result of the way the selinux labels are packaged, and they have to be updated from time to time.

Which is totally reasonable, except it means that a DNF update that otherwise took 5 minutes now takes an hour while the entire filesystem gets relabeled.

I’m running Fedora 41 on a reasonably modern machine w/ 12 cores and an SSD.

Any suggestions? I’m trying to avoid disabling SELinux outright, but it’s getting a bit ridiculous. My understanding of SELinux labels for packages is that, for the most part, adjustments to labels should be targeted and full-relabels should be quite rare.

Is it possible I need to fresh-install my system? I’ve been carrying this install forward for several years now (I think since 36?). It’d be a shame to break my streak :wink:

Edit to add: the issue was marked duplicate of this, but it doesn’t seem to have a resolution – https://bugzilla.redhat.com/show_bug.cgi?id=2318279

2

Hi and welcome to :fedora: !

Do you need the package nbdkit-selinux installed? It only seems to be a weak dependency of nbdkit.

3

Hm good thought. Going one step further, dnf repoquery --whatrequires nbdkit doesn’t list any packages that need even nbdkit itself, so I’ve uninstalled it entirely.

I suppose I’ll report back next time there are updates to install. Thanks!

(Side note: passt is a dependency of podman, which I do use so no such luck there.)

2 Likes