How to restore system app settings in rpm-ostree?

Ask Fedora
, , ,
1

I had major and hard to identify problems with logging in, so I disabled SElinux but the wrong way, so I deleted all the configs, thinking an update would restore them.

They are stored in /etc/ so they seem not to be part of the overwrite-part of the OSTree image.

In DNF for problems like that, also for grub problems, you could reinstall the packages simply. This is not a possibility in rpm-ostree.

How can I reset these settings?

  1. This command does not work
# rpm-ostree override remove selinux-policy --install selinux-policy
error: "selinux-policy" is already provided by: selinux-policy-37.19-1.fc37.noarch. Use --allow-inactive to explicitly require it.
# rpm-ostree override remove selinux-policy --install --allow-inactive selinux-policy
error: Override already exists for package 'selinux-policy'
  1. This is difficult as SELinux is a dependency for other apps like smartmontools-selinux, so you would have to replace all of these, which is similarly extreme like the “replace libavcodec with full ffmpeg” rpm-ostree override.
rpm-ostree override remove selinux-policy && rpm-ostree install selinux-policy
  1. I try
rpm-ostree install --allow-inactive selinux-policy` and it seems to work. Lets see

And this works! This is how you reinstall an app including its settings!

Now I just have to find the correct app restoring what I need.

2

i have never done that running this could break your system in ostree systems it is not the way that you should reinstall packages of base system.
rpm-ostree override remove package --install package

1 Like
3

yes I thought about that too, but too think its dangerous

but I mean its SELinux which is gone anyways so cant do harm, I will try

edited the post

4

So it seems the used command resetted all the SELinux configs, but how to enable it?

selinux-activate, which I found here seems to not be existing on Fedora.

1 Like
6

Please don’t follow such article on ostree based systems.
You should never run restorecon (and probably neitherfixfiles nor touch /.autorelabel) on a Fedora Silverblue host.
Have a look to these links:

2 Likes
7

Thanks! Yes the touch /.autorelabel alias fixfiles onboot can break the OSTree systems.

I think using rpm-ostree and reinstalling may be a possible solution? I thought using rpm-ostree might be the best solution, but didnt know of the extreme breakages.