SeLinux can break Atomic Fedora

Ask Fedora
, , , ,
1

I dont remember what exactly i did, but I broke SELinux somehow, deleted files and need to restore it. Normal procedure would be as far as I understood:

Mutable Fedora:

sudo setenforce 0
sudo dnf remove selinux-policy\* selinux-policy-targeted selinux-policy-devel policycoreutils-gui
sudo rm -rf /etc/selinux/targeted /etc/selinux/config
sudo dnf install selinux-policy-targeted
sudo dnf install selinux-policy-devel policycoreutils-gui
sudo touch /.autorelabel
reboot

Problems here: /etc/ is writable but /.autorelabel can’t be created. As far as I understood this means you can delete but not restore the configs.

Also the SELinux packages have some weird dependency problems so they can’t be removed. On Atomic it would look like

sudo setenforce 0
rpm-ostree override remove selinux-policy\* selinux-policy-targeted selinux-policy-devel policycoreutils-gui && rpm-ostree install selinux-policy-targeted selinux-policy-devel 
sudo rm -rf /etc/selinux/targeted /etc/selinux/config
#sudo touch /.autorelabel
reboot

CentOS 7 question

RockyLinux thread

2

See Troubleshooting :: Fedora Docs & Troubleshooting :: Fedora Docs.

3

So this is the solution?

rpm-ostree status -b | grep BaseCommit
                BaseCommit: 696991d589980aeaef5eda352dd7ad3d33c444c789c209f793a84bc6e7269aee
sudo ostree checkout -H <ID-of-BaseCommit> /ostree/repo/tmp/selinux-fix
sudo ostree fsck --delete
sudo ostree commit --consume --link-checkout-speedup --orphan --selinux-policy=/ /ostree/repo/tmp/selinux-fix
sudo restorecon -Rv /var
sudo restorecon -Rv /etc
sudo ostree admin deploy fedora:fedora/38/x86_64/silverblue
sudo reboot