Some problems about my script

Hi,a few days ago, I made a script to create Fedora (for Debian), but after finishing it, if you don’t add the selinux=0 parameter when booting ‘linux’, you’ll run into the problem shown in the picture.

Besides adding the ‘selinux=0’ parameter, how else can I fix it?

By the way, I asked AI and got a few mksquashfs commands, but they weren’t very satisfying (the final size is only half of the rootfs, and the finished product made by others through Lorax can reach a quarter of the original rootfs size, so I’m not happy). Are there any mksquashfs commands with higher compression?

Here is my script:


#!/bin/bash

mkdir chroot
rpm --initdb --root= $(realpath chroot)
dnf install @core @anaconda-tools anaconda-install-env-deps dracut-live anaconda-live  glibc-all-langpacks kernel-modules-extra kernel-modules livesys-scripts kernel -y --installroot $(realpath chroot)

mount --bind /run chroot/run
mount --bind /sys chroot/sys
mount --bind /tmp chroot/tmp
mount --bind /proc chroot/proc
mount --bind /dev chroot/dev
rm -r chroot/etc/resolv.conf
cp -r /etc/resolv.conf chroot/etc/resolv.conf
rm -r chroot/etc/yum.repos.d
cp -r /etc/yum.repos.d chroot/etc

chroot ./chroot dnf install @kde-desktop-environment -y
chroot ./chroot systemctl enable livesys-late.service livesys.service tmp.mount
chroot ./chroot /usr/bin/mandb
KERN_VER=$(ls -1 "chroot/lib/modules/" | head -1)
chroot ./chroot dracut -v --force --no-hostonly --no-hostonly-cmdline  --add "dmsquash-live network-manager overlayfs" --kernel-cmdline "systemd.log_level=debug systemd.log_target=console rd.shell=0" --modules "bash systemd dracut-systemd i18n plymouth drm kernel-modules dmsquash-live network-manager overlayfs rootfs-block fs-lib" --install "/bin/mount /bin/umount /bin/journalctl" initrd.img --kver ${KERN_VER}

umount -l chroot/tmp chroot/run chroot/sys chroot/proc chroot/dev chroot/sys

rm -f chroot/var/lib/rpm/\__db\* chroot/core\* chroot/var/lib/systemd/random-seed chroot/boot/*-rescue* chroot/etc/machine-id
touch chroot/etc/machine-id
cat >> chroot/etc/fstab << EOF
vartmp   /var/tmp    tmpfs   defaults   0  0
EOF
sed -i 's/^livesys_session=.\*/livesys_session="kde"/' chroot/etc/sysconfig/livesys

mkdir iso
mkdir iso/{boot,LiveOS}
mv chroot/initrd.img iso/LiveOS
cp chroot/boot/vmlinuz\* iso/LiveOS/vmlinuz
mkdir iso/boot/grub
cat >> iso/boot/grub/grub.cfg << EOF
set default="1"

function load_video {
insmod all_video
}

load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod ext2
insmod chain

set timeout=60

### END /etc/grub.d/00_header

search --no-floppy --set=root -l 'NirvanaOS-53'

### BEGIN /etc/grub.d/10_linux

menuentry 'Start NirvanaOS' --class fedora --class gnu-linux --class gnu --class os {
linux /LiveOS/vmlinuz root=live:CDLABEL=NirvanaOS-53  rd.live.image quiet rhgb
initrd /LiveOS/initrd.img
}
menuentry 'Start NirvanaOS (SELinux = 0)' --class fedora --class gnu-linux --class gnu --class os {
linux /LiveOS/vmlinuz root=live:CDLABEL=NirvanaOS-53  rd.live.image quiet rhgb selinux=0
initrd /LiveOS/initrd.img
}
menuentry 'Test this media & start NirvanaOS' --class fedora --class gnu-linux --class gnu --class os {
linux /LiveOS/vmlinuz root=live:CDLABEL=NirvanaOS-53  rd.live.image rd.live.check quiet
initrd /LiveOS/initrd.img
}
submenu 'Troubleshooting -->' {
menuentry 'Start NirvanaOS in basic graphics mode' --class fedora --class gnu-linux --class gnu --class os {
linux /LiveOS/vmlinuz root=live:CDLABEL=NirvanaOS-53  rd.live.image nomodeset vga=791 quiet rhgb
initrd /LiveOS/initrd.img
}
menuentry 'Boot first drive' --class fedora --class gnu-linux --class gnu --class os {
chainloader (hd0)+1
}
EOF
mksquashfs chroot squashfs.img -noappend -comp xz -b 1M -Xdict-size 100% -Xbcj x86 -e /tmp/\* /var/run/\* /var/lock/\*  -xattrs
mv squashfs.img ./iso/LiveOS
grub-mkrescue -o result.iso -V "NirvanaOS-53" iso   -iso-level 3  -J -R

Hi Hankon. It is better to use enforcing=0. When you use selinux=0, it completely disables SELinux and the file labels cannot be created or restored. With enforcing=0, SELinux runs in permissive mode so that the functionality is still there, but nothing will be blocked.

As for your script, make sure the policycoreutils package is installed and run fixfiles -F onboot at the end. After running that command, the next time your image boots, it should automatically fix the SELinux permissions on all the files.


TIP: Rather than manually creating all those bind mounts, you can use the systemd-nspawn command with the -D parameter.[1] systemd-nspawn does something similar to chroot, but it configures all those mount points automatically. In particular, for creating a minimal image, see “Example 2” near the end of the systemd-nspawn man page.[2]


  1. You can omit -b if you just want to chroot without booting the system. ↩︎

  2. See the systemd-firstboot man page for info about how to initialize a new Fedora Linux image (machine-id, root password, etc.). ↩︎

Fedora systems employs SELinux for fine-grained access control and process separation by default, while Debian does not (Debian default to use AppArmor instead). SELinux relies on file context to make access control decisions, but since this Fedora system is installed from Debian (with SELinux disabled), it doesn’t write context along with the files during bootstrapping, so if you don’t disable SELinux on boot, it will throw a fit and deny access to everything, making system unbootable, because it can’t make access control decision at all (and everything falls back to “default deny”).

In this case, a full filesystem relabel might help with this. Create an empty file called .autorelabel under the root filesystem of Fedora (with livecd or something), and reboot the machine. Remember to remove selinux=0 from kernel command line before rebooting.

Gregory Lee Bartholomew notifications@fedoraproject.discoursemail.com
writes:

Hi Hankon. It is better to use enforcing=0. When you use selinux=0, it completely disables SELinux and the file labels cannot be created or restored. With enforcing=0, SELinux runs in permissive mode so that the functionality is still there, but nothing will be blocked.

As for your script, make sure the policycoreutils package is installed and run fixfiles -F onboot at the end. After running that command, the next time your image boots, it should automatically fix the SELinux permissions on all the files.

It’s also possible to relabel files directly during the compose using setfiles

  • it will save you one reboot, something like:
setfiles -r `pwd`/chroot `pwd`/chroot/etc/selinux/targeted/contexts/files/file_contexts `pwd`/chroot