The man page for the rc-local at man systemd-rc-local-generator
doesn’t mention setting the Selinux context on the script you add to /etc/rc.d/rc.local but in my experience on Fedora 40, my rc-local service would not run at boot time until I did this in the /etc/rc.d/ directory:
After that if I rebooted, the rc.local generator would run correctly. Shouldn’t that man page make it clear you have to set those contexts or is this bug and that should not be necessary?
I was doing exactly the command the “Selinux Alert Browser” parroted to me to do that it said would correct the problem.
For the “semanage” one, it offered a whole list of -t options strings, I picked the systemd_rc_local_generator_exec_t because it seemed the logical one (since the rc-local is a generator)
If you just create /etc/rc.d/rc.local it will inherit the label from /etc/rc.d, which is “etc_t”. This will also work as the generator is allowed to access files labeld with “etc_t”.