From a2b72a5196c4ca54993efbb4238ebe6b59e194b7 Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Tue, 13 Feb 2024 09:50:37 -0500
Subject: [PATCH] Ensure root_t label for /store

The way osbuild works is to synthesize a filesystem tree in the
store, then copy it to the disk.  This ensures the label for the
store is `root_t` which ends up being the labeling for
the "infrastructure" bits in the `/ostree` repository in the
target root.

This in turn is blocking a lot of things.

Closes: https://github.com/osbuild/bootc-image-builder/issues/149
---
 bib/cmd/bootc-image-builder/main.go |  2 +-
 bib/internal/setup/setup.go         | 13 +++++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/bib/cmd/bootc-image-builder/main.go b/bib/cmd/bootc-image-builder/main.go
index 6db227c1a..2e68d3626 100644
--- a/bib/cmd/bootc-image-builder/main.go
+++ b/bib/cmd/bootc-image-builder/main.go
@@ -237,7 +237,7 @@ func cmdBuild(cmd *cobra.Command, args []string) error {
 	if err := setup.Validate(); err != nil {
 		return err
 	}
-	if err := setup.EnsureEnvironment(); err != nil {
+	if err := setup.EnsureEnvironment(osbuildStore); err != nil {
 		return err
 	}
 
diff --git a/bib/internal/setup/setup.go b/bib/internal/setup/setup.go
index 944a64d0c..be97ae74d 100644
--- a/bib/internal/setup/setup.go
+++ b/bib/internal/setup/setup.go
@@ -12,13 +12,21 @@ import (
 
 // EnsureEnvironment mutates external filesystem state as necessary
 // to run in a container environment.  This function is idempotent.
-func EnsureEnvironment() error {
+func EnsureEnvironment(storePath string) error {
 	osbuildPath := "/usr/bin/osbuild"
 	if util.IsMountpoint(osbuildPath) {
 		return nil
 	}
 
-	// A hardcoded security label from Fedora derivatives
+	// Forcibly label the store to ensure we're not grabbing container labels
+	rootType := "system_u:object_r:root_t:s0"
+	// This papers over the lack of ensuring correct labels for the /ostree root
+	// in the existing pipeline
+	if err := util.RunCmdSync("chcon", rootType, storePath); err != nil {
+		return err
+	}
+
+	// A hardcoded security label from Fedora derivatives for osbuild
 	// TODO: Avoid hardcoding this by using either host policy lookup
 	// Or eventually depend on privileged containers just having this capability.
 	//
@@ -53,6 +61,7 @@ func EnsureEnvironment() error {
 	if err := util.RunCmdSync("mount", "--bind", destPath, osbuildPath); err != nil {
 		return err
 	}
+
 	return nil
 }